Client network access provision by a network traffic manager

• US 9,736,120 B2
• Filed: 09/09/2016
• Issued: 08/15/2017
• Est. Priority Date: 10/16/2015
• Status: Active Grant

• Current Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Original Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Inventors: Rose, Adam Douglas, Glazemakers, Kurt
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US15/260,881
• Publication Number:
  US 20170111317A1
• Time in Patent Office: 340 Days
• Field of Search: 726 1
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

In one embodiment, a computer implemented method provides a client computing device network access to a private network by a network traffic manager, and the method includes: obtaining context parameters related to a context of the client computing device; selecting as a function of the context parameters one or more policies as selected policies, wherein each policy is associated with one or more network entitlement rules defining network access rules to a networking device or an application in the private network according to the policy; retrieving the one or more network entitlement rules associated with the selected policies; and providing the network traffic manager with the one or more network entitlement rules, thereby providing the client computing device the network access.

Claims

1. A computer implemented method for providing network access for a client computing device to a private network by a network traffic manager, the method comprising:

obtaining, by a first networking device from the client computing device, context parameters related to a context of the client computing device;

selecting, by the first networking device, as a function of the context parameters, one or more policies as selected policies, wherein each policy is associated with one or more network entitlement rules defining network access rules for a networking device or an application in the private network according to the policy;

retrieving, by the first networking device, the one or more network entitlement rules associated with the selected policies; and

providing, by the first networking device, the one or more network entitlement rules to the client computing device upon authentication of the client computing device with the first networking device, wherein the one or more network entitlement rules are not alterable by the client computing device, and the client computing device to provide the one or more network entitlement rules to the network traffic manager, thereby providing the network access for the client computing device.

2. The method of claim 1, wherein the selecting comprises performing a predefined logical combination of the context parameters.

3. The method of claim 1, wherein the selecting comprises performing a predefined Boolean combination of the context parameters.

4. The method of claim 1, wherein the context parameters comprise at least one of:

a device parameter indicative for a state or property of the client computing device;

a user parameter indicative for a property of a user of the client computing device;

or

a system parameter indicative for a property of a framework configuration of the client computing device.

5. The method of claim 4, wherein the device parameter comprises at least one of:

a network address of the client computing device, a certificate of the client computing device, local firewall configuration information, or information related to a networking interface configuration of the client computing device.

6. The method of claim 4, wherein the user parameter comprises at least one of:

user account information for the user in the private network, information on a country the user is registered in, or e-mail account information of the user.

7. The method of claim 4, wherein the system parameter comprises at least one of:

a time of the day, a login history of the client computing device, or a login history of the user of the client computing device.

8. The method of claim 1, wherein the one or more network entitlement rules are generic for any client computing device, and the retrieving further comprises assigning a networking address of the client computing device to the one or more network entitlement rules.

9. The method of claim 1, further comprising creating a predetermined set of policies, and wherein the selecting comprises selecting the selected policies from the predetermined set of policies.

10. A networking device for providing network access for a client computing device to a private network by a network traffic manager, the networking device comprising:

at least one processor; and

at least one memory storing instructions configured to instruct the at least one processor to;

receive context parameters related to a context of the client computing device;

select from the context parameters one or more policies as selected policies, wherein each policy is associated with one or more network entitlement rules defining network access rules for a networking device or an application in the private network according to the policy;

retrieve the one or more network entitlement rules associated with the selected policies; and

provide the one or more network entitlement rules to the client computing device, wherein the one or more network entitlement rules are not alterable by the client computing device, and the client computing device to provide the one or more network entitlement rules to the network traffic manager, thereby providing the network access for the client computing device.

11. A system comprising:

a first networking device for providing network access for a client computing device to a private network by a network traffic manager, the first networking device comprising;

at least one first processor; and

at least one memory storing first instructions configured to instruct the at least one first processor to;

receive context parameters related to a context of the client computing device;

select, from the context parameters, one or more policies as selected policies, wherein each policy is associated with one or more network entitlement rules defining network access rules for a networking device or an application in the private network according to the policy;

retrieve the one or more network entitlement rules associated with the selected policies;

provide the network traffic manager with the one or more network entitlement rules, thereby providing the network access for the client computing device; and

provide the one or more network entitlement rules to the client computing device upon authentication of the client computing device with the first networking device, wherein the one or more network entitlement rules are not alterable by the client computing device; and

a gateway for providing network access to the private network, the gateway comprising;

at least one second processor; and

at least one memory storing second instructions configured to instruct the at least one second processor to;

establish a networking tunnel between the gateway and the client computing device; and

receive the one or more network entitlement rules from the client computing device, the network traffic manager configured to allow the network access according to the one or more network entitlement rules.

12. The system of claim 11, wherein:

the first instructions are further configured to instruct the at least one first processor to provide a client tunnel session list to the client computing device, wherein the client tunnel session list comprises tunnel authentication information; and

the second instructions are further configured to instruct the at least one second processor to establish the tunnel upon authentication of the client computing device using the tunnel authentication information.

13. The system of claim 11, wherein the one or more network entitlement rules are readable by the client computing device.