Enforcing secure internet connections for a mobile endpoint computing device
View Patent ↗Methods and apparatus enforce a secure internet connection from a mobiles endpoint computing device. A security policy for the endpoint is defined based on its location. From that location, an internet connection is established and detected. This event triggers the launching of a full VPN tunnel connection including an NDIS firewall forcing packet traffic through a port of the endpoint computing device assigned by the security policy and/or MAC/IP addresses of a VPN concentrator. Thereafter, the packet traffic is monitored for compliance with the security policy. This includes determining whether packet traffic over the assigned port is observed within a given time or packet traffic is attempted over other ports. Monitoring occurs whether or not the protocol of the VPN tunnel connection is known. Other features contemplate quarantining for improper operation of the VPN tunnel, undertaking remediation, and computer program products, to name a few.
1. In a computing system environment, a method of enforcing a secure internet connection by way of a mobile, endpoint computing device, comprising:
pre-defining a security policy for the endpoint computing device based on a location of the endpoint computing device;
at that location, establishing an internet connection from the endpoint computing device to another computing device;
by the endpoint computing device, automatically launching a VPN tunnel connection between the endpoint computing device and the another computing device including forcing packet traffic of the internet connection through the VPN tunnel connection and a port of the endpoint computing device assigned by the security policy; and
at the endpoint computing device, monitoring the packet traffic to ensure that all said packet traffic of the internet connection is forced through the VPN tunnel connection in compliance with the security policy and determining whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
2. The method of claim 1 , wherein the monitoring further includes determining whether any said packet traffic over the assigned port has occurred within a given time.
3. The method of claim 1 , further including quarantining the endpoint computing device if the VPN tunnel connection cannot be confirmed.
4. The method of claim 1 , wherein the monitoring further includes monitoring without knowing a protocol of the VPN tunnel connection.
5. The method of claim 1 , wherein the monitoring further includes verifying inbound packet traffic from a VPN concentrator to determine proper VPN connection establishment.
6. The method of claim 1 , including performing remediation if the security policy is not satisfied.
7. In a computing system environment, a method of enforcing a secure internet connection by way of a mobile, endpoint computing device, comprising:
pre-defining a security policy for the endpoint computing device based on a location of the endpoint computing device;
at that location, establishing an internet connection from the endpoint computing device to another computing device;
by the endpoint computing device, automatically launching a full VPN tunnel connection between the endpoint computing device and the another computing device, including an NDIS firewall forcing packet traffic of the internet connection through the full VPN tunnel connection and a port of the endpoint computing device assigned by the security policy; and
at the endpoint computing device, monitoring the packet traffic at the assigned port to ensure that all said packet traffic of the internet connection is forced through the VPN tunnel connection in compliance with the security policy and determining whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
8. The method of claim 7 , wherein the monitoring further includes monitoring without knowing a protocol of the VPN tunnel connection as prescribed by a third party vendor.
9. The method of claim 7 , further including determining whether the endpoint computing device has access to the internet.
10. The method of claim 7 , further including quarantining the endpoint computing device for non-compliance of the security policy.
11. The method of claim 10 , wherein the quarantining further includes preventing all said packet traffic to the endpoint computing device.
12. The method of claim 10 , wherein the quarantining further includes disabling network adapters of the endpoint computing device.
13. In a computing system environment, a method of enforcing a secure internet connection by way of a mobile, endpoint computing device, comprising:
pre-defining a security policy for the endpoint computing device based on a location of the endpoint computing device;
at that location, establishing an internet connection from the endpoint computing device to another computing device;
by the endpoint computing device, launching a VPN tunnel connection between the endpoint computing device and the another computing device including forcing packet traffic of the internet connection through the VPN tunnel connection by way of a MAC/IP address of a VPN connector assigned by the security policy; and
at the endpoint computing device, monitoring the packet traffic to ensure that all said packet traffic of the internet connection is forced through the VPN tunnel connection in compliance with the security policy and determining whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
14. In a computing system environment, a method of enforcing a secure internet connection by way of a mobile, endpoint computing device, comprising:
pre-defining a security policy for the endpoint computing device based on a location of the endpoint computing device;
at that location, establishing an internet connection from the endpoint computing device to another computing device;
detecting the established internet connection;
based on the detecting, by the endpoint computing device, automatically launching a full VPN tunnel connection between the endpoint computing device and the another computing device, including forcing packet traffic of the internet connection through the full VPN tunnel connection, an NDIS firewall, and a port of the endpoint computing device assigned by the security policy; and
at the endpoint computing device, monitoring the assigned port for said packet traffic within a given time to ensure that all said packet traffic of the internet connection is forced through the VPN tunnel connection in compliance with the security policy and determining whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
15. A network computing system, comprising:
a first computing device able to establish an internet connection with a second computing device, the first computing device having at least one port for conducting the internet connection and,
a security module to enforce a pre-defined security policy,
a location detection module to determine a location thereof,
a VPN module to automatically launch a full VPN tunnel connection between the first and second computing devices upon detecting said internet connection having been made,
an NDIS firewall to force packet traffic of the internet connection through the full VPN tunnel connection and one of the ports assigned by the security policy through the security module, and
a security agent to monitor the packet traffic at the assigned one port to ensure that all said packet traffic of the internet connection is forced through the full VPN tunnel connection in compliance with the security policy and to determine whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
16. The network computing system of claim 15 , wherein the first computing device further includes a timer that the security agent utilizes to determine whether any said packet traffic over the assigned one port has occurred within a given time.
17. The network computing system of claim 15 , wherein the security agent is configured to quarantine the first computing device if the VPN tunnel connection cannot be confirmed.
18. A non-transitory computer program product for loading on a computing device to enforce a secure internet connection of a mobile, endpoint computing device, the computer program product having executable instructions that detect an internet connection with the endpoint computing device and another computing device and based on the detected internet connection automatically launches a full VPN tunnel connection between the endpoint computing device and the another computing device including forcing packet traffic of the internet connection through the full VPN tunnel connection and a port of the endpoint computing device assigned by a pre-determined security policy whereby said packet traffic can be monitored to ensure that all said packet traffic of the internet connection is forced through the VPN tunnel connection in compliance with the security policy;
the computer program product further including executable instructions that determine whether said packet traffic is attempted over ports of the endpoint computing device other than the assigned port.
19. The computer program product of claim 18 , further including executable instructions that determine whether any said packet traffic over the assigned port has occurred within a given time.
20. The computer program product of claim 18 , further including executable instructions that quarantine the endpoint computing device if the operation of the VPN tunnel connection cannot be confirmed.
21. The computer program product of claim 18 , further including executable instructions that monitor the packet traffic without knowing a protocol of the VPN tunnel connection.
22. The computer program product of claim 18 , further including executable instructions that verify inbound packet traffic from a VPN concentrator to determine proper VPN connection establishment.
23. The computer program product of claim 18 , further including executable instructions that perform remediation if the security policy is not in compliance.