Method for protecting resources access to a device connected through an authorized device

Abstract

A method, a non-transitory computer-readable medium, a network traffic management device, and a network traffic management system for protecting a resource accessible to a secondary device connected to a hotspot hosted by a host device that establishes a VPN tunnel with a secure server storing the protected resource are shown. With this technique, a host device establishes a connection with a protected resource via a VPN tunnel based on a successful compliance check, and at the same time the host device also acts as a hotspot. The host device intercepts one or more data packets from a secondary device connected to the hotspot, and in response to determining that the data packet has a TTL value less than a default value, the host device performs a security action on the data packet.

Description

[0001] The present technology relates to methods and systems for protecting resources accessible to devices via an authorized host device acting as a hotspot. Background Art

[0002] Many organizations and enterprises have an architecture that allows remote users to securely access protected resources on a secure server by utilizing a virtual private connection (VPN). When a remote device connects to a secure server using a VPN, the connection may create what may be called a VPN tunnel, which may be a communication channel between the remote device and the secure server, which may provide additional security, such as traffic encryption. In many cases, the user must be authorized and may have to provide login credentials to establish such a VPN tunnel between the remote device and the secure server. In addition, the security protocol of the organization associated with the secure server may also require the remote device to pass a security compliance check before establishing a VPN tunnel with the secure server. The security compliance check may involve a software program performing an analysis on the remote device to determine whether the remote device has the appropriate security protection required in order to be allowed to access the secure server. For example, the organization may require that the remote device include the required antivirus software, anti-malware software, data loss prevention (DLP) software, and any other software or device features that the organization associated with the secure server may require. These requirements provide a certain degree of security for the protected resources on the remote server. For example, if a remote device accesses a secure server without appropriate antivirus software, a user who remotely accesses the secure server but unknowingly has malware on their device may open the secure server to malware attacks. Similarly, if a remote device accessing a secure server does not include the required DLP software, the secure server may be at risk for data theft from the remote device (e.g., either via malware unknowingly installed on the remote device or intentional deletion by a user who is authorized to access the remote server but not authorized to steal data therefrom).

[0003] The various computing devices that can be used to access the secure server in the manner described above may also be able to act as a hotspot (or mobile hotspot) that can provide Internet access to other nearby devices. For example, a user may utilize a host device (e.g., a mobile smartphone) to create a VPN tunnel with the secure server described above while acting as a mobile hotspot to allow the user to connect an auxiliary device (e.g., his laptop) to the Internet via a hotspot hosted by the host device (or, for example, conversely, a laptop may be used to create a VPN tunnel and host a hotspot, while the smartphone may be used as an auxiliary device). However, this may present a significant security risk to the protected resources on the secure server, because since the host device has already established a VPN tunnel with the secure server, the auxiliary device may (intentionally or unintentionally) access the established VPN tunnel when connected to the host device as a hotspot. In other words, the auxiliary device (which may not have undergone any security screening, such as through a security compliance check to ensure that the device has adequate antivirus or DLP software) can now access the secure server via the hotspot and VPN tunnel provided by the host device, which may expose the protected resources of the secure server to the risk of theft, destruction, or other malicious activity, whether due to intentional behavior by the user of the auxiliary device or unknowingly via malware contained on the auxiliary device.

[0004] Therefore, there is a need to create a system to protect the resources of a secure server (which are accessible via a VPN tunnel to an authorized host device that also acts as a hotspot) to prevent other devices with insufficient security protection from accessing the protected resources of the secure server. Summary of the invention

[0005] A method implemented by a network traffic management system including one or more server devices, host devices, or client devices includes establishing a connection to a protected resource via a virtual private network (VPN) tunnel based on a successful compliance check. The method also includes acting as a hotspot when establishing the connection to the protected resource. The method includes intercepting one or more data packets from an auxiliary device connected to the hotspot. In response to determining that the one or more data packets have a time to live (TTL) value less than a default value, performing a security action.

[0006] A network traffic management device includes: a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to establish a connection with a protected resource via a VPN tunnel based on a successful compliance check. When establishing the connection with the protected resource, the network traffic management device acts as a hotspot. The network traffic management device intercepts one or more data packets from a secondary device connected to the hotspot. In response to determining that the one or more data packets have a TTL value less than a default value, a security action is performed.

[0007] A non-transitory computer readable medium having instructions including executable code stored thereon, the instructions, when executed by one or more processors, causing the processors to establish a connection to a protected resource via a VPN tunnel based on a successful compliance check. When establishing the connection to the protected resource, the processor acts as a hotspot. The processor intercepts one or more data packets from an auxiliary device connected to the hotspot. In response to determining that the one or more data packets have a TTL value less than a default value, a security action is performed.

[0008] A network traffic management system includes one or more server devices, network traffic management devices, or client devices having: a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to establish a connection to a protected resource via a VPN tunnel based on a successful compliance check. When establishing a connection to the protected resource, the processor acts as a hotspot. The processor intercepts one or more data packets from an auxiliary device connected to the hotspot. In response to determining that the one or more data packets have a TTL value less than a default value, a security action is performed.

[0009] The present technology provides many advantages, including providing a method for providing security to prevent devices that have not undergone security compliance checks from accessing protected resources via a host device that acts as a hotspot and has established a VPN tunnel with the protected resources, a non-transitory computer-readable medium, a network traffic management device, and a network traffic management system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 is a block diagram of an exemplary network traffic management system;

[0011] Figure 2 is a block diagram of an exemplary network traffic management device;

[0012] Figure 3 is a flow chart of an exemplary method for providing access control to a protected server for an attempt by a secondary device to access the protected server via a hotspot operated by a host device that establishes a VPN tunnel with the protected server; and

[0013] Figure 4 is a flow chart of an exemplary method for protecting resources accessible to a device via an authorized host device acting as a hotspot.

[0014] Although each of the drawings shows a specific example for the purpose of clearly showing the examples, other examples may omit, add, reorder or modify any of the elements shown in the drawings. For the purpose of clearly showing the examples, one or more figures may be described with reference to one or more other figures, but the specific arrangements shown in one or more other figures are not required to be used in the examples. DETAILED DESCRIPTION

[0015] In the following description, for the purpose of explanation, many specific details are provided to provide a thorough understanding of the present invention. However, it should be understood that the present invention can be practiced without these specific details. In other examples, well-known structures and devices are shown in block diagram form to avoid unnecessary obscurity of the present invention.

[0016] It should also be understood that: unless expressly stated otherwise, the term "or" can be inclusive or exclusive; the term "set" can include zero, one, or two or more elements; the terms "first", "second", "some" and "particular" are used as naming conventions to distinguish elements from each other, and unless otherwise stated, do not imply the order, timing or any characteristics of the referenced items; the terms "such as", "eg", "for example", etc. describe one or more examples, but are not limited to the examples described; the terms "comprises" and / or "comprising" specify the presence of the stated features, but do not exclude the presence or addition of one or more other features.

[0017] A "computer system" refers to one or more computers, such as one or more physical computers, virtual computers, and / or computing devices. As an example, a computer system may be or may include one or more server computers, cloud-based computers, cloud-based computer clusters, virtual machine instances, or virtual machine computer elements, such as virtual processors, storage devices and memory, data centers, storage devices, desktop computers, laptop computers, mobile devices, or any other special-purpose computing devices. Unless otherwise expressly stated, any reference to a "computer system" herein may refer to one or more computers. When a computer system performs an action, the action is performed by one or more computers of the computer system.

[0018] A "client" (also referred to as a "client device") refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources is configured to interact with one or more servers over a network, such as the Internet. A client may refer to a combination of components on one or more computers, or one or more computers.

[0019] A "server" (also referred to as a "server system," "server computer system," "server device," or "server apparatus") refers to a combination of integrated software components and an allocation of computing resources, such as memory, computing devices, and processes on the computing devices for executing the integrated software components. The combination of software and computing resources provides a particular type of functionality on behalf of the server's clients. A server may refer to a combination of components on one or more computers, or one or more computers. A server may include multiple servers; that is, a server may include a first server computing device and a second server computing device, which may provide the same or different functionality to the same or different sets of clients.

[0020] As used herein, the term "website" may refer to a collection of web pages, web resources, and other web content that can be obtained through the Internet. For example, a first website may include web content hosted by a web server system (such as a first server device), and a second website may include web content hosted by a second web server system (such as a second web server device). Typically, the web content of a website shares a single domain name or a collection of related domain names that are owned or controlled by a common entity. A website may include web page content that can be accessed on the Internet through a browser, and / or web content that can be accessed from another client application through the Internet. Such applications may include web applications executed in a browser and / or native applications installed on a client computing device (also referred to as a "client device").

[0021] This document generally describes systems, methods, devices, and other techniques for protecting resources accessible to devices via an authorized host device that acts as a hotspot. An entity may wish to prevent other devices that have not passed a security compliance check from accessing protected resources via a device connected to a virtual private network (VPN) (where the connected device also acts as a hotspot), and the entity has an infrastructure for allowing authorized users to remotely access protected resources (e.g., resources stored on a private enterprise server) via the VPN, for example, based on the access device passing a security compliance check. The disclosed technology may involve providing software on a device that also acts as a hotspot (aka "host device") that can analyze traffic directed to a protected resource (aka "security server") to determine whether the traffic should be allowed to continue to the security server or whether a security action (e.g., dropping the packet) should be taken with respect to the traffic. The software installed on the host device may cause the host device to analyze a header of network traffic to determine whether the header contains a time-to-live value that is less than a default value, which may indicate that the packet originated from a secondary device accessing the host device that acts as a hotspot. If the host device determines that the TTL value of one or more network packets is less than a default value, the host device may perform a security action, such as dropping the one or more network packets or dropping the VPN connection with the security server.

[0022] If the auxiliary device can pass the security compliance check, the present technology may also involve providing access to the auxiliary device. For example, if the auxiliary device is connected to a host device, and the host device determines that the network packets originating from the auxiliary device have a TTL value less than a default value, the host device can discard those packets, but then can also provide a method for the auxiliary device to perform a security compliance check. For example, the host device can provide a security compliance check software download link for the auxiliary device. After downloading the security compliance check software, the auxiliary device can execute the software to perform a security compliance check, and assuming that the auxiliary device passes the security compliance check, the software can cause the network packet sent from the auxiliary device to have a modified header, which includes a flag indicating that the auxiliary device has passed the security compliance check. In some examples, the flag can be an authentication flag, which is a unique key that can be recognized by the compliance software running on the auxiliary device, the host module on the host device, and the server module on the server device. Thus, in some examples, if an auxiliary device connects to a hotspot operated by a host device in order to communicate with a secure server via a VPN tunnel established by the host device, the host device may analyze the header of a packet originating from the auxiliary device, and if it is determined that the header includes a flag indicating that the auxiliary device has passed a security compliance check, the host device may allow traffic from the auxiliary device to flow to the secure server via the VPN. In this manner, the disclosed technology may protect a secure server from being accessed by devices that have not passed a security compliance check, thereby increasing the security of protected resources hosted on a secure server from being accessed by devices that may be unknowingly infected with malware or lacking appropriate data loss prevention (DLP) software.

[0023] refer to Figure 1 , an exemplary network traffic management system 100 is shown. The network traffic management system 100 in this example includes a network traffic management device 102 coupled to a server device 104 and a client device 106 via a communication network 110, but the network traffic management device 102, the server device 104, and the client device 106 can be coupled together via other topologies. The network traffic management system 100 can also include other network devices that are well known in the art and will not be described herein, such as routers or switches. The present technology provides many advantages, including methods for providing protection for resources accessible to auxiliary devices (e.g., client devices 106) via authorized host devices (e.g., network traffic management devices 102), non-transitory computer-readable media, network traffic management systems 100, and network traffic management devices 102, which establish a VPN tunnel with a secure server (e.g., server device 104) containing these resources and also act as a hotspot at the same time.

[0024] In this particular example, Figure 1100 discloses the network traffic management device 102, the server device 104, and the client device 106 as dedicated hardware devices. However, in some examples, one or more of the network traffic management device 102, the server device 104, and the client device 106, or portions thereof, may also be implemented in software form within one or more other devices in the network traffic management system 100. Although the description herein is generally directed to a system distributed across multiple devices, it should be understood that it is contemplated that the technology disclosed herein may alternatively be applied to a centralized system.

[0025] refer to Figure 1 to Figure 2 , the network traffic management device 102 of the network traffic management device system 100 can perform any number of functions, such as, for example, performing security compliance checks, establishing a VPN connection / tunnel with the server device 104, acting as a hotspot, and providing access control functions for auxiliary devices connected to the hotspot hosted by the network traffic management device 102, which auxiliary devices may attempt to access the server device 104 using the VPN tunnel established by the network traffic management device 102. The network traffic management device 102 in this example includes a processor 202, a memory 204, and a communication interface 206 coupled together by a bus, but the secure server device 102 may include other types or numbers of elements in other configurations.

[0026] The processor 202 of the network traffic management device 102 can execute programmed instructions stored in the memory 204 of the network traffic management device 102 for any number of functions described and illustrated herein. The processor 202 of the network traffic management device 102 can include, for example, one or more central processing units (CPUs) or general-purpose processors having one or more processing cores, although other types of processors can also be used.

[0027] The memory 204 of the network traffic management device 102 stores these programming instructions for one or more aspects of the present technology as described and illustrated herein, but some or all of the programming instructions may be stored elsewhere. Various different types of memory storage devices (such as RAM, ROM, hard disk, solid state drive, flash memory, or other computer readable media that is read from and written to by a magnetic, optical or other read-write system coupled to a processor) can be used for the memory.

[0028] Thus, the memory of the network traffic management device 102 may store one or more modules that may include computer executable instructions that, when executed by the network traffic management device 102, cause the network traffic management device 102 to perform actions such as, for example, transmitting, receiving, or otherwise processing network messages and performing the operations described below with reference to Figure 3 to Figure 4Other actions described and shown. Modules can be implemented as components of other modules. In addition, modules can be implemented as applications, operating system extensions, plug-ins, etc.

[0029] In this particular example, the memory of the network traffic management device 102 includes a compliance check module 210. According to some examples, the compliance check module 210 may include software installed on the network traffic management device 102 that may perform a security compliance check on the network traffic management device 102 to determine whether the network traffic management device 102 includes certain predetermined security features, such as required antivirus software, anti-malware software, DLP software, and any other such security features that may be required by the organization operating the network traffic management system 100. In some examples, the security compliance check module 210 may also seek to confirm whether the antivirus software program, anti-malware software program, or DLP program is the latest version, is from a specified vendor, whether the software program last performed a device scan within a predetermined threshold time range (e.g., the most recent scan must have been within the last hour), whether the software program performed a database update (or at least checked for updates) within a predetermined threshold time range (e.g., the antivirus definition database was last updated within the last 24 hours), whether the software program has received required patches, whether the software program is actively running, or any other such characteristics of the software program that may be relevant to the security assessment of the device. According to some examples, the network traffic management device 102 must successfully pass a security compliance check before a VPN tunnel can be established with a secure server (e.g., server device 104). Thus, in some examples, the compliance check module 210 may include software that needs to be installed on the network traffic management device 102 by the organization operating the network traffic management system 100 before being able to attempt to access the secure server via VPN. In various examples, the compliance check module 210 may perform security compliance checks on the network traffic management device 102 at different time intervals. For example, in some examples, the security compliance check may be run intermittently (e.g., once an hour, once a day, etc.), or in some examples, the security compliance check may be run in response to some other event (such as, for example, in response to the network traffic management device 102 attempting to initiate a VPN tunnel with a secure server).

[0030] The memory 204 of the network traffic management device 102 may also include a virtual private network (VPN) module 212. The VPN module 212 may include software configured to allow the network traffic management device 102 to establish a VPN connection or VPN tunnel with the server device 104. In some examples, the VPN module may require that the user be authenticated before the VPN tunnel is established, for example, by entering a username and password, performing secondary authentication using a mobile device, obtaining a biometric signal of the user, or any other authentication technique that is known or may be subsequently developed. In some examples, the VPN tunnel established between the network traffic management device 102 and the server device 104 may be secure (e.g., traffic between the two may be encrypted) such that the only way to access protected resources on the secure server device 104 is through the process of establishing the VPN tunnel with the secure server device 104, as described herein. According to some examples, the VPN module 212 may determine whether the network traffic management device 102 has passed a security compliance check (such as performed by the compliance check module 210 described above) before allowing the VPN tunnel to be established between the network traffic management device 102 and the server device 104. In some examples, after attempting to establish a VPN connection / tunnel with the server device 104 using the VPN module 212, the VPN module 212 may cause the compliance check module 210 to run a security compliance check and receive the results of the security compliance check before allowing the VPN tunnel to be established. In other words, before establishing a VPN tunnel with the server device 104, the VPN module 212 may need to receive an indication from the compliance check module 210 that the network traffic management device 102 contains all security features required to allow the network traffic management device 102 to connect to the secure server device 104.

[0031] The memory 204 of the network traffic management device 102 may also include a hotspot access control module 214, which may provide access control between an auxiliary device connected to the network traffic management device 102 that acts as a hotspot and a secure server device 104 that has established a VPN tunnel with the network traffic management device 102. It should be understood by those of ordinary skill in the art that various devices such as smartphones, tablet computers, laptop computers, etc. are generally configured to be able to operate a mobile hotspot, thereby allowing other nearby devices to connect and access the Internet. Thus, the network traffic management device 102 may be configured to act as a hotspot, thereby allowing other auxiliary devices (e.g., client devices 106) to access the Internet via the network traffic management device 102, however, if the network traffic management device 102 has also established a VPN tunnel with the secure server device 104, the auxiliary device connected to the hotspot hosted by the network traffic management device 102 may inadvertently access the secure server device 104 via the established VPN tunnel.

[0032] Therefore, as follows Figure 3 and Figure 4Further described, the network traffic management device 102 can provide access control functions to prevent auxiliary devices that have not passed the necessary security compliance checks from accessing the secure server device 104 by connecting to a hotspot hosted by the network traffic management device 102 (via a VPN tunnel to the secure server device 104 established by the network traffic management device 102). For example, the hotspot access control module 214 can be configured to analyze network packets sent to a secure server for which a VPN tunnel has been established to determine whether these network packets should be allowed to be sent before the network packets are sent to the secure server. In some examples, the hotspot access control module 214 can check the header of each such packet to identify the time to live (TTL) value of the packet and compare it with a predetermined default value. Although the predetermined default value can be set to any number required for system management, the typical default value is "64" because this is usually the initial TTL value used when creating a network packet. In other words, if the TTL value of a given network packet is "64" in a system where the initial value used when creating a network packet is "64", this indicates that the packet has not undergone any jumps, and if the value of a given network packet is "63", this indicates that the network packet has undergone one jump. It should be understood by those skilled in the art that when an auxiliary device (e.g., client device 106) connects to a hotspot hosted by network traffic management device 102 and then sends traffic to the Internet through network traffic management device 102, the traffic will undergo one hop when arriving at network traffic management device 102, i.e., transmitted from the auxiliary device to network traffic management device 102. Therefore, the TTL of network packets originating from the auxiliary device in network traffic management device 102 will be "63" (or less, for example, in the case where the auxiliary device is able to connect to the hotspot via a third intermediate device) when arriving at network traffic management device 102. Therefore, when inspecting outbound network packets directed to a secure server that is the subject of a VPN tunnel between network traffic management device 102 and the secure server, hotspot access control module 214 can distinguish network packets originating from network traffic management device 102 itself (which has passed the security compliance check) from packets originating from auxiliary devices 106 (which the auxiliary device does not know whether to have passed the security compliance check) by inspecting the TTL value of the network packets and comparing it with a default value to determine whether the TTL value is less than the default value. If the hotspot access control module 214 identifies that the TTL value of one or more packets is less than a default value, the network traffic management device 102 can perform security actions, such as dropping the packet or severing the VPN connection with the security server device 104 to prevent the packet from being sent to the security server device 104.In this manner, the network traffic management device 102 can protect the secure server 104 with which the VPN tunnel is established from traffic originating from auxiliary devices that have not undergone appropriate security screening and that otherwise access the secure server device 104 by connecting to a hotspot hosted by the network traffic management device 102. Using the TTL value to identify the presence of an auxiliary device connected to the hotspot in this manner is superior to other possible methods, such as verifying the source IP address of the packet, because, for example, when network address translation (NAT) is enabled, the source IP address of the packet may have been translated before being verified by the network traffic management device 102, making this an ineffective method of identifying traffic originating from an auxiliary device.

[0033] In some examples, hotspot access control module 214 may include software configured to facilitate performing security compliance checks on the auxiliary device to allow the auxiliary device to access secure server 104 via the hotspot (if desired by the user). For example, hotspot access control module 214 may be configured to identify the auxiliary device upon determining that the packet is sent from the auxiliary device (i.e., by detecting that the TTL value of the packet is less than a default value), (e.g., by scanning for wireless signals (such as Wi-Fi signals, Bluetooth signals, etc.) of nearby devices and communicating with them to determine which device is accessing the hotspot, by establishing a communication link with a previously connected device that is detected to be nearby based on wireless signal detection (e.g., establishing a Bluetooth or Wi-Fi connection between an identified / previously connected device (such as a smartphone or laptop)), or by receiving information or data from the auxiliary device sufficient to identify the device (e.g., identifying a source IP address, MAC address, or other such identifier in a header of an identified packet)), and may communicate with the auxiliary device to facilitate providing security compliance checking software to the auxiliary device. For example, the network traffic management device 102 may send a link or http redirect request to the secondary device for a download page, which may be displayed, for example, by a web browser being used on the secondary device. Alternatively, in some examples, the user of the secondary device may manually view the link displayed by the host device and copy the link on the secondary device, or the link may be emailed to an email address associated with the user of the secondary device in response to the user of the host device entering the email address into a spreadsheet provided by software on the host device (e.g., VPN software or hotspot access control software). When activated by the secondary device, the link may cause the secondary device to download a lightweight security compliance check software package, which may perform the necessary security compliance checks on the secondary device and may provide other functionality, such as the ability to modify the header of an outgoing packet to include an authentication flag, the ability to authenticate a VPN server (e.g., by providing a username / password), and the ability to communicate with the host device. Upon determining that the secondary device has successfully passed the security compliance check, the downloaded software may also be configured to modify or supplement the header of a network packet transmitted by the secondary device to include a security compliance flag indicating that the secondary device has passed the security compliance check. Therefore, in some examples, the hotspot access control module 214 of the network traffic management device 102 can also be configured to analyze the headers of outgoing network packets to determine whether they include a security compliance flag, and if they include a security compliance flag, the hotspot access control module 214 can override the TTL value analysis of the network packets and only allow the packets to be sent to the secure server. In this way, the disclosed systems and methods can allow users to access secure servers using auxiliary devices by providing a way for auxiliary devices to perform security compliance checks.

[0034] This may be particularly useful, for example, if a user accesses a secure server using a mobile smartphone registered with their company, but instead wants to access the secure server using their laptop computer. In this case, the user may use their smartphone to establish a VPN tunnel with the secure server, use the smartphone-hosted hotspot, connect their laptop computer to the hotspot hosted by the smartphone, experience packet drops and be prompted to download the security compliance check software as described above, and then after successfully passing the downloaded security compliance check, the laptop computer may now be able to access the secure server via the smartphone hotspot, but at the same time ensure that the laptop computer has appropriate security protections in place to avoid exposing the secure server to the risk of being attacked, for example, by a virus unknowingly present in the laptop computer.

[0035] like Figure 1 As shown, the network traffic management device 102 can be located between the client device 106 and the server device 104 so that the network traffic management device 102 can intercept or otherwise receive network traffic directed to one or more server devices 104. In this manner, the network traffic management device 102 can analyze all traffic directed to the secure server device 104 from a secondary device (i.e., a client device 106) that is accessing a hotspot hosted by the network traffic management device 102.

[0036] The communication interface 206 of the network traffic management device 102 is operably coupled and communicates between the network traffic management device 102, the client device 106, and the server device 104, which are coupled together at least in part via the communication network 110, but other types and numbers of communication networks or systems having other types or numbers of connections or configurations to other devices or elements may also be used.

[0037] By way of example only, the communication network 110 may include a local area network (LAN) or a wide area network (WAN), and may use Ethernet-based TCP / IP and industry standard protocols, although other types or numbers of protocols or communication networks may be used. In this example, the communication network 110 may employ any suitable interface mechanism and network communication technology, including, for example, telephone traffic in any suitable form (e.g., voice and modem), a public switched telephone network (PSTN), an Ethernet-based packet data network (PDN) hosting a hypertext transfer protocol (HTTP), combinations thereof, and the like. The communication network may also include a local connection between a client device and the network traffic management device 102, such as a direct Wi-Fi connection, a Bluetooth connection, near field communication, a direct wired connection, or any other method by which the client device 106 communicates directly or indirectly with the network traffic management device 102.

[0038] In this example, the network traffic management device 102 is shown as including a single device, but in other examples, multiple devices may be included, each device having a processor (each processor having a processing core) that implements the steps of the present technology. In these examples, one or more of the devices may have a dedicated communication interface or memory. Alternatively, one or more of the devices may utilize the memory 204, the communication interface 206, or other hardware or software components of one or more other devices of the devices included in the network traffic management device 102.

[0039] Thus, one or more of the devices that collectively comprise the network traffic management device 102 may be a standalone device or integrated with one or more other devices or apparatuses, such as, for example, a server device 104. In addition, one or more of the devices of the network traffic management device 102 may be in the same or different communication networks, including, for example, one or more public, private, or cloud networks. In yet other examples, multiple network traffic management devices 102 may be deployed within and / or outside a local area network associated with a server device 104 that communicates with any number of application servers or end station computers, and other network topologies may also be used.

[0040] In some examples, the network traffic management device 102 may also be coupled to at least one output device via an I / O subsystem. The output device may be a digital computer display. Examples of displays that may be used for various examples include a touch screen display or a light emitting diode (LED) display or a liquid crystal display (LCD) or an electronic paper display. The network traffic management device 102 may include other types of output devices as an alternative or supplement to the display device. Examples of other output devices include a printer, a ticket printer, a plotter, a projector, a sound card or a video card, a speaker, a buzzer or a piezoelectric device or other sound device, a light or an LED or LCD indicator, a tactile device, an actuator, or a servo.

[0041] In some examples, at least one input device can be coupled to the I / O subsystem of the network traffic management device 102 for communicating signals, data, command selections, or gestures to the processor 304. Examples of input devices include touch screens, microphones, still and video digital cameras, alphanumeric and other keys, keypads, keyboards, graphics tablets, image scanners, joysticks, clocks, switches, buttons, dials, sliders, and / or various types of sensors such as force sensors, motion sensors, thermal sensors, accelerometers, gyroscopes, and inertial measurement unit (IMU) sensors and / or various types of transceivers such as wireless transceivers such as cellular or Wi-Fi, radio frequency (RF) or infrared (IR) transceivers, and global positioning system (GPS) transceivers.

[0042] Another type of input device is a control device that can perform cursor control or other automatic control functions (such as navigating in a graphical interface on a display screen) as an alternative or supplement to the input function. The control device can be a touch pad, a mouse, a trackball, or a cursor direction key for communicating direction information and command selections to the processor 202 and for controlling the movement of the cursor on the display. The input device can have at least two degrees of freedom on two axes (a first axis (i.e., x) and a second axis (i.e., y)), which allows the device to specify a position in a plane. Another type of input device can be a wired, wireless, or optical control device, such as a joystick, a recognition pen, a console, a steering wheel, a pedal, a gear shift mechanism, or other types of control devices. The input device can include a combination of multiple different input devices (such as a camera and a depth sensor).

[0043] According to some examples, the network traffic management device 102 may be any computing device that can be used to host a hotspot and establish a VPN tunnel with the server device 104, such as, for example, a smartphone, a laptop computer, a desktop computer, a tablet computing device, or any other such computing device. In another example, the network traffic management device 102 may be an Internet of Things (IoT) device or other type of network device in which one or more of the output device, input device, and control device are omitted. Alternatively, in such an example, the input device may be one or more cameras, motion detectors, thermometers, microphones, earthquake detectors, other sensors or detectors, measuring devices, or encoders, and the output device may be a dedicated display (such as a single-line LED or LCD display), one or more indicators, display panels, meters, valves, solenoids, actuators, or servos.

[0044] Return to reference Figure 1In this example, the server device 104 of the network traffic management system 100 can be a commercial web server that hosts one or more web pages that can be accessed by the client device 106. The web page can request web resources from any number of other domains. Example types of requests include XMLHttpRequests, Fetch API requests, WebSockets, WebRTCs, Beacons, form submissions, resource acquisition (such as links, scripts, images, videos, etc.), etc. According to some examples, the server device 104 can be a secure server that can only be accessed by authorized users. For example, a device accessing the server device 104 may need to authenticate by providing a username and password to access the server device 104. In addition, in some examples, the server device 104 can be configured to establish a VPN tunnel with the network traffic management device 102, which can be encrypted to provide secure communication between the devices. According to some examples, the server device 104 may require external devices that wish to connect to the server device 104 (e.g., via a VPN tunnel) to pass a security compliance screening to ensure that such devices include sufficient security to avoid exposing protected resources stored by the server device 104 to the risk of theft and / or damage.

[0045] The example of the server device 104 includes a processor, memory, and communication interface coupled together by a bus or other communication link (not shown), although other numbers or types of components may be used. The server device 104 in this example may include, for example, an application server or a database server, although other types of server devices 104 may also be included in the secure server system 100. In this example, the server device 104 may exchange communications to prevent or facilitate interaction of a user of a client device 106 with a hosted web application, which may optionally be protected by the network traffic management device 102 described and shown herein.

[0046] Thus, in some examples, the server device 104 can process web requests (e.g., requests to view web content, logins, and other requests) received from the network traffic management device 102 and / or the client device 106 via the communication network 110 according to, for example, an HTTP-based application RFC protocol. A protected web application can operate on the server device 104 and transmit data (e.g., files or web pages) to the network traffic management device 102 and / or the client device 106 in response to requests from the network traffic management device 102 and / or the client device 106. The server device 104 can be hardware or software, or can represent a system with multiple servers in a pool that can include an internal or external network.

[0047] Although the server device 104 is shown as a single device, in other examples, the server device 104 may include multiple servers distributed on one or more different network computing devices of the common server device 104. In addition, the server device 104 is not limited to a particular configuration. Thus, the server device 104 may include network computing devices that operate using a master / slave approach, whereby one of the network computing devices of the server device 104 operates to manage or otherwise coordinate the operations of the other network computing devices. The server device 104 may function as multiple network computing devices within a cluster architecture, a peer-to-peer architecture, within a virtual machine, or within a cloud architecture, for example.

[0048] Therefore, the technology disclosed herein should not be construed as limited to a single environment, and other configurations and architectures are also contemplated. Therefore, any number of network traffic management devices 102, client devices 106, and server devices 104 may be used. For the purpose of providing illustrative examples only, Figure 1 A plurality of network traffic management devices 102, client devices 106, and server devices 104 are shown.

[0049] In this example, each of the client devices 106 of the network traffic management system 100 includes any type of computing device that can exchange network data and interface with a web page, such as a mobile, desktop, laptop or tablet computing device, a virtual machine (including a cloud-based computer), etc. Each of the server devices 106 in this example includes a processor, a memory, and a communication interface coupled together by a bus or other communication link (not shown), but other numbers or types of components may also be used. According to some examples, the client device 106 may include some or all of the features of the network traffic management device 102, with the possible exception of lacking some of the specific software modules 210, 212, and 214 described with respect to the network traffic management device 102. Although as described herein, in some examples, the client device 106 may be prompted at some point to download a security compliance check program similar to the compliance check module 210. Thus, in some examples, client device 106 may be configured to download and execute a lightweight security compliance checker that operates to evaluate whether client device 106 includes required security features (e.g., specific antivirus software, DLP software, etc.), and upon determining that client device 106 has successfully passed the security compliance check (i.e., client device 106 includes predetermined / required security features), the client device is further configured to modify the header of outgoing network packets transmitted by client device 106 to include a flag indicating that client device 106 has successfully passed the security compliance check.

[0050] The client device 106 may run an interface application, such as a standard web browser or a native client application, which may provide an interface to issue requests to the server device 106 and receive content stored on the server device via the network 110. The client device 106 may also include a display device, such as a display screen or a touch screen, or an input device, such as, for example, a keyboard (not shown).

[0051] Although an exemplary network traffic management system 100 having a network traffic management device 102, a server device 104, a client device 106, and a communication network 110 is described and shown herein, other types or numbers of systems, devices, components, or elements in other topologies may be used. It should be understood that the example systems described herein are for exemplary purposes, as many variations of the specific hardware and software used to implement these examples are possible, as will be appreciated by those skilled in the relevant art.

[0052] In some examples, two or more computing systems or devices may be replaced with any of the systems or devices in any of the examples. Therefore, the principles and advantages of distributed processing, such as redundancy and replication, may also be implemented as needed to improve the robustness and performance of the devices and systems of the examples. These examples may also be implemented on a computer system extended over any suitable network using any suitable interface mechanisms and traffic technologies, including (by way of example only) wireless traffic networks, cellular traffic networks, packet data networks (PDNs), the Internet, intranets, and combinations thereof.

[0053] For one or more aspects of the present technology, these examples may also be embodied as one or more non-transitory computer-readable media having executable or programming instructions stored thereon (such as stored in the memory 204, ROM, or storage device of the network traffic management device 102), as described and shown by the examples herein. The instructions in some examples include executable code that, when executed by one or more processors (such as one or more processors 202 of the network traffic management device 102), causes the processor to perform the steps required to implement the methods of the examples of the present technology described and shown herein.

[0054] refer to Figure 3, a flow chart of an example method 300 for providing access control to a protected server for an attempt by a secondary device to access the protected server via a hotspot operated by a host device that establishes a VPN tunnel with the protected server is shown. In step 302 of the example, a host device (e.g., the network traffic management device 102 of the network traffic management system 100) establishes a connection between the host device and a secure server (e.g., the server device 104) via a VPN tunnel. In some examples, the VPN tunnel may be encrypted and / or require authentication of a user of the host device. In addition, as a condition for establishing a VPN tunnel with the secure server, the host device must first provide an indication to the VPN software that the host device has passed a security compliance check, which may be performed by executing security compliance checking software stored on the host device. In some examples, the host device may perform a security compliance check in response to an attempt to initiate a VPN connection with the secure server. If the host device is found to include one or more predetermined security features required for the security compliance check (such as, for example, a required antivirus software program and / or a required DLP software program), the security compliance check may be passed. Thus, in some examples, after successfully passing the security compliance check, the VPN client of the host device may connect to the VPN server to establish a VPN.

[0055] In step 304, after successfully passing the security compliance check and establishing the VPN tunnel with the secure server, the host device acts as a hotspot. For example, in some instances, the host device can be a smartphone or laptop configured to function as a mobile hotspot. In some examples, the host device can connect to the Internet using a cellular or Wi-Fi signal, and can advertise itself as a hotspot using a Wi-Fi signal, a Bluetooth signal, or other wireless signal that can allow other devices (e.g., client device 106) to connect to the host device.

[0056] In step 306, the host device processes network packets destined for or directed to the secure server by inspecting the headers of such network packets, which may include both data packets originating from the host device itself and data packets originating from auxiliary devices (e.g., client device 106) utilizing the hotspot operated by the host device. It should be understood by those of ordinary skill in the art that a secure socket layer VPN (SSL VPN) utilizes a routing table to determine whether a packet is destined for a virtual VPN adapter created to direct traffic to the VPN or an Ethernet interface (e.g., eth0), and based on the routing of each packet, the host device can distinguish network packets destined for the VPN from network packets directed elsewhere.

[0057] In step 308, the host device determines whether the network packet includes a security compliance check override flag in its header. For example, when a packet originating from the auxiliary device arrives at the host, the VPN client on the host can check whether the security compliance check override flag is present in the packet header. In other words, the host device can check the header of each outgoing network packet and look for a specific security compliance check override flag, which can be a specific alphanumeric string located in a specified field. According to some examples, the security compliance check software on the auxiliary device can include a mechanism for generating a unique flag / authentication flag, which can be generated by communicating with a VPN server. The host device can communicate with the same VPN server to obtain information for verifying the flag / header when receiving packets from the auxiliary device. If the host device determines that a particular network packet has a specific security compliance check override flag in its header, this will cause the host device to override the TTL check described below and forward the network packet to the security server / allow the network packet to be transmitted into the established VPN tunnel at step 312. After transmitting the network packet to the security server at step 312, the host device will continue to receive and process the network packets as described above with respect to step 306. However, if the host device determines that a particular network packet does not include a particular security compliance check override flag in its header, the process will continue to step 310.

[0058] In step 310, the host device determines whether the TTL value of the network packet is less than a default value. For example, if the default value is sixty-four ("64"), the host device will analyze the TTL values ​​in the header of each network packet to determine whether they are less than "64". If it is determined that the TTL value of the network packet is not less than 64, the no branch is taken to enter step 312. At step 312, the host device can transmit the network packet to the security server via the established VPN tunnel. However, if the host device determines in step 310 that the TTL value of one or more of the network packets is less than 64, the yes branch is taken to enter step 314. In step 314, the host device will perform a security action on one or more network packets, such as dropping the packet at step 314. It should be understood by those of ordinary skill in the art that if the host device drops the network packet, the network packet will not be sent to the security server and will simply stop traversing the network. Additionally, at step 314, based on the TTL value of the identified network packet being less than a default value (which causes the host device to discard the identified network packet), the host device can determine that the secondary device associated with the identified network packet is attempting to send traffic to a secure server via the VPN tunnel. In some examples, the host device can provide a notification to a user of the host device to inform the user of the activity of the secondary device (e.g., by presenting a notification in a graphical user interface of the host device).

[0059] In step 316, a determination may be made whether to provide the secondary device with access to the secure server via the hotspot operated by the host device and the VPN tunnel established. This determination may be made in response to the host device determining that the secondary device has attempted to send network packets through the VPN tunnel and has discarded its network packets, as described above for step 314. According to some examples, the host device may include software that provides a user interface that allows a user to indicate that they want to provide the secondary device with access to the VPN tunnel to the secure device. In some examples, this determination may be made automatically by the host device, for example, based on a determination that the secondary device is owned / associated with an owner / user of the host device (e.g., based on information provided by the secondary device to the host device) or a determination that the secondary device includes or has provided authentication credentials sufficient to provide login to the VPN tunnel (e.g., a username and password for accessing a corporate server). In such cases, the yes branch is taken to step 318, where security compliance checking software may be provided to the secondary device. However, if returning to step 316, it is not determined that the secondary device is provided with access to the secure server via the hotspot operated by the host device and the VPN tunnel established, the no branch is taken to return to step 306 described above, where the host device will continue to analyze the headers of the network packets sent to the secure server.

[0060] In step 318, the host device may facilitate providing the lightweight security compliance checking software to the secondary device by, for example, providing a software download link to the secondary device. The secondary device may download and execute the security compliance checking software, and upon passing the security compliance check, the security compliance checking software may also be configured to modify or append headers of outgoing network packets to include a security compliance check override flag. Thus, network packets originating from the secondary device and transmitted to the hotspot hosted by the host device will now include the security compliance override flag, and the method will continue at step 306, where the host device will continue to receive and analyze headers of network packets as previously described.

[0061] refer to Figure 4, a flow chart of an example method 400 for protecting resources accessible to a device via an authorized host device acting as a hotspot is shown. In step 402, in this example, a host device (e.g., network traffic management device 102) establishes a connection with a protected resource (e.g., server device 104) via a VPN tunnel based on a successful compliance check. For example, the host device may include a security compliance checking software program (e.g., compliance checking module 210) that, when executed, may perform an analysis on the host device to determine whether the host device includes required security features, such as, for example, specific antivirus software and / or DLP software. In some examples, the security compliance check may be performed in response to an attempt to initiate a VPN tunnel with a protected resource. In other examples, the security compliance check may be performed intermittently (e.g., once a day), and the results of the security compliance check may be stored by the host device and accessed by the VPN software after an attempt to initiate a VPN connection with a protected resource.

[0062] In step 404, after successfully passing the security compliance check, the host device (e.g., network traffic management device 102) acts as a hotspot when establishing a connection with a protected resource. For example, a user of the host device can access a hotspot function included in the host device and can manually activate it to allow other devices to access the Internet using the hotspot. In some examples, the hotspot may be secure, meaning that it may be password protected so that only authorized users can access the hotspot.

[0063] In step 406, the host device (e.g., the network traffic management device 102) intercepts or otherwise receives one or more data packets from the auxiliary device (e.g., the client device 106) connected to the hotspot. In other words, when the auxiliary device begins to attempt to transmit network packets to the Internet using the hotspot, the host device will receive these network packets from the auxiliary device and be configured to analyze them before forwarding them to their destination. For example, the host device can analyze the headers of the network packets to identify whether they include a security compliance check flag, and can also analyze them to determine whether the TTL value of the data packet is less than a default value.

[0064] In step 408, in response to the host device determining that one or more data packets have a TTL value less than a default value, the host device may perform a security action. According to some examples, the default value is "64", however it should be understood that this is merely an example and the default value may be set to any appropriate number corresponding to the initial TTL value of the network packet when the network packet was created. Therefore, in the case where the default value is "64", the host device may analyze one or more data packets to determine whether the TTL value of the packet is less than 64, and if so, the host device may perform a security action on such packets.

[0065] In some examples, the security action may include dropping one or more data packets to prevent one or more data packets from entering the VPN tunnel. In some examples, the security action may include disconnecting from the VPN tunnel. For example, the host device may disconnect the VPN tunnel until the hotspot is closed to prevent packets from auxiliary devices that have not been shown to pass the security compliance check from being able to access protected resources via the VPN tunnel. Therefore, in some examples, the VPN software stored on the host device may be configured to perform a check to determine that the host device is no longer acting as a hotspot before allowing the VPN tunnel to be reestablished. In some examples, the security action may include providing a notification to the user of the host device that the auxiliary device is attempting to send a network packet through the VPN tunnel.

[0066] According to some examples, method 400 may also include providing the secondary device with access to a compliance check software download (e.g., providing a software download link to the secondary device via a host device). The compliance check software is configured such that when the secondary device downloads and executes the compliance check software and passes the security compliance check, the compliance check software may be configured to modify / supplement a header of an outgoing network packet of the secondary device to include a compliance check flag indicating that the device has passed the security compliance check. Therefore, in some examples, method 400 may also include the host device analyzing a header of each of one or more data packets to determine whether the header includes a compliance check flag, and for each of the one or more data packets, in response to determining that the header includes a compliance check flag, overriding a check on a TTL value of the data packet and allowing the data packet to continue to enter the VPN tunnel, as described above in Figure 3 As described in step 308.

[0067] As previously described, the compliance check software download may be configured to be downloaded by the auxiliary device and, upon execution by the auxiliary device, may be configured to determine whether the auxiliary device has passed the compliance check. Determining whether the auxiliary device has passed the compliance check may include determining whether the auxiliary device includes features specified by a predetermined security configuration. For example, the compliance check may include determining whether the auxiliary device includes specified security features, including at least one of an antivirus software program and a data loss prevention (DLP) program, and the compliance check software may be further configured to append a header of an outgoing data packet to include a compliance check flag in response to determining that the auxiliary device has indeed passed the compliance check.

[0068] Using the present technology, it is possible to protect resources from an auxiliary device that is utilizing a hotspot operated by a host device that has established a VPN tunnel with a security server, which contains these resources. By determining that network traffic originating from an auxiliary device has a TTL value less than a default value, the system can advantageously enable all host devices to detect such network traffic. In response to detecting that such traffic originates from an auxiliary device, the host device can then advantageously perform a security action (e.g., discarding a packet or disconnecting a VPN tunnel) on the network traffic originating from the auxiliary device to shield the protected resources / security server from interacting with the auxiliary device. In this way, the disclosed technology can advantageously shield a security server containing protected resources from interacting with an auxiliary device that has not passed a security compliance check, thereby protecting the security server from potential malware or malicious actions that may originate from the auxiliary device. In addition, examples of the disclosed technology can also facilitate appropriate security compliance checks on auxiliary devices, so that access to the security server using the auxiliary device can be allowed as needed. Therefore, the disclosed technology provides higher security for protected resources accessed via VPN tunnels, while still providing flexibility in the number and nature of devices that can access the security server via VPN tunnels.

[0069] Having thus described the basic concepts of the present invention, it will be quite apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented only by way of example and is not restrictive. Although not expressly stated herein, various changes, improvements and modifications will occur and are intended to be used by those skilled in the art. These changes, improvements and modifications are intended to be proposed accordingly and are within the spirit and scope of the present invention. In addition, except as may be specified in the claims, the order of the listed processing elements or sequences, or the use of numbers, letters or other names is therefore not intended to limit the claimed process to any order. Therefore, the present invention is limited only by the following claims and their equivalents.

Claims

1. A method implemented by a network traffic management system, the network traffic management system comprising one or more host devices, server devices, network traffic management devices or client devices, the method comprising: Based on a successful compliance check, establishing a connection to a protected resource via a virtual private network (VPN) tunnel; acting as a hotspot when establishing said connection to said protected resource; intercepting one or more data packets from a secondary device connected to the hotspot; as well as In response to determining that the one or more data packets have a time to live (TTL) value that is less than a default value, a security action is performed.

2. The method of claim 1, wherein the default value is sixty-four.

3. The method of claim 1, wherein the security action comprises: discarding the one or more data packets to prevent the one or more data packets from entering the VPN tunnel; or Disconnect from the VPN tunnel.

4. The method of claim 1, further comprising: providing the auxiliary device with access to compliance checking software downloads; analyzing a header of each of the one or more data packets to determine whether the header includes a compliance check flag; as well as For each of the one or more data packets, in response to determining that the header includes the compliance check flag, overriding the check of the TTL value of the data packet and allowing the data packet to continue into the VPN tunnel.

5. The method of claim 4, wherein providing the secondary device with access to the compliance checking software download further comprises providing compliance checking software to be downloaded by the secondary device and configured to: determining whether the secondary device passes a compliance check, wherein the compliance check includes determining whether the secondary device includes specified security features, the specified security features including at least one of an antivirus software program and a data loss prevention program; and In response to determining that the secondary device does pass the compliance check, a header of an outgoing data packet is appended to include the compliance check flag.

6. A network traffic management device, comprising: Memory, The memory includes programming instructions stored thereon; and one or more processors configured to execute stored programming instructions to: Based on a successful compliance check, establishing a connection to a protected resource via a virtual private network (VPN) tunnel; acting as a hotspot when establishing said connection to said protected resource; intercepting one or more data packets from a secondary device connected to the hotspot; In response to determining that the one or more data packets have a time to live (TTL) value that is less than a default value, a security action is performed.

7. The apparatus of claim 6, wherein the default value is sixty-four.

8. The apparatus of claim 6, wherein the security action comprises one of the following: discarding the one or more data packets to prevent the one or more data packets from entering the VPN tunnel; or Disconnect from the VPN tunnel.

9. The apparatus of claim 6, wherein the programming instructions are further configured to cause the network traffic management device to: providing the auxiliary device with access to compliance checking software downloads; analyzing a header of each of the one or more data packets to determine whether the header includes a compliance check flag; and For each of the one or more data packets, in response to determining that the header includes the compliance check flag, overriding the check of the TTL value of the data packet and allowing the data packet to continue into the VPN tunnel.

10. The apparatus of claim 9, wherein providing the secondary device with access to the compliance checking software download further comprises providing compliance checking software to be downloaded by the secondary device and configured to: determining whether the secondary device passes a compliance check, wherein the compliance check includes determining whether the secondary device includes specified security features, the specified security features including at least one of an antivirus software program and a data loss prevention program; and In response to determining that the secondary device does pass the compliance check, a header of an outgoing data packet is appended to include the compliance check flag.

11. A non-transitory computer readable medium having stored thereon instructions, the instructions comprising executable code that, when executed by one or more processors, causes the one or more processors to: Based on a successful compliance check, establishing a connection to a protected resource via a virtual private network (VPN) tunnel; acting as a hotspot when establishing said connection to said protected resource; intercepting one or more data packets from a secondary device connected to the hotspot; In response to determining that the one or more data packets have a time to live (TTL) value that is less than a default value, a security action is performed.

12. The non-transitory computer readable medium of claim 11, wherein the default value is sixty-four.

13. The non-transitory computer-readable medium of claim 11, wherein the security action comprises one of: discarding the one or more data packets to prevent the one or more data packets from entering the VPN tunnel; or Disconnect from the VPN tunnel.

14. The non-transitory computer readable medium of claim 11, wherein the instructions are further configured to cause the one or more processors to: providing the auxiliary device with access to compliance checking software downloads; analyzing a header of each of the one or more data packets to determine whether the header includes a compliance check flag; and For each of the one or more data packets, in response to determining that the header includes the compliance check flag, overriding the check of the TTL value of the data packet and allowing the data packet to continue into the VPN tunnel.

15. The non-transitory computer readable medium of claim 14, wherein providing the secondary device with access to the compliance checking software download further comprises providing compliance checking software to be downloaded by the secondary device and configured to: determining whether the secondary device passes a compliance check, wherein the compliance check includes determining whether the secondary device includes specified security features, the specified security features including at least one of an antivirus software program and a data loss prevention program; and In response to determining that the secondary device does pass the compliance check, a header of an outgoing data packet is appended to include the compliance check flag.

16. A network traffic management system comprising one or more server devices, network traffic management devices, or client devices having: a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to: Based on a successful compliance check, establishing a connection to a protected resource via a virtual private network (VPN) tunnel; acting as a hotspot when establishing said connection to said protected resource; intercepting one or more data packets from a secondary device connected to the hotspot; In response to determining that the one or more data packets have a time to live (TTL) value that is less than a default value, a security action is performed.

17. The system of claim 16, wherein the default value is sixty-four.

18. The system of claim 16, wherein the security action comprises one of the following: discarding the one or more data packets to prevent the one or more data packets from entering the VPN tunnel; or Disconnect from the VPN tunnel.

19. The system of claim 16, wherein the programming instructions are further configured to cause the one or more processors to: providing the auxiliary device with access to compliance checking software downloads; analyzing a header of each of the one or more data packets to determine whether the header includes a compliance check flag; and For each of the one or more data packets, in response to determining that the header includes the compliance check flag, overriding the check of the TTL value of the data packet and allowing the data packet to continue into the VPN tunnel.

20. The system of claim 19, wherein providing the secondary device with access to the compliance checking software download further comprises providing compliance checking software to be downloaded by the secondary device and configured to: determining whether the secondary device passes a compliance check, wherein the compliance check includes determining whether the secondary device includes specified security features, the specified security features including at least one of an antivirus software program and a data loss prevention program; and In response to determining that the secondary device does pass the compliance check, a header of an outgoing data packet is appended to include the compliance check flag.

Images