System and method for double-capture/double-redirect to a different location

Abstract

Embodiments disclosed herein provide a system, method, and computer program product for providing network access control for a shared network. One embodiment of a network access controller may intercept a request to access a network resource from a browser application running on a client device associated with an anonymous user and determine whether the network resource is in a set of network destinations in the shared network. If the network resource is in the set of network destinations, the network access controller may direct the browser application to the network resource. If the network resource is not in the set of network destinations, the network access controller may redirect the browser application to a pre-authentication capture destination in the shared network. From the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations in the shared network without authentication.

Description

TECHNICAL FIELD

Embodiments disclosed herein relate to network access control and security. More particularly, embodiments disclosed herein relate to a system, method, and computer program product for providing network access control for a shared network.

BACKGROUND

Network access providers utilizing Access Controlled Network Sharing technology to provide user-specific provisioned access to private/public networks may also have a need to allow controlled access for unauthenticated users to a restricted collection of network destinations.

For example, a shopping mall owner may want to provide any on-site customer possessing a wireless device (such as a laptop computer, PDA, etc.) with access to the Web server for the mall, plus one or more other Web sites that are associated with the mall (e.g., the local Web server for a tenant in the mall, such as a department store or movie theater). In this case, the collection of Web servers that the mall owner will allow an anonymous user to visit is referred to as the “walled garden”.

In addition, the mall owner may intend to provide unlimited web access to customers who agree to register with the mall owner, and identify themselves (by providing credentials—typically, in the form of a user identifier and a password that were assigned at the time they registered) whenever they wish to be granted full access to the Internet. The process of verifying a customer's credentials is referred to as “authentication”.

Previous solutions would either 1) require that the network destination of the authentication service (i.e., the “captive” portal) be specified explicitly in a link on at least one of the web pages within the set of destinations that are members of the “walled garden”, or 2) require that the end-user manually enter the web address of the authentication service in the address bar of their web browser.

SUMMARY OF THE DISCLOSURE

Embodiments disclosed herein provide a software-based system and method that enhances the function of a network access controller by introducing a “Pre-Authentication Capture Destination”. In the standard Access Controlled Network Sharing solution, an unauthenticated client who attempts to access the network is re-directed to a challenge screen or “captive portal”, where they must provide their network login credentials (e.g., user name and password).

If a Pre-Authentication Capture Destination is specified, then this behavior changes. Any attempt by an unauthenticated client to access a network resource that is not in a list of allowed destinations (i.e., the list of servers that make up the “walled garden”) will result in the client being re-directed by the Network Access Controller to the Pre-Authentication Capture Destination. The unauthenticated client is then free to visit any of the servers that are included in the walled garden without authentication. Any attempt to access a web site or location that is outside of the walled garden will cause the client to be re-directed back to the Pre-Authentication Capture Destination.

At some point, the unauthenticated client may want to use network access privileges that are only available to an authenticated user. Consequently, the client must then be re-directed to an authentication URL (or “captive” portal), where they may login (or register as a new user). To accomplish this re-direction, at least one of the web sites within the walled garden can include an HTML link that references a site that is not in the walled garden and includes a special token within the “query” portion of the link's target HTTP URL (as defined in the IETF RFC-2616—“Hypertext Transfer Protocol—HTTP/1.1” and RFC-1738 “Uniform Resource Locators (URL)” specifications). This special token, referred to as the “Authentication Token”, is a unique sequence of characters that are valid for use in the query portion of a URL. When the client attempts to access the referenced site, they will be captured by the Network Access Controller. However, because of the presence of the Authentication token within the HTTP URL, the Network Access Controller will re-direct the client to the authentication screen, rather than redirecting them back to the Pre-Authentication Capture Destination.

Note that there is no requirement for any web page in the walled garden to have prior knowledge of the actual authentication screen location. Consequently, the same collection of walled garden sites may be used to service multiple Network Access controllers, where each controller may utilize a different authentication portal.

Embodiments disclosed herein enable a public/private network service provider to automatically redirect anonymous clients to a pre-defined destination within a limited set of network destinations, and provides a mechanism for accessing the authentication service without requiring that the web servers in the “walled garden” know the actual authentication URL. The automatic redirection occurs whenever the anonymous client attempts to access a network destination outside of the allowed set. The anonymous client does not have to enter the network URL of a server in the “walled garden”—instead, they just have to attempt to access any well-known URL (such as www.yahoo.com), and they will be redirected to the pre-defined destination.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the present invention and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein:

FIG. 1 is a diagrammatic representation of a system depicting the network access capability afforded to an unauthenticated client, according to one embodiment disclosed herein;

FIG. 2 is a diagrammatic representation of a system depicting the network access capability afforded to an authenticated client, according to one embodiment disclosed herein; and

FIG. 3 is a diagrammatic representation of the flow of control (decision diagram) for a network access sharing device implementing the double-capture, double-redirect method, according to one embodiment disclosed herein.

DETAILED DESCRIPTION

The following applications are hereby fully incorporated by reference herein in their entirety: U.S. patent application Ser. No. 10/683,317, pending, filed Oct. 10, 2003 by Richard MacKinnon, Kelly Looney, and Eric White, entitled “SYSTEM AND METHOD FOR PROVIDING ACCESS CONTROL”; U.S. Provisional Application No. 60/551,698, filed Mar. 10, 2004 by Patrick Turley, entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” which converted into U.S. patent application Ser. No. 11/076,719, filed Mar. 10, 2005 by Richard MacKinnon, Kelly Looney, and Eric White, entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” issued as U.S. Pat. No. 7,610,621; U.S. Provisional Application No. 60/551,754, filed Mar. 10, 2004 by Keith Johnston, entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” which converted into U.S. patent application Ser. No. 11/078,223, filed Mar. 10, 2005 by Keith Johnston, entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” issued as U.S. Pat. No. 7,509,625; U.S. Provisional Application No. 60/551,703, filed Mar. 10, 2004 by Patrick Turley and Keith Johnston, entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWAY”; U.S. Provisional Application No. 60/551,702, filed Mar. 10, 2004 by Patrick Turley, Keith Johnston, and Steven D. Tonnesen, entitled “SYSTEM AND METHOD FOR ACCESS SCOPE CONTROL (“WALLED GARDENS”) FOR CLIENTS OF A NETWORK ACCESS GATEWAY,” which converted into U.S. patent application Ser. No. 11/076,591, pending, filed Mar. 10, 2005 by Patrick Turley, Keith Johnston, and Steven D. Tonnesen, entitled “METHOD AND SYSTEM FOR CONTROLLING NETWORK ACCESS”; U.S. Provisional Application No. 60/551,699, filed Mar. 10, 2004 by Patrick Turley, et al., entitled “SYSTEM AND METHOD FOR DYNAMIC BANDWIDTH CONTROL”; U.S. Provisional Application No. 60/551,697, filed Mar. 10, 2004 by Steven D. Tonnesen, entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” which converted into U.S. patent application Ser. No. 11/076,652, filed Mar. 10, 2005 by Steven D. Tonnesen, entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” issued as U.S. Pat. No. 7,590,728; U.S. Provisional Application No. 60/551,705, filed Mar. 10, 2004 by Keith Johnston, et al., entitled “SYSTEM AND METHOD FOR DOUBLE-CAPTURE/DOUBLE-REDIRECT TO A DIFFERENT LOCATION,” which converted into U.S. patent application Ser. No. 11/076,646, now allowed, filed Mar. 10, 2005 by Keith Johnston, et al., entitled “SYSTEM AND METHOD FOR DOUBLE-CAPTURE/DOUBLE-REDIRECT TO A DIFFERENT LOCATION”; U.S. Provisional Application No. 60/551,704, filed Mar. 10, 2004 by Keith Johnston and Mario Garcia, entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION,” which converted into U.S. patent application Ser. No. 11/076,672, pending, filed Mar. 10, 2005 by Keith Johnston and Mario Garcia, entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION”; and U.S. Provisional Application No. 60/660,408, filed Mar. 10, 2005 by Patrick Turley, et al., entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWAY.”

Preferred embodiments disclosed herein are illustrated in the accompanying drawings, with like numerals being used to refer to like and corresponding parts of the various drawings.

Network access providers utilizing Access Controlled Network Sharing technology to provide user-specific provisioned access to private/public networks may also have a need to allow controlled access for unauthenticated users to a restricted collection of network destinations. An example of Access Controlled Network Sharing technology is described in U.S. patent application Ser. No. 10/683,317, filed Oct. 10, 2003 by Richard MacKinnon, Kelly Looney, and Eric White, entitled “SYSTEM AND METHOD FOR PROVIDING ACCESS CONTROL.” An example of a restricted collection of network destinations is referred to as the “walled garden” in U.S. Provisional Application No. 60/551,702, filed Mar. 10, 2004 by Patrick Turley, Keith Johnston and Steven D. Tonnesen, entitled “SYSTEM AND METHOD FOR ACCESS SCOPE CONTROL (“WALLED GARDENS”) FOR CLIENTS OF A NETWORK ACCESS GATEWAY,” which converted into U.S. patent application Ser. No. 11/076,591, filed Mar. 10, 2005 by Patrick Turley, Keith Johnston and Steven D. Tonnesen, entitled “METHOD AND SYSTEM FOR CONTROLLING NETWORK ACCESS.”

To illustrate by example, assume that the following configuration has been set in the Network Access Controller 2, as depicted in FIG. 1:

Walled Garden 5 contains three servers:

wg1.com (Server 6)

wg2.com (Server 7)

auth.com (Server 8)

The Pre-Authentication Capture Destination for the embodiment of FIG. 1 will be designated http://wg1.com/welcome.html.

The Authentication Capture Destination for the embodiment of FIG. 1 will be designated https://auth.com/login.jsp.

As shown in the embodiment of FIG. 1, assume that an anonymous user has access to one of the Client network access devices 1. This user launches a Web browser and enters “www.yahoo.com” (an “external” URL, i.e., a destination that is not in the Walled Garden 5) in the address bar, and presses <Return>. The Network Access Controller 2 uses its internal Firewall 3 function to recognize the attempt by an unknown user to access an “external” location (represented by the Internet cloud 4 in FIG. 1), intercepts the request, and sends an HTTP redirect to the Client's browser, specifying the Pre-Authentication Capture URL “http://wg1.com/welcome.html”. The browser then automatically performs an HTTP Get to retrieve that Web page from the wg1.com server.

At this point, the anonymous user may access Web locations on any of the three servers that are in the Walled Garden 5. For this example, assume that the Web pages on the wg1.com Server 6 include links to Web pages on the wg2.com Server 7. The anonymous user would be able to click on any of these links and view the referenced pages hosted on Server 7. However, if one of these Web pages contained a link to an “external” web site, and the user clicked on that link, then the Network Access Controller would again redirect the Client's browser back to the Pre-Authentication Capture URL http://wg1.com/welcome.html, hosted on Server 6.

Now, assume that the anonymous user decides that they want to be authenticated, so that they may be allowed access to an “external” network destination. To enable the user to login, an HTML link is included on the welcome page at “http://wg1.com/welcome.html”. The link's reference URL identifies a server that is outside of the Walled Garden 5, and includes the special token string “proceedToAuthenticationURL=true” within the query portion. Note that the exact form of this special token need not be predefined; the special token is simply uniquely identifiable.

When the user clicks on this link, the Network Access Controller 2 intercepts the request. However, instead of redirecting the Client's browser to the Pre-Authentication Capture URL, the Network Access Controller 2 recognizes the presence of the token, and redirects the browser to the Authentication URL http://auth.com/login.jsp, hosted on the “auth.com” Server 8.

At this point, the user is presented with a Login page, and enters a username/password. Assuming that these credentials are valid, the “auth.com” Server 8 sends an “authorize” command to the Network Access Controller 2. This command instructs the Network Access Controller 2 to allow “external” access for the authenticated user.

As shown in FIG. 2, the Client now has access to the Internet 4 (“External Network”). If the user now enters “www.yahoo.com” in the Web browser's address bar, the Network Access Controller 2 would no longer intercept this request, and the welcome page from the Yahoo web site would be displayed.

Note that, in one embodiment, this “external” access is only granted to the authenticated user. An anonymous user on a different Client would still be restricted to the Walled Garden 5.

One embodiment of the decision logic (and associated flow) that can be executed by the Network Access Controller 2 is depicted in FIG. 3. The Network Access Controller continuously monitors for network access from network access client devices 1 on its first network interface at step 18.

When a network packet is received (step 19), the Network Access Controller 2 determines if the packet is being sent by an authenticated client (step 20).

If the packet is from an authenticated client, then the Network Access Controller 2 allows the packet to pass through and be routed to its target destination (“Yes” decision fork).

If the packet is from an unauthenticated client, then the Network Access Controller 2 determines if the destination of the packet is one of the servers within the Walled Garden 5 (step 21).

If the packet is from an unauthenticated client and the destination is a server in the Walled Garden 5, then the Network Access Controller 2 allows the packet to pass through and be routed to its target server (“Yes” decision fork).

If the packet is from an unauthenticated client and the destination is not a server in the Walled Garden 5, then the Network Access Controller 2 determines if a Pre-Authentication URL has been specified (step 22).

If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, and a Pre-Authentication URL has not been specified, then the Network Access Controller 2 directs the client to the Authentication URL (step 24).

If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, and a Pre-Authentication URL has been specified, then the Network Access Controller 2 determines if the packet contains the Authentication Token (step 23).

If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, a Pre-Authentication URL has been specified, and the packet does not contain the Authentication Token, then the Network Access Controller 2 directs the client to the Pre-Authentication URL (step 25).

If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, a Pre-Authentication URL has been specified, and the packet contains the Authentication Token, then the Network Access Controller 2 directs the client to the Authentication URL (step 24).

While the present disclosure has been described with reference to particular embodiments, it should be understood that the embodiments are illustrative and that the scope of the invention is not limited to these embodiments. Many variations, modifications, additions and improvements to the embodiments described above are possible. It is contemplated that these variations, modifications, additions and improvements fall within the scope of the invention as detailed in the following claims.

Claims

1. A method for automatic pre-authentication redirection of network traffic, comprising: providing a network access controller in a shared network, wherein the shared network comprises a plurality of server computers and a set of network destinations hosted on the plurality of server computers;intercepting at the network access controller a request to access a network resource from a browser application running on a client device within the shared network associated with an anonymous user;determining whether the network resource referenced in the request is in the set of network destinations hosted on the plurality of server computers in the shared network;if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device within the shared network associated with the anonymous user to the network resource; andif the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device within the shared network associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

2. The method according to claim 1, wherein the network resource is at a network location external to the shared network.

3. The method according to claim 1, wherein the redirecting further comprises sending from the network access controller to the client device a response containing an identifier identifying the pre-authentication capture destination.

4. The method according to claim 1, further comprising: redirecting the browser application running on the client device back to the preauthentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

5. The method according to claim 1, further comprising: intercepting at the network access controller a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; anddetermining whether the second request contains an authentication token.

6. The method according to claim 5, wherein the second request does not contain the authentication token, further comprising redirecting the browser application running on the client device associated with the anonymous user back to the pre-authentication capture destination hosted on the first server computer in the shared network.

7. The method according to claim 5, wherein the second request contains the authentication token, further comprising redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.

8. The method according to claim 7, wherein the anonymous user is authenticated by the second server computer for network access external to the shared network.

9. A computer program product comprising a non-transitory computer readable storage medium storing computer instructions translatable by a processor to perform: intercepting at a network access controller a request to access a network resource from a browser application running on a client device within the shared network associated with an anonymous user;determining whether the network resource referenced in the request is in a set of network destinations hosted on a plurality of server computers in a shared network;if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device within the shared network associated with the anonymous user to the network resource; andif the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device within the shared network associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

10. The computer program product of claim 9, wherein the redirecting further comprises sending from the network access controller to the client device a response containing an identifier identifying the pre-authentication capture destination.

11. The computer program product of claim 9, wherein the computer instructions are further translatable by the processor to perform: redirecting the browser application running on the client device back to the preauthentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

12. The computer program product of claim 9, wherein the computer instructions are further translatable by the processor to perform: intercepting at the network access controller a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; anddetermining whether the second request contains an authentication token.

13. The computer program product of claim 12, wherein the second request does not contain the authentication token and wherein the computer instructions are further translatable by the processor to perform: redirecting the browser application running on the client device associated with the anonymous user back to the pre-authentication capture destination hosted on the first server computer in the shared network.

14. The computer program product of claim 12, wherein the second request contains the authentication token and wherein the computer instructions are further translatable by the processor to perform: redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.

15. The computer program product of claim 14, wherein the anonymous user is authenticated by the second server computer for network access external to the shared network and wherein the computer instructions are further translatable by the processor to perform: allowing the client device access to the second network resource.

16. An apparatus for controlling network access, comprising: a processor within a shared network; anda computer readable storage medium storing computer instructions translatable by the processor to perform: intercepting a request to access a network resource from a browser application running on a client device within the shared network coupled to the apparatus, wherein the client device is associated with an anonymous user;determining whether the network resource referenced in the request is in a set of network destinations hosted on a plurality of server computers coupled to the apparatus, wherein the plurality of server computers resides on the shared network;if the network resource is in the set of network destinations hosted on the plurality of server computers in the shared network, directing the browser application running on the client device within the shared network associated with the anonymous user to the network resource; andif the network resource is not in the set of network destinations hosted on the plurality of server computers in the shared network, redirecting the browser application running on the client device within the shared network associated with the anonymous user to a pre-authentication capture destination hosted on a first server computer, wherein the first server computer is one of the plurality of server computers in the shared network and wherein from the pre-authentication capture destination the anonymous user is free to visit any of the set of network destinations hosted on the plurality of server computers in the shared network without authentication.

17. The apparatus of claim 16, wherein the computer instructions are further translatable by the processor to redirect the browser application running on the client device back to the preauthentication capture destination when the anonymous user attempts to access any network resource that is not in the set of network destinations hosted on the plurality of server computers in the shared network.

18. The apparatus of claim 16, further comprising: a first network interface coupled to the processor, wherein the computer instructions are further translatable by the processor to continuously monitor for network access from client devices on the first network interface.

19. The apparatus of claim 18, wherein the computer instructions are further translatable by the processor to perform: intercepting a second request from the browser application running on the client device associated with the anonymous user to access a second network resource that is not in the set of network destinations; anddetermining whether the second request contains an authentication token.

20. The apparatus of claim 19, wherein the computer instructions are further translatable by the processor to perform: if the second request does not contain the authentication token, redirecting the browser application running on the client device associated with the anonymous user back to the preauthentication capture destination hosted on the first server computer in the shared network; andif the second request contains the authentication token, redirecting the browser application running on the client device associated with the anonymous user to an authentication page hosted on a second server computer in the shared network.