Method and system for controlling network access
View Patent ↗Systems and methods intended to control a network devices access to a network are disclosed. Embodiments of the current invention expose a method for confining a network client's network access to a specific logical region of the network. A network communication may be received and the client that originated this communication determined. This client is associated with a set of rules or walled garden that specifies the access allowed by that client. The destination of the communication may also be determined and if the destination is allowed by the set of rules associated with the client and access to the destination allowed if access to the destination is allowed by the set of rules.
1. A method of network traffic quarantine control, comprising:
at a network access gateway device between a local network and the Internet, selecting a client device in a first network segment of the network;
at the network access gateway device, performing a plurality of quarantine control functions over the client device, wherein the plurality of quarantine control functions comprises:
a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment;
b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and
rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to implementation of one of the plurality of quarantine control function of the client device.
2. The method according to claim 1 , wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses.
3. The method according to claim 1 , further comprising:
evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert.
4. The method according to claim 1 , further comprising:
filtering the network traffic emanating from the client device to limit network packet flow by the client device.
5. The method according to claim 1 , further comprising:
routing the network traffic emanating from the client device to limit network packet traversal by the client device.
6. The method according to claim 1 , wherein the plurality of quarantine control functions further comprises:
restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment.
7. The method according to claim 1 , further comprising:
performing all of the plurality of quarantine control functions over the client device.
8. A computer program product comprising at least one non-transitory computer readable medium storing instructions translatable by at least one processor to perform:
a plurality of quarantine control functions over a client device coupled to the network access gateway device, wherein the network access gateway device is between a local network and the Internet, wherein the client device is in a first network segment of the network, and wherein the plurality of quarantine control functions comprises:
a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment;
b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and
rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to the implementation of one of the plurality of quarantine control function of the client device.
9. The computer program product of claim 8 , wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses.
10. The computer program product of claim 8 , wherein the instructions are further translatable by the at least one processor to perform:
evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert.
11. The computer program product of claim 8 , wherein the instructions are further translatable by the at least one processor to perform:
filtering the network traffic emanating from the client device to limit network packet flow by the client device.
12. The computer program product of claim 8 , wherein the instructions are further translatable by the at least one processor to perform:
routing the network, traffic emanating from the client device to limit network packet traversal by the client device.
13. The computer program product of claim 8 , wherein the plurality of quarantine control functions further comprises:
restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment.
14. The computer program product of claim 8 , wherein the instructions are further translatable by the at least one processor to perform:
all of the plurality of quarantine control functions over the client device.
15. A network access gateway device, comprising:
at least one processor; and
at least one non-transitory computer readable medium storing instructions translatable by the at least one processor to perform:
a plurality of quarantine control functions over a client device coupled to the network access gateway device, wherein the network access gateway device is between a local network and the Internet, wherein the client device is in a first network segment of the network, and wherein the plurality of quarantine control functions comprises:
a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment;
b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and
rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to implementation of one of the plurality of quarantine control function of the client device.
16. The system of claim 15 , wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses.
17. The system of claim 15 , wherein the instructions are further translatable by the at least one processor to perform:
evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert.
18. The system of claim 15 , wherein the instructions are further translatable by the at least one processor to perform:
filtering the network traffic emanating from the client device to limit network packet flow by the client device.
19. The system of claim 15 , wherein the instructions are further translatable by the at least one processor to perform:
routing the network traffic emanating from the client device to limit network packet traversal by the client device.
20. The system of claim 15 , wherein the plurality of quarantine control functions further comprises:
restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment.