Forcing all mobile network traffic over a secure tunnel connection
View Patent ↗A process is disclosed in which all network traffic between a mobile device and an untrusted network arriving before the establishment of a VPN tunnel are dropped in response to rules imposed by the mobile device's operating system. Once a VPN tunnel is established all communication from the mobile device is secured, without an intervention on the part of the user of the device. A device supporting such a process is also disclosed.
1. A method for a mobile device having an operating system (OS) to communicate with a trusted remote host over an untrusted network comprising
sending and receiving communication packets between the mobile device and the trusted remote host over the untrusted network pursuant to controls of packet filtering at the kernel level of the operating system of the mobile device, sufficient to establish a virtual private network (VPN) connection;
establishing at the mobile device a VPN connection with the trusted remote host, wherein the mobile device comprises a VPN handler that encrypts outbound network packets and decrypts inbound network packets to securely tunnel the network packets between the mobile device and the trusted remote host;
rejecting, in response to controls of packet filtering at the kernel level, packet traffic over the untrusted network other than those packets necessary to the establishment of the VPN connection, said rejection continuing until the VPN connection is established,
following establishment of the VPN connection, receiving all packet traffic over the VPN connection:
when the VPN connection disconnects or fails to connect, causing a browser program to create a set of network rules that enable user intervention which allows establishment of a secure tunnel that proceeds over the untrusted network between the mobile device and the trusted remote host; and
wherein the network rules and the packet filtering rules are BSD (Berkeley Style Distribution)—style UNIX variants of the OS to control packet filtering inside an OS kernel networking stack.
2. The method according to claim 1 further comprising upon disconnect or failure to connect, allowing a browser to create a set of network rules to enable user intervention to allow establishment of a secure tunnel to proceed over the untrusted network between the mobile device and the trusted remote host.
3. The method according to claim 1 wherein the packet traffic over the untrusted network is limited to packets addressed to a predetermined port on the trusted remote host.
4. The method according to claim 1 wherein the packet traffic over the VPN connection is limited to packets addressed to a predetermined port on the mobile device.
5. The method according to claim 2 , further comprising allowing specific applications resident on the mobile device to perform traffic over the untrusted network.
6. A method for a mobile device to communicate with a trusted remote host over an untrusted network comprising
sending and receiving communication packets between the mobile device and the trusted remote host over the untrusted network pursuant to network routing tables of the operating system of the mobile device, sufficient to establish a virtual private network (VPN) connection;
establishing at the mobile device a VPN connection with the trusted remote host,
wherein the mobile device comprises a VPN handler that encrypts outbound network packets and decrypts inbound network packets to securely tunnel the network packets between the mobile device and the trusted remote host;
rejecting in response to network routing tables packet traffic over the untrusted network other than those packets necessary to the establishment of the VPN connection, said rejection continuing until the VPN connection is established,
following establishment of the VPN connection, receiving all packet traffic over the VPN connection:
when the VPN connection disconnects or fails to connect, causing a browser program to create a set of network rules that enable user intervention which allows establishment of a secure tunnel that proceeds over the untrusted network between the mobile device and the trusted remote host; and
wherein the network rules and the packet filtering rules are BSD (Berkeley Style Distribution)-style UNIX variants of the OS to control packet filtering inside an OS kernel networking stack.
7. The method according to claim 6 wherein the packet traffic over the VPN connection is limited to packets addressed to a predetermined port on the trusted remote host.
8. The method according to claim 6 wherein the packet traffic over the VPN connection is limited to packets addressed to a predetermined port on the mobile device.
9. The method according to claim 6 , further comprising allowing applications resident on the mobile device to perform traffic over the VPN connection.
10. A mobile device to communicate with a trusted remote host over an untrusted network comprising:
a transmitter and receiver to send and receive communications in the form of radio frequency signals;
a microprocessor configured to cause a browser program, upon disconnect or failure to connect, to create a set of network rules that enable user intervention which allows establishment of a secure tunnel that proceeds over the untrusted network between the mobile device and the trusted remote host;
an operating system executing on said microprocessor to provide an operating environment for application software; and
a VPN handler to establish a VPN connection with the trusted remote host over the untrusted network pursuant to packet filtering rules of the operating system of the mobile device, sufficient to establish a virtual private network (VPN) connection;
wherein the VPN handler is configured to:
establish at the mobile device a VPN connection with the trusted remote host, and to encrypt outbound network packets and decrypt inbound network packets to securely tunnel the network packets between the mobile device and the trusted remote host;
reject, in response to the packet filtering rules, packet traffic over the untrusted network other than those packets necessary to the establishment of the VPN connection, said rejection continuing until the VPN connection is established; and
following establishment of the VPN connection, receive all packet traffic over the VPN connection
wherein the network rules and the packet filtering rules are BSD (Berkeley Style Distribution)-style UNIX variants of the OS to control packet filtering inside an OS kernel networking stack.
11. The mobile device according to claim 10 , wherein said microprocessor is further configured to permit specific applications resident on the mobile device to perform traffic over the untrusted network.