Embodiments of the present invention relate to network access control and security. More particularly, embodiments of the present invention relate to providing access control for a shared network.
Network access providers utilizing Access Controlled Network Sharing technology to provide user-specific provisioned access to private/public networks may also have a need to allow controlled access for unauthenticated users to a restricted collection of network destinations.
For example, a shopping mall owner may want to provide any on-site customer possessing a wireless device (such as a laptop computer, PDA, etc.) with access to the Web server for the mall, plus one or more other Web sites that are associated with the mall (e.g., the local Web server for a tenant in the mall, such as a department store or movie theater). The collection of Web servers that the mall owner will allow an anonymous user to visit is referred to as the “walled garden”.
In addition, the mall owner may intend to provide unlimited web access to customers who agree to register with the mall owner, and identify themselves (by providing credentials—typically, in the form of a user identifier and a password that were assigned at the time they registered) whenever they wish to be granted full access to the Internet. The process of verifying a customer's credentials is referred to as “authentication”.
Previous solutions would either 1) require that the network destination of the authentication service (i.e., the “captive” portal) be specified explicitly in a link on at least one of the web pages within the set of destinations that are members of the “walled garden”, or 2) require that the end-user manually enter the web address of the authentication service in the address bar of their web browser.
The invention is a software-based system and method that enhances the function of a network access controller by introducing a “Pre-Authentication Capture Destination”. In the standard Access Controlled Network Sharing solution, an unauthenticated client who attempts to access the network is re-directed to a challenge screen or “captive portal”, where they must provide their network login credentials (e.g., user name and password).
If a Pre-Authentication Capture Destination is specified, then this behavior changes. Any attempt by an unauthenticated client to access a network resource that is not in a list of allowed destinations (e.g., the list of servers that make up the “walled garden”) will result in the client being re-directed by the Network Access Controller to the Pre-Authentication Capture Destination. The unauthenticated client is then free to visit any of the servers that are included in the walled garden without authentication. Any attempt to access a web site or location that is outside of the walled garden will cause the client to be re-directed back to the Pre-Authentication Capture Destination.
At some point, the unauthenticated client may want to use network access privileges that are only available to an authenticated user. Consequently, the client must then be re-directed to an authentication URL (or “captive” portal), where they may login (or register as a new user). To accomplish this re-direction, at least one of the web sites within the walled garden can include an HTML link that references a site that is not in the walled garden and includes a special token within the “query” portion of the link's target HTTP URL (as defined in the IETF RFC-2616—“Hypertext Transfer Protocol—HTTP/1.1” and RFC-1738 “Uniform Resource Locators (URL)” specifications). This special token, referred to as the “Authentication Token”, is a unique sequence of characters that are valid for use in the query portion of a URL. When the client attempts to access the referenced site, they will be captured by the Network Access Controller. However, because of the presence of the Authentication token within the HTTP URL, the Network Access Controller will re-direct the client to the authentication screen, rather than redirecting them back to the Pre-Authentication Capture Destination.
Note that there is no requirement for any web page in the walled garden to have prior knowledge of the actual authentication screen location. Consequently, the same collection of walled garden sites may be used to service multiple Network Access controllers, where each controller may utilize a different authentication portal.
This invention enables a public/private network service provider to automatically redirect anonymous clients to a pre-defined destination within a limited set of network destinations, and provides a mechanism for accessing the authentication service without requiring that the web servers in the “walled garden” know the actual authentication URL. The automatic redirection occurs whenever the anonymous client attempts to access a network destination outside of the allowed set. The anonymous client does not have to enter the network URL of a server in the “walled garden”—instead, they just have to attempt to access any well-known URL (such as www.yahoo.com), and they will be redirected to the pre-defined destination.
A more complete understanding of the present invention and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein:
The following applications are hereby fully incorporated by reference herein in their entirety: U.S. application Ser. No. 10/683,317, filed Oct. 10, 2003, entitled “SYSTEM AND METHOD FOR PROVIDING ACCESS CONTROL,” by Richard MacKinnon, Kelly Looney, and Eric White; U.S. Provisional Application No. 60/551,698, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” by Patrick Turley which converted into U.S. application Ser. No. 11/076,719, filed Mar. 10, 2005, entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” by Richard MacKinnon, Kelly Looney, and Eric White; U.S. Provisional Application No. 60/551,754, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” by Keith Johnston which converted into U.S. application Ser. No. 11/078,223, filed Mar. 10, 2005, entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” by Keith Johnston; U.S. Provisional Application No. 60/551,703, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWAY,” by Patrick Turley and Keith Johnston; U.S. Provisional Application No. 60/551,702, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR ACCESS SCOPE CONTROL (“WALLED GARDENS”) FOR CLIENTS OF A NETWORK ACCESS GATEWAY,” by Patrick Turley, Keith Johnston, and Steven D. Tonnesen which converted into U.S. application Ser. No. 11/076,591, filed Mar. 10, 2005, entitled “METHOD AND SYSTEM FOR CONTROLLING NETWORK ACCESS,” by Patrick Turley, Keith Johnston, and Steven D. Tonnesen; U.S. Provisional Application No. 60/551,699, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR DYNAMIC BANDWIDTH CONTROL,” by Patrick Turley, et al.; U.S. Provisional Application No. 60/551,697, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” by Steven D. Tonnesen which converted into U.S. application Ser. No. 11/076,652, filed Mar. 10, 2005, entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” by Steven D. Tonnesen; U.S. Provisional Application No. 60/551,704, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION,” by Keith Johnston and Mario Garcia which converted into U.S. application Ser. No. 11/076,672, filed Mar. 10, 2005, entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION,” by Keith Johnston and Mario Garcia; and U.S. Provisional Application No. 60/660,408 filed Mar. 10, 2005, entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWAY,” by Patrick Turley, et al.
Preferred embodiments of the invention are illustrated in the FIGURES, like numerals being used to refer to like and corresponding parts of the various drawings.
Network access providers utilizing Access Controlled Network Sharing (as, for example, described in U.S. patent application Ser. No. 10/683,317, filed Oct. 10, 2003, entitled “System and Method for Providing Access Control”, by Richard MacKinnon, Kelly Looney, and Eric White) technology to provide user-specific provisioned access to private/public networks may also have a need to allow controlled access for unauthenticated users to a restricted collection of network destinations (this can be referred to as the “walled garden”—see U.S. Provisional Patent Application No. 60/551,702 entitled “System and Method for Access Scope Control (“Walled Gardens”) for Clients of a Network Access Gateway” by Patrick Turley, Keith Johnston and Steven D. Tonnesen, filed Mar. 10, 2004, converted into U.S. patent application Ser. No. 11/076,591, entitled “Method and System for Controlling Network Access” by Patrick Turley, Keith Johnston and Steven D. Tonnesen, filed Mar. 10, 2005).
To illustrate this invention, assume that the following configuration has been set in the Network Access Controller 2, as depicted in
Walled Garden 5 contains three servers:
The Pre-Authentication Capture Destination for the embodiment of
The Authentication Capture Destination is https://auth.com/login.jsp.
As shown in the embodiment of
At this point, the anonymous user may access Web locations on any of the three servers that are in the Walled Garden 5. For this example, assume that the Web pages on the wg1.com Server 6 include links to Web pages on the wg2.com Server 7. The anonymous user would be able to click on any of these links and view the referenced pages hosted on Server 7. However, if one of these Web pages contained a link to an “external” web site, and the user clicked on that link, then the Network Access Controller 2 would again redirect the Client's browser back to the Pre-Authentication Capture URL http://wg1.com/welcome.html, hosted on Server 6.
Now, assume that the anonymous user decides that they want to be authenticated, so that they may be allowed access to an “external” network destination. To enable the user to login, an HTML link is included on the welcome page at “http://wg1.com/welcome.html”. The link's reference URL identifies a server that is outside of the Walled Garden 5, and includes the special token string “proceedToAuthenticationURL=true” within the query portion. (Note that the exact form of this special token need not be predefined; the special token is simply uniquely identifiable.)
When the user clicks on this link, the Network Access Controller 2 intercepts the request. However, instead of redirecting the Client's browser to the Pre-Authentication Capture URL, the Network Access Controller 2 recognizes the presence of the token, and redirects the browser to the Authentication URL http://auth.com/login.jsp, hosted on the “auth.com” Server 8.
At this point, the user is presented with a Login page, and enters a username/password. Assuming that these credentials are valid, the “auth.com” Server 8 sends an “authorize” command to the Network Access Controller 2. This command instructs the Network Access Controller 2 to allow “external” access for the authenticated user.
As shown in
Note that in one embodiment, this “external” access is only granted to the authenticated user. An anonymous user on a different Client would still be restricted to the Walled Garden 5.
One embodiment of the decision logic (and associated flow) that can be executed by the Network Access Controller 2 is depicted in
When a network packet is received (step 19), the Network Access Controller 2 determines if the packet is being sent by an authenticated client (step 20).
If the packet is from an authenticated client, then the Network Access Controller 2 allows the packet to pass through and be routed to its target destination (“Yes” decision fork).
If the packet is from an unauthenticated client, then the Network Access Controller 2 determines if the destination of the packet is one of the servers within the Walled Garden 5 (step 21).
If the packet is from an unauthenticated client and the destination is a server in the Walled Garden 5, then the Network Access Controller 2 allows the packet to pass through and be routed to its target server (“Yes” decision fork).
If the packet is from an unauthenticated client and the destination is not a server in the Walled Garden 5, then the Network Access Controller 2 determines if a Pre-Authentication URL has been specified (step 22).
If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, and a Pre-Authentication URL has not been specified, then the Network Access Controller directs the client to the Authentication URL (step 24).
If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, and a Pre-Authentication URL has been specified, then the Network Access Controller 2 determines if the packet contains the Authentication Token (step 23).
If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, a Pre-Authentication URL has been specified, and the packet does not contain the Authentication Token, then the Network Access Controller 2 directs the client to the Pre-Authentication URL (step 25).
If the packet is from an unauthenticated client, the destination is not a server in the Walled Garden 5, a Pre-Authentication URL has been specified, and the packet contains the Authentication Token, then the Network Access Controller 2 directs the client to the Authentication URL (step 24).
While the present invention has been described with reference to particular embodiments, it should be understood that the embodiments are illustrative and that the scope of the invention is not limited to these embodiments. Many variations, modifications, additions and improvements to the embodiments described above are possible. It is contemplated that these variations, modifications, additions and improvements fall within the scope of the invention as detailed in the following claims.
This application claims priority under 35 U.S.C. 119(e) to U.S. Provisional Patent Application No. 60/551,705 entitled “System and Method for Double-Capture/Double-Redirect to a Different Location,” by Keith Johnston, et al., filed Mar. 10, 2004 and U.S. Provisional Patent Application No. 60/551,702 entitled “System and Method For Access Scope Control (“Walled Gardens”) For Clients of a Network Access Gateway”, by Patrick Turley, Keith Johnston and Steven D. Tonnesen, filed Mar. 10, 2004, which are both hereby fully incorporated by reference herein.
Number | Name | Date | Kind |
---|---|---|---|
5673393 | Marshall et al. | Sep 1997 | A |
5706427 | Tabuki | Jan 1998 | A |
5748901 | Afek et al. | May 1998 | A |
5878231 | Baehr et al. | Mar 1999 | A |
5896499 | McKelvey | Apr 1999 | A |
5901148 | Bowen et al. | May 1999 | A |
5936542 | Kleinrock et al. | Aug 1999 | A |
5953506 | Kalra et al. | Sep 1999 | A |
5987134 | Shin et al. | Nov 1999 | A |
5996013 | Delp et al. | Nov 1999 | A |
6085241 | Otis | Jul 2000 | A |
6088451 | He et al. | Jul 2000 | A |
6092200 | Muniyappa et al. | Jul 2000 | A |
6108782 | Fletcher et al. | Aug 2000 | A |
6130892 | Short et al. | Oct 2000 | A |
6131116 | Riggins et al. | Oct 2000 | A |
6157953 | Chang et al. | Dec 2000 | A |
6173331 | Shimonishi | Jan 2001 | B1 |
6176883 | Holloway et al. | Jan 2001 | B1 |
6185567 | Ratnaraj et al. | Feb 2001 | B1 |
6194992 | Short et al. | Feb 2001 | B1 |
6199113 | Alegre et al. | Mar 2001 | B1 |
6205552 | Fudge | Mar 2001 | B1 |
6212558 | Antur et al. | Apr 2001 | B1 |
6219706 | Fan et al. | Apr 2001 | B1 |
6233607 | Taylor et al. | May 2001 | B1 |
6243815 | Antur et al. | Jun 2001 | B1 |
6275693 | Lin et al. | Aug 2001 | B1 |
6295294 | Odlyzko | Sep 2001 | B1 |
6321339 | French et al. | Nov 2001 | B1 |
6324648 | Grantges, Jr. | Nov 2001 | B1 |
6336133 | Morris et al. | Jan 2002 | B1 |
6404743 | Meandzija | Jun 2002 | B1 |
6421319 | Iwasaki | Jul 2002 | B1 |
6463474 | Fuh et al. | Oct 2002 | B1 |
6473793 | Dillon et al. | Oct 2002 | B1 |
6473801 | Basel | Oct 2002 | B1 |
6477143 | Ginossar | Nov 2002 | B1 |
6502131 | Vaid et al. | Dec 2002 | B1 |
6516417 | Pegrum et al. | Feb 2003 | B1 |
6535879 | Behera | Mar 2003 | B1 |
6539431 | Sitaraman et al. | Mar 2003 | B1 |
6636894 | Short et al. | Oct 2003 | B1 |
6678733 | Brown et al. | Jan 2004 | B1 |
6708212 | Porras et al. | Mar 2004 | B2 |
6732179 | Brown et al. | May 2004 | B1 |
6735691 | Capps et al. | May 2004 | B1 |
6757740 | Parekh et al. | Jun 2004 | B1 |
6785252 | Zimmerman et al. | Aug 2004 | B1 |
6789110 | Short et al. | Sep 2004 | B1 |
6804783 | Wesinger et al. | Oct 2004 | B1 |
6823385 | McKinnon et al. | Nov 2004 | B2 |
6917622 | McKinnon et al. | Jul 2005 | B2 |
7013331 | Das | Mar 2006 | B2 |
7120934 | Ishikawa | Oct 2006 | B2 |
7143283 | Chen et al. | Nov 2006 | B1 |
7146639 | Bartal et al. | Dec 2006 | B2 |
7181017 | Nagel et al. | Feb 2007 | B1 |
7185368 | Copeland, III | Feb 2007 | B2 |
7266754 | Shah et al. | Sep 2007 | B2 |
7272646 | Cooper et al. | Sep 2007 | B2 |
7324947 | Jordan et al. | Jan 2008 | B2 |
7325042 | Soscia et al. | Jan 2008 | B1 |
7406530 | Brown et al. | Jul 2008 | B2 |
7420956 | Karaoguz et al. | Sep 2008 | B2 |
20010038639 | McKinnon et al. | Nov 2001 | A1 |
20010038640 | McKinnon et al. | Nov 2001 | A1 |
20010038645 | McKinnon et al. | Nov 2001 | A1 |
20010039576 | Kanada | Nov 2001 | A1 |
20010039582 | McKinnon et al. | Nov 2001 | A1 |
20020013844 | Garrett et al. | Jan 2002 | A1 |
20020021665 | Bhagavath et al. | Feb 2002 | A1 |
20020023160 | Garrett et al. | Feb 2002 | A1 |
20020029260 | Dobbins et al. | Mar 2002 | A1 |
20020035699 | Crosbie | Mar 2002 | A1 |
20020042883 | Roux et al. | Apr 2002 | A1 |
20020046264 | Dillon et al. | Apr 2002 | A1 |
20020052950 | Pillai et al. | May 2002 | A1 |
20020055968 | Wishoff et al. | May 2002 | A1 |
20020059408 | Pattabhiraman et al. | May 2002 | A1 |
20020075844 | Hagen | Jun 2002 | A1 |
20020085719 | Crosbie | Jul 2002 | A1 |
20020087713 | Cunningham | Jul 2002 | A1 |
20020090089 | Branigan et al. | Jul 2002 | A1 |
20020091944 | Anderson et al. | Jul 2002 | A1 |
20020112183 | Baird, III et al. | Aug 2002 | A1 |
20020112186 | Ford et al. | Aug 2002 | A1 |
20020120741 | Webb et al. | Aug 2002 | A1 |
20020123335 | Luna et al. | Sep 2002 | A1 |
20020124078 | Conrad | Sep 2002 | A1 |
20020124103 | Maruyama et al. | Sep 2002 | A1 |
20020129143 | McKinnon, III et al. | Sep 2002 | A1 |
20020131404 | Mehta et al. | Sep 2002 | A1 |
20020133581 | Schwartz et al. | Sep 2002 | A1 |
20020133589 | Gubbi et al. | Sep 2002 | A1 |
20020136226 | Christoffel et al. | Sep 2002 | A1 |
20020138762 | Horne | Sep 2002 | A1 |
20020138763 | Delany et al. | Sep 2002 | A1 |
20020143964 | Guo et al. | Oct 2002 | A1 |
20020152284 | Cambray et al. | Oct 2002 | A1 |
20020162030 | Brezak et al. | Oct 2002 | A1 |
20020164952 | Singhai et al. | Nov 2002 | A1 |
20020165990 | Singhai et al. | Nov 2002 | A1 |
20020169867 | Mann et al. | Nov 2002 | A1 |
20020174227 | Hartsell et al. | Nov 2002 | A1 |
20020178282 | Mysore et al. | Nov 2002 | A1 |
20020199007 | Clayton et al. | Dec 2002 | A1 |
20030041104 | Wingard et al. | Feb 2003 | A1 |
20030043846 | Purpura et al. | Mar 2003 | A1 |
20030046370 | Courtney | Mar 2003 | A1 |
20030055994 | Herrmann et al. | Mar 2003 | A1 |
20030059038 | Meyerson et al. | Mar 2003 | A1 |
20030061506 | Cooper et al. | Mar 2003 | A1 |
20030069956 | Gieseke et al. | Apr 2003 | A1 |
20030070170 | Lennon | Apr 2003 | A1 |
20030078784 | Jordan et al. | Apr 2003 | A1 |
20030087629 | Juitt et al. | May 2003 | A1 |
20030126608 | Safadi et al. | Jul 2003 | A1 |
20030135753 | Batra et al. | Jul 2003 | A1 |
20030149751 | Bellinger et al. | Aug 2003 | A1 |
20030154399 | Zuk et al. | Aug 2003 | A1 |
20030159072 | Bellinger et al. | Aug 2003 | A1 |
20030163603 | Fry et al. | Aug 2003 | A1 |
20030172167 | Judge et al. | Sep 2003 | A1 |
20030177477 | Fuchs | Sep 2003 | A1 |
20030212800 | Jones et al. | Nov 2003 | A1 |
20030217126 | Polcha et al. | Nov 2003 | A1 |
20040015719 | Lee et al. | Jan 2004 | A1 |
20040047356 | Bauer | Mar 2004 | A1 |
20040049586 | Ocepek et al. | Mar 2004 | A1 |
20040064836 | Ludvig et al. | Apr 2004 | A1 |
20040073941 | Ludvig et al. | Apr 2004 | A1 |
20040085906 | Ohtani et al. | May 2004 | A1 |
20040093513 | Cantrell et al. | May 2004 | A1 |
20040103426 | Ludvig et al. | May 2004 | A1 |
20040122956 | Myers et al. | Jun 2004 | A1 |
20040172557 | Nakae et al. | Sep 2004 | A1 |
20040177276 | MacKinnon et al. | Sep 2004 | A1 |
20040179822 | Tsumagari et al. | Sep 2004 | A1 |
20040181816 | Kim et al. | Sep 2004 | A1 |
20040199635 | Ta et al. | Oct 2004 | A1 |
20040210633 | Brown et al. | Oct 2004 | A1 |
20040268234 | Sampathkumar et al. | Dec 2004 | A1 |
20050021686 | Jai et al. | Jan 2005 | A1 |
20050044350 | White et al. | Feb 2005 | A1 |
20050044422 | Cantrell et al. | Feb 2005 | A1 |
20050091303 | Suzuki | Apr 2005 | A1 |
20050138416 | Qian et al. | Jun 2005 | A1 |
20050149721 | Lu et al. | Jul 2005 | A1 |
20050193103 | Drabik | Sep 2005 | A1 |
20050195854 | Agmon et al. | Sep 2005 | A1 |
20050204022 | Johnston et al. | Sep 2005 | A1 |
20050204031 | Johnston et al. | Sep 2005 | A1 |
20050204050 | Turley | Sep 2005 | A1 |
20050204168 | Johnston et al. | Sep 2005 | A1 |
20050204169 | Tonnesen | Sep 2005 | A1 |
20050204402 | Turley et al. | Sep 2005 | A1 |
20060036723 | Yip et al. | Feb 2006 | A1 |
20060168229 | Shim et al. | Jul 2006 | A1 |
20060173992 | Weber et al. | Aug 2006 | A1 |
20060184618 | Kurup et al. | Aug 2006 | A1 |
20070073718 | Ramer et al. | Mar 2007 | A1 |
20070186113 | Cuberson et al. | Aug 2007 | A1 |
20070208936 | Robles | Sep 2007 | A1 |
20070268878 | Clements | Nov 2007 | A1 |
20080066096 | Wollmershauser et al. | Mar 2008 | A1 |
20080120661 | Ludvig et al. | May 2008 | A1 |
20080147840 | Roelens et al. | Jun 2008 | A1 |
20080276305 | Chan et al. | Nov 2008 | A1 |
Number | Date | Country |
---|---|---|
0587522 | Jan 2000 | EP |
WO 0177787 | Oct 2001 | WO |
WO 0209458 | Jan 2002 | WO |
WO 0223825 | Mar 2002 | WO |
WO 0241587 | May 2002 | WO |
WO 02077820 | Oct 2002 | WO |
WO 03021890 | Mar 2003 | WO |
WO 03098461 | May 2003 | WO |
WO 2004034229 | Apr 2004 | WO |
WO 2004036371 | Apr 2004 | WO |
WO 2005020035 | Mar 2005 | WO |
Number | Date | Country | |
---|---|---|---|
20050204168 A1 | Sep 2005 | US |
Number | Date | Country | |
---|---|---|---|
60551705 | Mar 2004 | US | |
60551702 | Mar 2004 | US |