Granted Patent B2

US 7,735,118 · App. 11/052,260 · Granted Jun 8, 2010

Abstract

Claims (48)

1. A method for preventing a bridge between a secure network and an insecure network at a network device, comprising:

receiving, at a node associated with the secure network, a request to establish a secure network connection with the secure network, wherein the request to establish the secure network connection with the secure network is associated with the network device; and

in response to a determination that the request to establish the secure network connection has associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device, accepting the request to establish the secure network connection with the secure network;

in response to a determination that the request to establish the secure network connection does not have associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device, denying the request to establish the secure network connection with the secure network.

2. The method of claim 1 , wherein the request to establish the secure network connection is initiated by the network device using a process comprising:

obtaining a request for establishing the secure network connection;

determining, in response to the request, whether an insecure network connection exists at the network device;

in response to a determination that an insecure network connection does not exist at the network device, generating a token indicative that an insecure network connection to an insecure network does not exist at the network device; and

transmitting the token toward the node associated with the secure network.

3. The method of claim 2 , wherein determining whether an insecure network connection exists at the network device comprises:

calling at least one function for determining whether an insecure network connection exists at the network device.

4. The method of claim 2 , wherein generating the token comprises:

generating the token using at least one algorithm, the at least one algorithm generating the token in a manner for enabling the node associated with the secure network to determine whether or not an insecure network connection exists for the network device.

5. The method of claim 1 , wherein the token is received as at least a portion of a dynamic host configuration protocol (DHCP) class identifier option.

6. The method of claim 1 , wherein the token is received as at least a portion of at least one extensible authentication protocol (EAP) parameter.

7. The method of claim 1 , wherein the token is received at a virtual private network (VPN) gateway associated with the secure network, wherein the token is received as at least a portion of a virtual private network (VPN) setup phase.

8. The method of claim 1 , wherein the token is received as at least a portion of a point-to-point protocol (PPP) setup phase.

9. The method of claim 1 , further comprising:

validating the token, wherein the token is validated by comparing the token associated with the request to establish the secure network connection to at least one token stored locally by the node associated with the secure network; and

establishing the secure network connection in response to a determination that the token associated with the request to establish the secure network connection matches at least one token stored locally by the node associated with the secure network.

10. The method of claim 1 , further comprising:

monitoring the network device for an attempt to establish an insecure network connection to an insecure network; and

invalidating the token in response to detecting an attempt to establish an insecure network connection with an insecure network.

11. A computer readable storage medium storing a software program, that, when executed by a computer, causes the computer to perform a method for preventing a bridge between a secure network and an insecure network at a network device, the method comprising:

receiving, at a node associated with the secure network, a request to establish a secure network connection with the secure network, wherein the request to establish the secure network connection with the secure network is associated with the network device; and

in response to a determination that the request to establish the secure network connection has associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device, accepting the request to establish the secure network connection with the secure network;

in response to a determination that the request to establish the secure network connection does not have associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device, denying the request to establish the secure network connection with the secure network.

12. The computer readable storage medium of claim 11 , wherein the request to establish the secure network connection is initiated by the network device using a process comprising:

obtaining a request for establishing the secure network connection;

determining, in response to the request, whether an insecure network connection exists at the network device;

in response to a determination that an insecure network connection does not exist at the network device, generating a token indicative that an insecure network connection to an insecure network does not exist at the network device; and

transmitting the token toward the node associated with the secure network.

13. The computer readable storage medium of claim 12 , wherein determining whether an insecure network connection exists at the network device comprises:

calling at least one function for determining whether an insecure network connection exists at the network device.

14. The computer readable storage medium of claim 12 , wherein generating the token comprises:

generating the token using at least one algorithm, the at least one algorithm generating the token in a manner enabling the secure network to determine whether or not an insecure network connection to an insecure network exists for the network device.

15. The computer readable storage medium of claim 11 , wherein the token is received as at least one of: at least a portion of a dynamic host configuration protocol (DHCP) class identifier option, at least a portion of at least one extensible authentication protocol (EAP) parameter, at least a portion of a virtual private network (VPN) setup phase, and at least a portion of a point-to-point protocol (PPP) setup phase.

16. The computer readable storage medium of claim 11 , further comprising:

validating the token, wherein the token is validated by comparing the token associated with the request to establish the secure network connection to at least one token stored locally at the node associated with the secure network; and

establishing the secure network connection in response to a determination that the token associated with the request to establish the secure network connection matches at least one token stored locally by the node associated with the secure network.

17. The computer readable storage medium of claim 11 , further comprising:

monitoring the network device for an attempt to establish an insecure network connection to an insecure network; and

invalidating the token in response to detecting an attempt to establish an insecure network connection to an insecure network.

18. An apparatus for preventing a bridge between a secure network and an insecure network at a network device, comprising:

a receiver for receiving a request to establish a secure network connection with the secure network, wherein the request to establish the secure network connection with the secure network is associated with the network device; and

a processor for processing the request, the processor configured for:

accepting the request to establish the secure network connection with the secure network in response to a determination that the request to establish the secure network connection has associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device; and

denying the request to establish the secure network connection with the secure network in response to a determination that the request to establish the secure network connection does not have associated therewith a token indicative that an insecure network connection to an insecure network does not exist for the network device.

Assignments (9)