Secure captive portal remediation

Patent metadata

Field	Value
Publication number	US-2020358770-A1
Application number	US-201916407808-A
Country	US
Kind code	A1
Filing date	May 9, 2019
Priority date	May 9, 2019
Publication date	Nov 12, 2020
Grant date	—

Abstract

Methods to securely remediate a captive portal are provided. In these methods, a processor of a user device detects a connection, via a network, to a captive portal. Based on the detected connection to the captive portal, the processor launches a dedicated secure web browser, and selectively restricts access of the user device to the network in order to only allow, via the dedicated secure web browser, communications related to remediation with the captive portal.

First claim

What is claimed is:

1 . A method comprising:
detecting, by a processor of a user device, a connection, via a network, to a captive portal; based on detecting the connection to the captive portal, launching, by the processor, a dedicated secure web browser; and selectively restricting, by the processor, access of the user device to the network to only allow, via the dedicated secure web browser, communications related to remediation with the captive portal.

2 . The method of claim 1 , further comprising:
based on the launching of the dedicated secure web browser, loading, by the processor, a universal resource locator (URL) that redirects the dedicated secure web browser to a captive portal remediation page.

3 . The method of claim 2 , further comprising:
executing, by the processor, a network security control daemon that detects the connection to the captive portal and updates at least one network access restriction of the user device; and remediating with the captive portal, wherein the remediating with the captive portal comprises:
displaying, on the dedicated secure web browser, content received from the captive portal,
obtaining, via the dedicated secure web browser, user input related to obtaining access to the network of the captive portal;
providing the user input to the captive portal;
obtaining, from the captive portal, a response indicating one of:
access to a network of the captive portal is granted, and
further input is required to obtain the access to the captive portal; and periodically polling to detect completion of remediation with the captive portal.

4 . The method of claim 3 , further comprising:
based on detecting the completion of the remediation and the response indicating that the access to the network of the captive portal is granted, updating, by the network security control daemon, the at least one network access restriction of the user device by reapplying one or more network access restrictions executed by the processor prior to the detecting of the connection to the captive portal.

5 . The method of claim 1 , wherein the selectively restricting the access of the user device to the network comprises updating at least one network access restriction of the user device such that one or more user applications, executed by the processor, are blocked from the access to the network.

6 . The method of claim 5 , wherein the one or more user applications include a web browser and at least one of virtualized desktop applications, social media applications, email applications, and content streaming applications.

7 . The method of claim 5 , wherein the selectively restricting the access of the user device to the network comprises blocking transmission of data from the one or more user applications to one or more destinations external to the user device.

8 . The method of claim 7 , wherein the selectively restricting the access of the user device to the network comprises updating the at least one network access restriction of the user device such that data received by the user device from sources external to the user device is dropped without being processed.

9 . The method of claim 1 , further comprising:
initiating, by the processor, a virtual private network (VPN) tunnel with a VPN server; based on detecting the connection to the captive portal, updating, by the processor, one or more existing network access restrictions to one or more captive portal network access restrictions which include blocking data to and from the VPN server; detecting, by the processor, a successful completion of remediation with the captive portal; based on the detecting the successful completion of remediation with the captive portal, updating the one or more captive portal network access restrictions of the user device to re-apply the one or more existing network access restrictions; and based on the updating to the one or more existing network access restrictions, reestablishing the VPN tunnel with the VPN server.

10 . An apparatus comprising:
a communication interface configured to enable network communications on a network; a memory configured to store executable instructions; and a processor coupled to the communication interface and the memory, and configured to:
detect a connection, via a network, to a captive portal;
based on the connection to the captive portal detected by the processor, launch a dedicated secure web browser; and
selectively restrict access of the apparatus to the network to only allow, via the dedicated secure web browser, communications related to remediation with the captive portal.

11 . The apparatus of claim 10 , wherein the processor is further configured to load a universal resource locator (URL) that redirects the dedicated secure web browser to a captive portal remediation page.

12 . The apparatus of claim 11 , further comprising:
a display; and a user interface, wherein the processor is further configured to:
execute a network security control daemon that detects the connection to the captive portal and updates one or more of existing network access restrictions of the apparatus to one or more of captive portal network access restrictions of the apparatus;
remediate with the captive portal by:
displaying, on the display, the dedicated secure web browser including content received from the captive portal,
obtaining, via the user interface, user input related to obtaining access to the captive portal;
providing the user input to the captive portal;
obtaining, from the captive portal, a response indicating one of:
access to the captive portal is granted, and
further input is required to obtain the access to the captive portal;

periodically polling to detect completion of remediation with the captive portal; and
based on detecting the completion of the remediation with the captive portal, update the one or more captive portal network access restrictions of the apparatus by applying the one or more existing network access restrictions.

13 . The apparatus of claim 10 , wherein the processor is configured to selectively restrict the access of the apparatus to the network by updating at least one network access restriction of the apparatus such that one or more user applications, executed by the processor, are blocked from access to the network, and
wherein the one or more user applications include a web browser and at least one of virtualized desktop applications, social media applications, email applications, and content streaming applications.

14 . The apparatus of claim 13 , wherein the processor is configured to selectively restrict the access of the apparatus to the network by blocking transmission of data via the communication interface from the one or more user applications from the apparatus and by dropping data received via the communication interface by the apparatus from sources external to the apparatus.

15 . The apparatus of claim 10 , wherein the processor is further configured to:
initiate a virtual private network (VPN) tunnel with a VPN server; based on the processor detecting the connection to the captive portal, update one or more existing network access restrictions of the apparatus to one or more captive portal network access restrictions which include blocking data to and from the VPN server; detect a successful completion of the remediation with the captive portal; based on the processor detecting the successful completion of the remediation with the captive portal, update the one or more captive portal network access restrictions of the apparatus to the one or more existing n

Assignees

• Cisco Tech Inc

Inventors

• Parla Vincent E
• Santau Valentiu Vlad
• Davis Peter Scott

Classifications

• H04L63/168 Primary

  above the transport layer · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title