SYSTEM AND METHOD FOR DOUBLE-CAPTURE/DOUBLE-REDIRECT TO A DIFFERENT LOCATION

• US 20100064356A1
• Filed: 11/16/2009
• Published: 03/11/2010
• Est. Priority Date: 03/10/2004
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Eric White
• Inventors: Martin, John, White, Eric, Johnston, Keith
• Granted Patent: US 8,356,336 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04W 12/062 Pre-authentication

Abstract

Embodiments disclosed herein provide a system, method, and computer program product for providing network access control for a shared network. One embodiment of a network access controller may intercept a request to access a network resource from a browser application running on a client device associated with an anonymous user and determine whether the network resource is in a set of network destinations in the shared network. If the network resource is in the set of network destinations, the network access controller may direct the browser application to the network resource. If the network resource is not in the set of network destinations, the network access controller may redirect the browser application to a pre-authentication capture destination in the shared network. From the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations in the shared network without authentication.

Claims

1. A method for automatic pre-authentication redirection of network traffic, comprising:

providing a network access controller in a shared network, wherein the shared network comprises a plurality of server computers and a set of network destinations hosted on the plurality of server computers;

intercepting at the network access controller a request to access a network resource from a browser application running on a client device associated with an anonymous user;

determining whether the network resource referenced in the request is in the set of network destinations hosted on the plurality of server computers in the shared network;

if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device associated with the anonymous user to the network resource; and

if the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

2. The method according to claim 1, wherein the network resource is at a network location external to the shared network.

3. The method according to claim 1, wherein the redirecting further comprises sending from the network access controller to the client device a response containing an identifier identifying the pre-authentication capture destination.

4. The method according to claim 1, further comprising:

redirecting the browser application running on the client device back to the pre-authentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

5. The method according to claim 1, further comprising:

intercepting at the network access controller a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; and

determining whether the second request contains an authentication token.

6. The method according to claim 5, wherein the second request does not contain the authentication token, further comprising redirecting the browser application running on the client device associated with the anonymous user back to the pre-authentication capture destination hosted on the first server computer in the shared network.

7. The method according to claim 5, wherein the second request contains the authentication token, further comprising redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.

8. The method according to claim 7, wherein the anonymous user is authenticated by the second server computer for network access external to the shared network.

9. A computer program product comprising a computer readable storage medium storing computer instructions translatable by a processor to perform:

intercepting at a network access controller a request to access a network resource from a browser application running on a client device associated with an anonymous user;

determining whether the network resource referenced in the request is in a set of network destinations hosted on a plurality of server computers in a shared network;

if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device associated with the anonymous user to the network resource; and

if the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

10. The computer program product of claim 9, wherein the redirecting further comprises sending from the network access controller to the client device a response containing an identifier identifying the pre-authentication capture destination.

11. The computer program product of claim 9, wherein the computer instructions are further translatable by the processor to perform:

redirecting the browser application running on the client device back to the pre-authentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

12. The computer program product of claim 9, wherein the computer instructions are further translatable by the processor to perform:

intercepting at the network access controller a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; and

determining whether the second request contains an authentication token.

13. The computer program product of claim 12, wherein the second request does not contain the authentication token and wherein the computer instructions are further translatable by the processor to perform:

redirecting the browser application running on the client device associated with the anonymous user back to the pre-authentication capture destination hosted on the first server computer in the shared network.

14. The computer program product of claim 12, wherein the second request contains the authentication token and wherein the computer instructions are further translatable by the processor to perform:

redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.

15. The computer program product of claim 14, wherein the anonymous user is authenticated by the second server computer for network access external to the shared network and wherein the computer instructions are further translatable by the processor to perform:

allowing the client device access to the second network resource.

16. An apparatus for controlling network access, comprising:

a processor; and

a computer readable storage medium storing computer instructions translatable by the processor to perform;

intercepting a request to access a network resource from a browser application running on a client device coupled to the apparatus, wherein the client device is associated with an anonymous user;

determining whether the network resource referenced in the request is in a set of network destinations hosted on a plurality of server computers coupled to the apparatus, wherein the plurality of server computers resides on a shared network;

if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device associated with the anonymous user to the network resource; and

if the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

17. The apparatus of claim 16, wherein the computer instructions are further translatable by the processor to redirect the browser application running on the client device back to the pre-authentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

18. The apparatus of claim 16, further comprising:

a first network interface coupled to the processor, wherein the computer instructions are further translatable by the processor to continuously monitor for network access from client devices on the first network interface.

19. The apparatus of claim 18, wherein the computer instructions are further translatable by the processor to perform:

intercepting a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; and

determining whether the second request contains an authentication token.

20. The apparatus of claim 19, wherein the computer instructions are further translatable by the processor to perform:

if the second request does not contain the authentication token, redirecting the browser application running on the client device associated with the anonymous user back to the pre-authentication capture destination hosted on the first server computer in the shared network; and

if the second request contains the authentication token, redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.