Portable Proxy For Security Management And Privacy Protection And Method Of Use

• US 20150288719A1
• Filed: 04/03/2014
• Published: 10/08/2015
• Est. Priority Date: 04/03/2014
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Uzun, Ersin, De Cristofaro, Emiliano, Freudiger, Julien, Sarwar, Golam
• Granted Patent: US 9,578,062 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A portable proxy for security management and privacy protection and methods of use are provided. The proxy establishes a connection to a user device. The proxy also establishes a secure connection to a virtual private network (VPN), performs authentication of the proxy to the VPN, and upon successful completion of the proxy authentication provides access to the VPN through the secure connection user credentials. Once the VPN accepts the credentials, the proxy routes at least a portion of Internet traffic between the user device and the VPN through the secure connection and the connection to the user device. The proxy can also establish a secure connection to an anonymizing service and route all Internet traffic of the user device through the anonymizing service using the secure connection and the connection to the user device.

Claims

1. A portable proxy for network security management, comprising:

a communication interface configured to connect to a user device and to securely connect to a virtual private network;

a memory configured to store proxy authentication data; and

a processor coupled to the memory and configured to execute code, comprising;

an authentication module configured to perform a proxy authentication protocol with the virtual private network using the proxy authentication data through the secure connection;

a user module configured to provide through the secure connection user credentials upon a successful completion of the proxy authentication protocol; and

a routing module configured to route at least a portion of user device Internet traffic between the user device and the virtual private network through the secure connection and the connection to the user device following an acceptance of the credentials by the virtual private network.

2. A proxy according to claim 1, further comprising:

a wireless transceiver configured to create a wireless network through which the communication interface connects to the user device.

3. A proxy according to claim 2, further comprising:

possession verification information; and

a permission module configured to receive the possession verification information from the user device and to allow the user device to connect to the wireless network upon receiving the possession verification information.

4. A proxy according to claim 3, further comprising:

a housing on which a barcode is comprised,

wherein the possession verification information is comprised in the barcode.

5. A proxy according to claim 3, further comprising at least one of:

a housing on which a name of the wireless network and a password to the wireless network are comprised;

an RFID tag comprised in the housing;

wherein the possession verification information comprises at least one of the name together with the password and a scan of the RFID tag.

6. A proxy according to claim 2, further comprising:

an RFID scanner;

a permission module configured to receive a scan of an RFID tag from the RFID scanner, to identify the scan as associated with a user authorized to access the virtual private network, and to allow the user device to connect to the wireless network upon the identification.

7. A proxy according to claim 1, further comprising:

a credentials module configured to obtain the credentials, comprising at least one of;

an address module configured to determine the credentials comprising a MAC address of the user device;

a receipt module configured to receive the credentials comprising a user name and a password of the user from the user device.

8. A proxy according to claim 1, comprising at least one of:

a certificate module configured to provide a public key certificate comprised in the proxy authentication data to the virtual private network; and

a shared key module configured to perform a shared key exchange with the virtual private network using the proxy authentication data.

9. A proxy according to claim 1, further comprising:

a security policy associated with the virtual private network stored in the memory; and

a filtering module configured to filter the user device Internet traffic based on the security policy.

10. A proxy according to claim 9, wherein the filtering comprises at least one of blocking the user device from accessing Internet sites blacklisted in the security policy, allowing access to Internet sites whitelisted in the security policy, limiting a time during which the user device can access the Internet, performing deep packet inspection, monitoring online behavior of a user associated with the user device, and limiting access to one or more Internet services.

11. A proxy according to claim 9, further comprising:

an intrusion detection module configured to monitor the user device Internet traffic and to take an action based on the monitoring and the security policy.

12. A proxy according to claim 11, further comprising:

an interception module configured to intercept the user device Internet traffic exchanged between the user device and a destination on the Internet other than the virtual private network; and

a relay module to relay the intercepted traffic between the destination and the user device.

13. A proxy according to claim 9, further comprising:

a syncing module configured to receive one or more of a software update, an update to the security policy, and an update to the proxy authentication data from the virtual private network through the secure connection.

14. A proxy according to claim 1, further comprising:

a connection module configured to determine whether the communication interface is connected to the Internet;

a search module configured to search for available networks and to present a list of the available networks through the user device upon the determination that the communication interface is not connected to the Internet;

a selection module configured to receive a user selection of one of the networks on the list;

a connectivity module configured to check a connectivity status of the selected network;

a terms module configured to present terms of service of an Internet gateway associated with the selected network through the user device and to accept the terms of service upon receiving a user command; and

a connection module configured to establish a connection to the Internet through the selected network; and

a secure connection configured module to establish the secure connection to the virtual private network via the Internet.

15. A portable proxy for privacy protection, comprising:

a communication interface configured to connect to a user device and to securely connect to an anonymizing service; and

a processor coupled to a memory to execute code, comprising;

a routing module to route substantially all Internet traffic of the user device through the anonymizing service using the connection to the user device and the secure connection.

16. A proxy according to claim 15, further comprising:

a wireless transceiver configured to create a wireless network through which the communication interface connects to the user device.

17. A proxy according to claim 16, further comprising:

possession verification information; and

a permission module configured to receive the possession verification information from the user device and to allow the user device to connect to the wireless network upon receiving the possession verification information.

18. A proxy according to claim 17, further comprising at least one of:

a housing on which a barcode is comprised,

the name of the wireless network and a password to the wireless network comprised on the housing; and

an RFID tag comprised within the housing,

wherein the possession verification information comprises at least one of a scan of the barcode, a scan of the RFID tag, and the name together with the password.

19. A proxy according to claim 16, further comprising:

an RFID scanner;

a permission module configured to receive a scan of an RFID tag from the RFID scanner, to identify the scan as associated with an authorized user, and to allow the user device to connect to the wireless network upon the identification.

20. A proxy according to claim 16, further comprising:

a connection module configured to determine whether the communication interface is connected to the Internet;

a search module configured to search for available networks and to present a list of the available networks through the user device upon the determination that the communication interface is not connected to the Internet;

a selection module configured to receive a user selection of one of the networks on the list;

a connectivity module configured to check a connectivity status of the selected network;

a terms module configured to present terms of service of an Internet gateway associated with the selected network through the user device and to accept the terms of service upon receiving a user command; and

a connection module configured to establish a connection to the Internet through the selected network; and

a secure connection module configured to establish the secure connection to the anonymizing service via the Internet.