FIELD OF THE INVENTION

The present invention relates to secured communication and, in particular, to the use of secured communication over restricted networks. Specifically, an apparatus and method are disclosed for enabling secure communication (such as VPN) over a network with restricted access when secure communication (such as VPN) has previously occurred over another network.

BACKGROUND OF THE INVENTION

While connected to a secure computing environment, users are typically protected from unauthorized receipt of their communication. Furthermore, chances of eavesdropping, destruction, or other adverse actions may be prevented by minimizing the chance of infection via spyware or malware. Technology users thus prefer to perform computer interaction on an enterprise network (or a trusted network) to ensure computer security.

It is not possible, however, to always confine oneself to a secure environment. Users are often in places where they require Internet access, but access is only available via a public network that is not secure. More specifically, users may need to connect a laptop and/or mobile phone to the Internet, may require various levels of security in their computation and communication tasks, and may find that the only practical way to communicate with the Internet is via a publicly available server. Connecting to the Internet in such an environment exposes the user to eavesdropping, data destruction, hacking etc. Another danger, however, also exists. When users are on their secure networks, firewall and security software often protects them from being able to communicate with sites that can potentially cause harm. Outside of the secure network, there might not be a “gatekeeper” to prevent a user from engaging in harmful site access. Furthermore, a user may access an endpoint with malware present, and such malware can subsequently gain access to enterprise resources.

Access to unsecured networks is often simple to achieve, since such networks are typically wireless. It is very common for such a network to be a local area network (LAN), and access to the LAN is provided via a wireless standard such as Wi-Fi. An access point provides a physical interface at which a user gains access to the LAN. The LAN may then transmit data to and receive data from a wide area network (WAN) such as the Internet.

Because wireless access has become so simple for the average layperson to achieve, wireless communication techniques are commonly used with a wide variety of mobile terminals, including smartphones, electronic whiteboards, projectors, laptops, etc. Wireless communication is performed by gaining entrance to a network using an access point. Because it is often not possible to visually confirm who is gaining access to wireless network, security relating to wireless communication typically needs to be more enhanced than in wired communication. Thus, before the terminal is connected to a wireless access point, the terminal may first be authenticated. Furthermore, in many wireless applications, data that is transmitted and received is encrypted. Another way to protect the wireless network is to limit access to terminals that have MAC addresses that are registered in advance. When the terminal attempts to connect to an access point, the MAC address of the terminal is compared to a list of MAC addresses. Connection is only permitted if the terminal's MAC address is on the list.

While the use of MAC addresses as a security tool works well, such a strategy also creates substantial limitations. In particular, a user with a legitimate right to be on a private network may be denied access because the MAC address of the user's terminal has not been preregistered. As another example, a guest having a smart phone, laptop, or tablet may be invited into a conference room to exchange information or have a discussion using the guest's electronic device. If the MAC address of the device has not been preregistered, use of the device on the private network is not permitted.

As a further example, a substantial number of businesses operate private networks in their respective physical locations. Such offerings have numerous advantages. For example, many buildings are constructed of materials that interfere with the cellular communication of a user that is inside the building. An individual shopping in a retail store may thus be unable to communicate with their cellular network. A business may wish to offer their own private wireless network to all shoppers as part of providing good customer service. If a shopper has good wireless communication during their shopping experience, the shopper is incentivized to stay in the store for a longer period of time, and to make additional purchases. As another example, current Wi-Fi technology allows a shopper on a Wi-Fi network to be position tracked as they move about the store. In this manner, it is possible to obtain intelligence regarding shopper behavior.

Providing the public with access to a private network, while advantageous, is not without its risks. For example, the owner of a private network typically does not wish to give every member of the public unrestricted access to their network. At a minimum, it may be desirable to insist that each network user agree on terms or conditions for network access in order to limit liability. Also, it may be very desirable to advise potential network users of rules they are required to follow while using the network in order to maintain network integrity. In other situations, prior to granting network access, it may be desirable to obtain some form of identification and/or password so that the network owner has information regarding who is on their network. In other situations, network owners may desire greater quantities of information to ensure security and/or enable future advertising or marketing to network users. In a further situation, network owners may wish to limit network access to individuals that are actually making purchases within their establishment (by providing them a password, for example, after making a purchase). In yet further situations, network owners may desire to be paid for network access before network access is granted.

One way to achieve the above goals is by providing limited accessibility to a network. Such a network may be referred to as “closed.” The limited accessibility allows a user terminal to request authentication from the network. Once authentication has been completed, the user terminal is then permitted greater (or possibly total) access to the network.

One common way to provide authentication to a user terminal seeking network access is via a captive portal. Wikipedia defines a captive portal as follows:. . . a web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi network before they are granted broader access to network resources. Captive portals are commonly used to present a landing or log-in page which may require authentication, payment, acceptance of an end-user license agreement, acceptable use policy, survey completion, or other valid credentials that both the host and user agree to adhere by. Captive portals are used for a broad range of mobile and pedestrian broadband services—including cable and commercially provided Wi-Fi and home hotspots. A captive portal can also be used to provide access to enterprise or residential wired networks, such as apartment houses, hotel rooms, and business centers.

Network resources are thus withheld from a user terminal requesting network access until the requirements of the captive portal have been satisfied. The captive portal may be transmitted to a prospective network user in response to a request for network access. An example of a request for network access is an HTTP request for a web page from a requesting terminal. A captive portal authentication server evaluates the request for network resources and determines if the request has come from a source that has already been granted (full) network access. If not, the authentication server responds to the HTTP request with either the contents of the captive portal page, or an HTTP Redirect response which sends the HTTP client to the URL of the captive portal page where it is hosted. Once required information has been provided to the authentication server in response to the captive portal, widespread network access is then granted to the requesting terminal.

The network for which access is granted by the captive portal may be referred to as a closed network, an initially closed network, or a captive network.

Captive portals control network access. They do not, however, address the issue of secure communication. In fact, once access to a network guarded by a captive portal is granted, a user is often communicating in a non-secure environment, and risk of security breach may be high.

Generally speaking, one method of allowing users to have secure communication over a network is through the use of a secure communications channel An example of a secure communications channel is a Virtual Private Network (VPN). Various types of VPNs are available. A corporate VPN enables access to the internal resources (intranet) of an enterprise. A private VPN permits access to Internet resources. When data is sent over a public network using a VPN, eavesdropping of the data is prevented.

In order to communicate over the Internet, data segments from layer-4 in the OSI model (Transport) are divided into packets. An IP packet is then formed by adding header information to the data unit received from layer-4. The resulting IP packet comprises an IP header and an IP payload (where the data is located). In the header, address information is included such as the source of the data and the destination of the data. The source of the data is included in the header so that once the packet is received at its destination, a response can be transmitted to the data source. The IP packets form IP traffic (also known as layer-3 traffic). The communications format may also be referred to as TCP/IP.

In order to exchange data over a VPN, the IP traffic is received by the VPN software (i.e. the VPN client). The VPN software a) optionally encrypts each IP packet b) encapsulates each IP packet with a new header. Again, step a) is optional and step b) is not optional. The new header includes the VPN server as the destination address and the client as the source address. Once the encapsulated IP traffic is received by the VPN server, the new header is removed, encrypted data (if any) is decrypted, and the IP packet is delivered to its intended destination.

When referring to a VPN, application data and its associated header (for example an IP packet) is considered to be “encapsulated” when a further header that includes the destination address of a VPN server is attached to the application data (and associated header). When referring to the transmission of application data (and its associated header) outside of a VPN, application data is considered to be “unencapsulated” when it is not encapsulated (i.e. a header that includes the destination address of a VPN server is not attached to the application data and its associated header) and “decapsulated” when encapsulation is removed. Put another way, unencapsulated application data (and its associated header), for example an IP packet, is 1) encapsulated by a VPN client, 2) the encapsulated application data and header is transmitted to a VPN server, 3) the VPN server decapsulates the encapsulated application data, and 4) the decapsulated application data is forwarded to a final destination.

In the above example the encapsulated data may or may not be encrypted.

SUMMARY OF THE INVENTION

A method of communicating with a remote server via a client, the method comprises the steps of: allowing encapsulated data to be transmitted from the client and towards a remote server via a VPN; attempting to gain access to, or to increase access to, a private network with unencapsulated data and outside of the VPN; identifying a captive portal that restricts access to the private network; allowing receipt of signaling with unencapsulated data outside of the VPN that causes an authentication server associated with the captive portal to permit access or increase access to the private network; and transmitting encapsulated data from the client to the remote server via the VPN and over the private network after the authentication server grants access to the private network.

