Provisioning layer two network access for mobile devices

• US 9,398,010 B1
• Filed: 03/23/2015
• Issued: 07/19/2016
• Est. Priority Date: 04/19/2011
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Inventors: Chickering, Roger A., Venable, Jeffrey C. Sr.
• Primary Examiner(s): Leung, Robert
• Application Number:
  US14/666,208
• Time in Patent Office: 484 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

In general, techniques are described for provisioning layer two access in computer networks. A network device located in a public network comprising an interface and a control unit may implement the techniques. The interface establishes a session with a mobile device. The control unit requests security state data identifying a security state of the mobile device via the established session. The interface receives a mobile device identifier and the security state data from the mobile device via the session. The mobile device identifier identifies the mobile device. The control unit publishes the security state information to a database such that the security state information is associated with the mobile device identifier.

Claims

1. A method comprising:

establishing, with a network device positioned in a public network, a session with a mobile device via a first interface of the mobile device;

requesting, with the network device, security state data identifying a security state of the mobile device via the established session;

receiving, with the network device, a mobile device identifier and the security state data from the mobile device via the session, wherein the mobile device identifier identifies the mobile device, wherein the mobile device identifier identifies a second interface of the mobile device that is used for communicating with a private network; and

publishing the security state information to a database securely accessible by an authentication device positioned in the private network such that the security state information is associated with the mobile device identifier and enables automatic authentication of the mobile device by the authentication device when the mobile device connects to the private network via the second interface prior to establishing a layer three session with the private network.

2. The method of claim 1, further comprising:

determining configuration data to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled, and wherein the security features include one or more of anti-virus, anti-malware, anti-spam, firewall, theft protection, and monitor and control security features; and

transmitting the configuration data to the mobile device via the session to configure the one or more security modules executing on the mobile device to enable those of the security features identified by the configuration data.

3. The method of claim 1, further comprising:

determining whether the mobile device has previously registered with the network device;

in response to determining that the mobile device has not previously registered with the network device, creating a profile for the mobile device identified by the mobile device identifier;

determining configuration data to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled;

transmitting the configuration data to the mobile device via the session to configure the one or more security modules executing on the mobile device to enable those of the security features identified by the configuration data;

storing the configuration data to the profile;

storing the security state data to the profile; and

publishing the profile to the database.

4. The method of claim 2, further comprising transmitting 802.1X configuration settings to the mobile device via the session to configure an 802.1X supplicant module on the mobile device,

wherein the profile published to the database includes information describing the 802.1X configuration settings, and

wherein the information describing the 802.1X configuration settings comprises one or more of an identifier of an X.509 certificate and a username.

5. The method of claim 1,

wherein the first interface comprises a wireless network interface,

wherein the second interface comprises a cellular interface, and

wherein the mobile device identifier comprises a layer 2 address associated with the wireless network interface of the mobile device that is different from the cellular interface of the mobile device used to communicate with the public network.

6. The method of claim 1, further comprising:

receiving registration information from the mobile device via the public network, wherein the registration information registers the mobile device with the network device; and

registering the mobile device with the network device based on the registration information,

wherein requesting security state data comprises, after successfully registering the mobile device with the network device, requesting the security state data identifying the security state of the mobile device.

7. The method of claim 1, further comprising:

prior to establishing the layer three session with the private network, receiving, with an authentication device, an authentication request from a wireless access point in an attempt by the wireless access point to authenticate the mobile device to locally access the private network wirelessly;

based on the authentication request, determining the mobile device identifier that identifies the mobile device with the authentication device;

retrieving the security state data associated with the determined mobile device identifier from the database;

determining, with the authentication device, a level of access to the private network permitted to the mobile device based on the retrieved security state data; and

prior to establishing the layer three session with the private network, transmitting the level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the level of access determined by the authentication device.

8. The method of claim 7, further comprising publishing, with the authentication device, a request-for-information to the database so as to provoke the network device to obtain and publish updated security state data.

10. The network device of claim 1,

wherein the control unit further determines configuration data to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled, and wherein the security features include one or more of anti-virus, anti-malware, anti-spam, firewall, theft protection, and monitor and control security features;

and

wherein the at least one interface transmits the configuration data to the mobile device via the session to configure the one or more security modules executing on the mobile device to enable those of the security features identified by the configuration data.

11. The network device of claim 1,

wherein the control unit further determines whether the mobile device has previously registered with the network device, in response to determining that the mobile device has not previously registered with the network device, creates a profile for the mobile device identified by the mobile device identifier, and determines configuration data to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled, and

wherein the at least one interface transmits the configuration data to the mobile device via the session to configure the one or more security modules executing on the mobile device to enable those of the security features identified by the configuration data, and

wherein the control unit stores the configuration data to the profile, stores the security state data to the profile, and publishes the profile to the database.

9. A network device located in a public network, the network device comprising:

at least one interface that establishes a session with a mobile device via a first interface of the mobile device; and

a control unit that requests security state data identifying a security state of the mobile device via the established session,

wherein the at least one interface receives a mobile device identifier and the security state data from the mobile device via the session, wherein the mobile device identifier identifies a second interface of the mobile device that is used for communicating with a private network, and

wherein the control unit publishes the security state information to a database securely accessible by an authentication device positioned in the private network such that the security state information is associated with the mobile device identifier and enables automatic authentication of the mobile device when the mobile device connects to the private network via the second interface prior to establishing a layer three session with the private network.

12. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to:

establish, with a network device positioned in a public network, a session with a mobile device via a first interface of the mobile device;

request, with the network device, security state data identifying a security state of the mobile device via the established session;

receive, with the network device, a mobile device identifier and the security state data from the mobile device via the session, wherein the mobile device identifier identifies a second interface of the mobile device that is used for communicating with a private network; and

publish the security state information to a database securely accessible by an authentication device positioned in the private network such that the security state information is associated with the mobile device identifier and enables automatic authentication of the mobile device by the authentication device when the mobile device connects to the private network via the second interface prior to establishing a layer three session with the private network.

13. A method comprising:

prior to establishing a layer three session with a mobile device, receiving, with an authentication device, an authentication request from a wireless access point in an attempt by the wireless access point to authenticate the mobile device to locally access a private network wirelessly;

based on the authentication request, determining, with the authentication device, a mobile device identifier that identifies a second interface of the mobile device used to communicate with the private network;

retrieving security state data associated with the determined mobile device identifier from the database, the security state data provided by the mobile device when positioned in a public network via a first interface of the mobile device;

determining, with the authentication device, a level of access to the private network permitted to the mobile device based on the retrieved security state data; and

prior to establishing the layer three session with the mobile device, transmitting the level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the level of access determined by the authentication device.

14. The method of claim 13,

wherein the database is accessed using interface for metadata access point (IF-MAP), and

wherein retrieving security state data comprises:

generating an IF-MAP query formulated in accordance with the IF-MAP specification that requests any security state data associated with the determined MAC address;

transmitting the IF-MAP query to the IF-MAP database; and

receiving an IF-MAP message in response to the IF-MAP query providing the security state data associated with the determined MAC address.

15. The method of claim 14, further comprising publishing, with the authentication device, a request-for-information to the database so as to provoke a network device to obtain and publish updated security state data.

16. The method of claim 14, further comprising:

subscribing, with the authentication device, to the database for changes to the updated security state data;

in response to changes to the updated security state data, determining, with the authentication device, a new level of access; and

transmitting the new level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the new level of access determined by the authentication device.

17. The method of claim 13, further comprising:

retrieving, with the authentication device, a profile created by the network device from the database that associates the mobile device identifier with the security state data and configuration data used to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled; and

determining, with the authentication device, the level of access to the private network permitted to the mobile device based on the retrieved profile.

18. An authentication device comprising:

at least one interface configured to, prior to establishing a layer three session with a mobile device, receive an authentication request from a wireless access point in an attempt by the wireless access point to authenticate the mobile device to locally access a private network wirelessly; and

a control unit configured to, based on the authentication request, determine a mobile device identifier that identifies a second interface of the mobile device used to communicate with the private network, retrieve security state data associated with the determined mobile device identifier from the database, the security state data provided by the mobile device when positioned in a public network via a first interface of the mobile device, determine, with the authentication device, a level of access to the private network permitted to the mobile device based on the retrieved security state data,

wherein the at least one interface is further configured to, prior to establishing the layer three session with the mobile device, transmit the level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the level of access determined by the authentication device.

19. The authentication device of claim 18, wherein the control unit publishes a request-for-information to the database so as to provoke the wireless access point to obtain and publish updated security state data.

20. The authentication device of claim 19,

wherein the control unit of the authentication device further subscribes to the database for changes to the updated security state data and, in response to changes to the updated security state data, determines a new level of access, and

wherein the at least one interface of the authentication device transmits the new level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the new level of access determined by the authentication device.

21. The authentication device of claim 18, wherein the control unit retrieves a profile created by the wireless access point from the database that associates the mobile device identifier with the security state data and configuration data used to configure one or more security modules executing on the mobile device, wherein the configuration data specifies whether one or more security features provided by the one or more security modules executing on the mobile device are enabled and determines the level of access to the private network permitted to the mobile device based on the retrieved profile.

22. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed, cause one or more processors to:

prior to establishing a layer three session with a mobile device, receive an authentication request from a wireless access point in an attempt by the wireless access point to authenticate the mobile device to locally access a private network wirelessly;

based on the authentication request, determine a mobile device identifier that identifies a second interface of the mobile device used to communicate with the private network;

retrieve security state data associated with the determined mobile device identifier from the database, the security state data provided by the mobile device when positioned in a public network via a first interface of the mobile device;

determine a level of access to the private network permitted to the mobile device based on the retrieved security state data; and

prior to establishing the layer three session with the mobile device, transmit the level of access to the wireless access point so that the wireless access point enforces, with respect to communications sent to and received from the mobile device, the determined level of access.