Restricting Network Access While Connected to an Untrusted Network

• US 20120198519A1
• Filed: 02/02/2011
• Published: 08/02/2012
• Est. Priority Date: 02/02/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Parla, Vincent E., Gladstone, Philip John Steuart, Fitzgerald, Christopher
• Granted Patent: US 9,077,730 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In an example embodiment, disclosed herein is an apparatus comprising an interface configured to communicate with at least one external device, and processing logic coupled with the interface. The processing logic determines whether the interface is connected directly to a predefined network. The processing logic restricts access to the interface responsive to determining the interface is connected to a network other than the predefined network. The processing logic does not restrict access to the interface while the interface is directly connected with the predefined network.

Claims

1. An apparatus, comprising:

an interface configured to communicate with at least one external device; and

processing logic coupled with the interface;

wherein the processing logic determines whether the interface is connected directly to a predefined network;

wherein the processing logic restricts access to the interface responsive to determining the interface is connected to a network other than the predefined network; and

wherein the processing logic does not restrict access to the interface while the interface is directly connected with the predefined network.

2. The apparatus of claim 1, wherein the processing logic restricts access by blocking access to the interface.

3. The apparatus of claim 1, wherein the processing logic restricts access by allowing limited access to the interface.

4. The apparatus of claim 3, wherein the processing logic restricts access to the interface to predefined protocols.

5. The apparatus of claim 4, wherein the processing logic permits the predefined protocols for a limited time period.

6. The apparatus of claim 1, wherein the processing logic attempts to establish a secure connection with a device that provides access to the predefined network while the interface is connected to a network other than the predefined network.

7. The apparatus of claim 6, wherein the secure connection is a virtual private network connection and the device is a virtual private network endpoint.

8. The apparatus of claim 7, wherein the processing logic restricts access to the interface to communications with the virtual private network once communications via the virtual private network is established while connected to a network other than the predefined network.

9. The apparatus of claim 1, wherein the processing logic blocks remote procedure calls from passing through the interface while the interface is connected to a network other than the predefined network.

10. The apparatus of claim 1, wherein the processing logic determines whether the interface is coupled with the predefined network by sending a secure hypertext transfer protocol probe via the interface.

11. The apparatus of claim 1, wherein the processing logic determines whether the interface is coupled with the predefined network by obtaining a domain name server list associated with the interface.

12. The apparatus of claim 1, wherein the processing logic determines whether the interface is coupled with the predefined network by determining what servers are connected to the interface.

13. The apparatus of claim 1, wherein the processing logic establishes a secure connection with a device on the predefined network while the interface is connected to a network other than the predefined network;

wherein the processing logic suspends the secure connection responsive to determining the interface has connected with the predefined network; and

wherein the processing logic resumes the secure connection responsive to determining the interface is no longer connected with the predefined network.

14. The apparatus of claim 1, wherein the processing logic cryptographically verifies the interface is coupled with the predefined network.

15. A method, comprising:

determining whether an interface is connected to a predefined network;

selectively restricting access to the interface by a processor while the interface is connected to a network other than the predefined network; and

removing the restrictions to the access to the interface by a processor while the interface is connected to the predefined network.

16. The method according to claim 15, the selectively restricting comprises allowing access to the interface to establish a secure connection with the predefined network while connected with a network other than the predefined network.

17. The method according to claim 15, the selectively restricting comprises limiting access to the interface to the secure connection upon establishing the secure connection.

18. The method according to claim 17, wherein the secure connection is a virtual private network connection.

19. The method according to claim 15, wherein determining whether the interface is connected to a predefined network comprises probing for a server with a known name and cryptographically verifying the connection with the server.

20. The method according to claim 15, determining whether the interface is connected to a predefined network comprises obtaining dynamic host configuration protocol parameters via the interface;

and

determining whether the dynamic host configuration protocol parameters are appropriate for the predefined network.

21. Logic encoded on at least one non-transitory tangible media for execution by a processor, and when executed operable to:

determine whether an interface is connected to a predefined network;

selectively restrict access to the interface by a processor while the interface is connected to a network other than the predefined network; and

permit unrestricted access to the interface by a processor while the interface is connected to the predefined network.