Gateway notification to client devices

• US 20060272014A1
• Filed: 05/26/2005
• Published: 11/30/2006
• Est. Priority Date: 05/26/2005
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Harrington, Kendra S., McRae, Matthew B.
• Application Number:
  US11/139,170
• Publication Number:
  US 20060272014A1
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A gateway device is provided, wherein the device is configured to initiate communication with a client device to notify the client device of detected network events and to query the user for action. A method of managing a gateway device is provided. The method includes: detecting an unauthorized network event, transmitting from the gateway device to a client device over a local area network (LAN) a message indicating the detection of the unauthorized or unexpected network event and requesting a response from a user of the client device, receiving the response from the client device, and handling the unauthorized or unexpected network event pursuant to the response from the client device.

Claims

1. A method of managing a gateway device, comprising:

detecting an unauthorized network event;

transmitting from the gateway device to a client device over a local area network (LAN) a message indicating the detection of the unauthorized network event and requesting a response from a user of the client device;

receiving the response from the client device; and

handling the unauthorized network event pursuant to the response from the client device.

2. The method of claim 1, wherein:

said gateway device comprises a router.

3. The method of claim 1, wherein:

said detecting the unauthorized network event comprises detecting network traffic prohibited by a firewall in the gateway device.

4. The method of claim 3, wherein:

said handling the unauthorized network event comprises updating an access rules data structure of the firewall.

5. The method of claim 3, wherein:

said unauthorized network event comprises an attempt to access a port blocked by the firewall.

6. The method of claim 5, wherein:

said requesting the response from the user of the client device comprises requesting the user to select an action from the list of actions comprising;

continue blocking the port, temporarily allowing the network traffic through the port, and permanently allowing the network traffic to the port.

7. The method of claim 3, wherein:

said detecting the unauthorized network event comprises detection of potential malware in network traffic through the firewall.

8. The method of claim 7, wherein:

said requesting the response from the user of the client device comprises requesting the user to select an action from the list of actions comprising;

allow the network traffic and block the network traffic.

9. The method of claim 1, wherein:

said detecting the unauthorized network event comprises detecting an attempt at a first client device to access a prohibited web page; and

said transmitting to the client device comprises transmitting to a second client device the message indicating the detection of the unauthorized network event and prompting the user of the second client device for the response.

10. The method of claim 1, wherein:

said gateway device comprises a wireless access point (WAP); and

said detecting the unauthorized network event comprises detection of a new client device attempting to access the WAP.

11. The method of claim 10, wherein:

said requesting the response from the user of the client device comprises requesting the user to select an action from the list of actions comprising;

block the new client device from accessing the WAP and allow the new client device to access the WAP.

12. The method of claim 1, further comprising:

executing on the client device a traffic monitoring application for receiving messages from the gateway device, for prompting the user to submit the response, and for transmitting the response to the gateway device.

13. A gateway device, comprising:

a first network interface for communicating with a first network;

a second network interface for communicating with one or more client devices on a second network; and

a traffic monitor configured to monitor network traffic through the gateway device and in response to detecting an unauthorized network event, to transmit to a client device a message indicating the detection of the unauthorized network event and requesting a response from a user of the client device, wherein the traffic monitor is further configured to handle the unauthorized network event pursuant to the response from the client device.

14. The device of claim 13, wherein:

said gateway device comprises a router.

15. The device of claim 13, wherein:

said detecting the unauthorized network event comprises detecting network traffic prohibited by a firewall in the gateway device.

16. The device of claim 15, wherein:

said traffic monitor is configured to handle the unauthorized network event by updating an access rules data structure of the firewall.

17. The device of claim 15, wherein:

said unauthorized network event comprises an attempt to access a port blocked by the firewall.

18. The device of claim 17, wherein:

said traffic monitor is configured to request the response from the user of the client device by requesting the user to select an action from the list of actions comprising;

continue blocking the port, temporarily allowing the network traffic through the port, and permanently allowing the network traffic to the port.

19. The device of claim 15, wherein:

said detecting the unauthorized network event comprises detection of potential malware in network traffic through the firewall.

20. The device of claim 19, wherein:

said traffic monitor is configured to request the response from the user of the client device by requesting the user to select an action from the list of actions comprising;

allow the network traffic and block the network traffic.

21. The device of claim 13, wherein:

said detecting the unauthorized network event comprises detecting an attempt at a first client device to access a prohibited web page; and

said traffic monitor is configured to transmit to the client device the message indicating the detection of the unauthorized network event by transmitting to a second client device the message indicating the detection of the unauthorized network event and prompting the user of the second client device for the response.

22. The device of claim 13, wherein:

said gateway device comprises a wireless access point (WAP); and

said detecting the unauthorized network event comprises detection of a new client device attempting to access the WAP.

23. The device of claim 22, wherein:

said traffic monitor is configured to request the response from the user of the client device by requesting the user to select an action from the list of actions comprising;

block the new client device from accessing the WAP and allow the new client device to access the WAP.

24. The device of claim 13, wherein:

said traffic monitor is configured to execute on the client device a traffic monitoring application for receiving messages from the gateway device, for prompting the user to submit the response, and for transmitting the response to the gateway device.

25. A gateway device, comprising:

a first network interface means for communicating with a first network;

a second network interface means for communicating with one or more client devices on a second network; and

a traffic monitoring means for monitoring network traffic through the gateway device and for transmitting to a client device a message indicating detection of an unauthorized network event and requesting a response from a user of the client device, wherein the traffic monitoring means is further configured to handle the unauthorized network event pursuant to the response from the client device.