A virtual private network client computer with traffic filter

Abstract

The present invention relates to a Virtual Private Network, VPN, client computer (1) configured to communicate with a VPN server (2) via a VPN connection over an untrusted network (4), the VPN client computer (1) being configured to be connected to the untrusted network (4) via an access network (5), the VPN client computer (1) comprising a VPN client software configured to route data packets for communication with the VPN server (2); a network stack (10) comprising one or more protocols for communication with the access network (5) and the untrusted network (4); wherein the network stack (10) further comprises a traffic filter (13) provided as a device driver in the network stack (10), the traffic filter (13) being configured to check, limit and / or rewrite all network packets (6a, 6b, 6c), on a Medium Access Control, MAC, level, being communicated to and from the VPN client computer (1).

Description

[0001] A VIRTUAL PRIVATE NETWORK CLIENT COMPUTER WITH TRAFFIC FILTER

[0002] Technical Field

[0003] The present disclosure relates to a virtual private network, VPN, client computer, and in particular to a VPN client computer comprising a traffic filter for network communication.

[0004] Background

[0005] A typical VPN client computer establishes a secure network connection to a corresponding VPN server. This connection is performed via an untrusted IP network. The VPN client computer needs to be able to send network packets over this network in order to reach the VPN server.

[0006] Outgoing network traffic is routed through the VPN client software, where it is encrypted and transmitted to the VPN server.

[0007] On a compromised or misbehaving VPN client computer, some network packets might bypass the VPN client software and be routed without encryption directly to the external network interface where they may be intercepted by an external attacker.

[0008] There are also some network protocols, most notably ARP and DHCP, that always need to send data unencrypted to peers on the access network for connection establishment with the access network. This traffic needs to bypass the VPN routing in order to be useful. An attacker might use this bypass possibility to piggyback sensitive data onto the presumed safe packets.

[0009] In many access networks (e.g. home) the presence of loT devices of questionable origin is ubiquitous. These devices are most likely not blocked from communicating with the entire world. Piggybacking unencrypted link traffic between such a device and the client computer would effectively create an unwanted proxy into the network behind the VPN server.

[0010] In present implementations of VPN client software, firewall functionality and routing rules are used to control the flow of packets. The access network is in many cases open for unencrypted traffic, which may lead to data leakage when connectedto a malicious Wi-Fi hotspot or even a trusted network that may contain untrusted devices.

[0011] Some variants include an external piece of hardware which serves as a gateway to the network, containing filtering functions.

[0012] For avoiding leakage through wireless devices, a common solution is to physically remove the wireless components, which is only possible when they are implemented as discrete parts

[0013] Hence, there is a need for improved traffic filtering for network communication of a VPN client computer.

[0014] It is an object of the present invention to provide an improved solution that alleviates the mentioned drawbacks with present devices. Furthermore, it is an object to provide a VPN client computer providing a higher control of network traffic communicated to and from the VPN client computer and increase the level of assurance that can be achieved for software solutions.

[0015] The invention is defined by the appended independent claims, with embodiments being set forth in the appended dependent claims, in the following description and in the drawings.

[0016] According to a first aspect of the invention, there is provided a Virtual Private Network, VPN, client computer configured to communicate with a VPN server via a VPN connection over an untrusted network. The VPN client computer is configured to be connected to the untrusted network via an access network. The VPN client computer comprises a VPN client software configured to route data packets for communication with the VPN server. The VPN client computer comprises a network stack comprising one or more protocols for communication with the access network and the untrusted network. The network stack comprises a traffic filter provided as a device driver in the network stack, the traffic filter being configured to check, limit and / or rewrite all network packets, on a Medium Access Control, MAC, level, being communicated to and from the VPN client computer.The traffic filter may allow for a higher control of network traffic flowing from and to the VPN client computer compared to other known solutions.

[0017] Furthermore, as the traffic filter is provided as a device driver, there may be no need for any external hardware for filtering. As such, cost may be reduced, and usability may be simplified. Without any external hardware being necessary for implementing the solution, risk factors, such as circumvention by connecting a cable or new physical network interface directly to the client computer, may be removed.

[0018] By providing the traffic filter as a device driver any erroneous routing rules, firewall configurations or similar issues may not matter for the data security, as all outgoing packets may be verified to be compliant before being pushed onto the network interface hardware.

[0019] The traffic filter may be provided at, adjacent, near, on top of, or directly on top of the network interface or the edge of the network interface. The traffic filter may be provided at, adjacent, near, on top of, or directly on top of the hardware of the VPN client computer. The traffic filter may be provided at, adjacent, near, on top of, or directly on top of a network driver, such as a Miniport Adapter.

[0020] The traffic filter may be provided such that the traffic filter has priority above functions that can be used to circumvent the traffic filter. The traffic filter may be provided such that each network packet being communicated to the VPN client computer is filtered by the traffic filter before the network packet is used and / or received by any other function and / or program of the VPN client computer. The traffic filter may be provided such that no function and / or program of the VPN client computer can edit a network packet being communicated from the VPN client computer after the network packet has been filtered by the traffic filter.

[0021] The traffic filter may be provided in the data-link layer or the network layer. The traffic filter may be provided as a device driver in the lowest layer possible in the network stack. By the traffic filter being provided as a device driver in the lowest layer possible in the network stack it may be meant that the traffic filter is provided at or near the edge of the network interface. The traffic filter may be provided as close to the hardware of the VPN client computer as possible for asoftware filter. The traffic filter may be provided as far down in the network stack as possible such that the traffic filter has priority above functions that can be used to circumvent the traffic filter. The traffic filter may be provided as closely as possible on top of a network driver, such as a Miniport Adapter. The lowest layer possible may be, for example, the data-link layer. The lowest layer possible may be the layer directly above the physical layer.

[0022] The traffic filter may ensure that all network traffic communicated to and from the VPN client computer pass through the traffic filter and are inspected by the traffic filter.

[0023] By "computer" it may be meant any device comprising a processor and a memory, and capable of being programmed and executing the program, such as desktop computers, laptop computers, mobile devices etc.

[0024] The access network may be, for example, a local area network or a wide area network. The local area network may be, for example, a guest network. The wide area network may be, for example, a mobile network. The access network may be a wired network or a wireless network. The access network may be a trusted network or part of the untrusted network.

[0025] The untrusted network may be, for example, a public network, such as the internet.

[0026] The traffic filter may be configured to check and / or limit that outgoing network packets has the VPN server IP address as recipient, the VPN client software as sender and / or one or more port numbers that are associated with the VPN connection. The traffic filter may be configured to check and / or limit reception of incoming network packets to network packets having the VPN server as the source, the VPN client software as recipient and / or one or more port numbers that are associated with the VPN connection.

[0027] The one or more port numbers associated with the VPN connection may include a port number of the VPN client computer used for incoming communication to the VPN client software and / or a port number of the VPN client computer used for outgoing communication from the VPN client software.Checking and / or limiting the recipient and sender of outgoing network packets may ensure that no packets are sent outside the VPN client computer except for packets that originates from the VPN client software. This may prevent network packets, on a compromised or misbehaving client computer, to bypass the VPN client software and be routed without encryption directly to the external network interface. Thus, interception by an external attacker may be prevented.

[0028] Checking and / or limiting reception of incoming packets may prevent other devices on the access network, for example loT devices, from communicating with the network behind the VPN server through the VPN client computer. Preventing this may be especially important in the cases where other devices on the access network is of questionable origin. Further, checking and / or limiting reception of incoming network packets may prevent incoming network packets from using open ports and other vulnerabilities of the VPN client computer.

[0029] Checking and / or limiting that outgoing network packets has one or more port numbers associated with the VPN connection may ensure that all network communication to the VPN server goes through the VPN client software / VPN tunnel. However, ensuring that all network communication from the VPN client computer to the VPN server goes through the VPN client software / VPN tunnel is not limited to checking and / or limiting network packets based on one or more port numbers, this could be done in other ways.

[0030] The traffic filter may be configured to limit outgoing and / or incoming network packets to known network packets necessary for connection establishment with the access network.

[0031] Some network protocols, such as ARP and DHCP, may need to bypass the VPN routing in order to enable connection establishment with the access network. By limiting incoming and outgoing network packets to and from the access network to known network packets necessary for connection establishment with the access network, data leakage may be further prevented if the VPN client computer is, for example, connected to a malicious Wi-Fi hotspot or a trusted network that may contain untrusted devices.The traffic filter may be configured to rewrite outgoing and / or incoming network packets of one or more predefined packet types to the access network such that unexpected data or data not needed for the purpose of the packet type is removed from the outgoing and / or incoming network packets.

[0032] Rewriting outgoing and / or incoming network packets may prevent an attacker from piggybacking sensitive data onto presumed safe packets.

[0033] By "rewrite" it may be meant to change and / or remove data in the network packets.

[0034] The predefined packet types may comprise ARP, one or more packet types of protocol IPv4, such as DHCP, ICMP, NTP, and DNS, one or more packet types of protocol IPv6, such as ICMPv6, and DHCPv6, and / or one or more packet types of IEEE802.il, such as Wi-Fi Management and Control Frames. The predefined packet types may comprise ARP, DHCP, ICMP, NTP, DNS, IPv4, ICMPv6, DHCPv6, IPv6, and / or Wi-Fi Management and Control Frames.

[0035] The rewriting of outgoing and / or incoming network packets may comprise removal of data in the network packets.

[0036] Unexpected data and any data that might not be used in practice may be removed from the outgoing network packets. Data leakage may thereby be further prevented.

[0037] By "removal of data" it may be meant resizing the network package such that data is removed from the network packet and / or setting the data / bits to be removed to, for example, 0.

[0038] The outgoing networks packets may be rewritten to remove data in the network packets not necessary for the purpose of establishing or maintaining the connection with the access network.

[0039] Removing data not necessary for establishing and maintaining connection with the access network may further prevent data leakage. For example, a number of DHCP options are not strictly necessary to establish connection with the access network, these options may be removed from the network packets. Removing theunnecessary data may prevent an attacker from piggybacking sensitive data onto the data that are not necessary to establish connection with the access network.

[0040] Rewriting, for example, DHCP network packets may prevent manipulation by using DHCP-options for attacks such as routing manipulation attacks or more specifically, for example, TunnelVision attacks.

[0041] The traffic filter may comprise a communication channel with the VPN client software.

[0042] The traffic filter may receive the IP address of the VPN server and / or one or more port numbers that are associated with the VPN connection from the VPN client software such that the traffic filter knows which IP address and / or port numbers that are allowable when checking and limiting incoming and outgoing traffic. The traffic filter may receive other means of identifying packets from the VPN client software. Furthermore, if an error of the VPN client software occurs, the traffic filter may receive an error message from the client software and prevent any outgoing or incoming traffic to and from the VPN client computer.

[0043] The traffic filter may be configured as a mandatory part of the network stack for all physical network interfaces of the VPN client computer.

[0044] By "the traffic filter being configured as a mandatory part of the network stack" it may be meant that the traffic filter has to be present and active when any network communication occurs to and from the VPN client computer. No network communication to and from the VPN client computer may be allowed if no traffic filter is provided. The traffic filter being a mandatory part of the network stack may ensure that all network traffic sent and received by the VPN client computer goes through the traffic filter.

[0045] The VPN client computer may be configured to prohibit an operating system, OS, of the VPN client computer from booting before the traffic filter is provided.

[0046] The OS may be configured to be prohibited from booting if the traffic filter is missing.

[0047] Starting the traffic filter before booting the OS may ensure that the traffic filter starts filtering before any network traffic is sent and received by the VPN clientcomputer, and thereby ensuring that all network traffic goes through the traffic filter.

[0048] The traffic filter and / or the VPN client software may be configured to monitor the function of the traffic filter.

[0049] Monitoring the function of the traffic filter may ensure that the traffic filter is functioning as intended and thereby ensuring that all network packets being communicated to and from the VPN client computer are inspected properly by the traffic filter.

[0050] The monitoring may comprise monitoring the traffic filter's position in the network stack, the traffic filter's presence in the network stack, and / or the number of packets being sent and / or received by the VPN client computer.

[0051] Monitoring that the traffic filter is present, functioning properly, and positioned correctly may ensure that all network packets being communicated to and from the VPN client computer are properly inspected.

[0052] The VPN client computer may be configured to block all network traffic based on the monitoring.

[0053] Blocking all network traffic based on the monitoring may prevent network traffic from reaching and leaving the VPN client computer without going through the traffic filter in the case when the traffic filter is malfunctioning or missing. This may ensure that all network communication goes through the traffic filter.

[0054] The traffic filter may have to be provided and functioning as intended for the VPN client computer to be allowed to receive and send any network packets.

[0055] The MAC level may be a layer 2 level / data-link level of the network stack. According to a second aspect of the invention, there is provided a computer implemented method for filtering network packets communicated to and from a VPN client computer. The method comprises providing a traffic filter as a device driver in the network stack of the VPN client computer, checking, limiting and / or rewriting, by the traffic filter, all network packets being sent and received to and from the VPN client computer, on a Medium Access Control, MAC, level, connecting to an untrusted network via an access network, and communicating with a VPNserver via a VPN connection over the untrusted network. The computer-implemented method may further comprise steps and / or features as presented above in relation to the embodiments of the VPN client computer.

[0056] Brief

[0057]

[0058] of the

[0059]

[0060] The invention will in the following be described in more detail with reference to the enclosed drawings, wherein:

[0061] Fig. 1 shows a VPN client computer communicating with a VPN server.

[0062] Fig. 2 shows a network stack.

[0063] Figs. 3a-3b show filtering of network packets by a traffic filter.

[0064] Fig. 4 shows a method for filtering network packets communicated to and from a VPN client computer.

[0065] Description of Embodiments

[0066] The present invention will be described more fully hereinafter with reference to the accompanying drawings, in which preferred embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In the drawings, like numbers refer to like elements.

[0067] Fig. 1 illustrate a VPN client computer 1 communicating with a VPN server 2 via a VPN connection over an untrusted network 4. The VPN client computer 1 is configured to be connected to the untrusted network 4 via an access network 5. The VPN client computer 1 comprises a VPN client software configured to route data packets for communication with the VPN server 2. The VPN client software may be configured to encrypt the data packets. The VPN client software may be configured to transmit the data packets to the VPN server 2. The VPN client software may be configured encrypt outgoing data packets before transmitting the data packets to the VPN server 2.The VPN server 2 may be, for example, a remote access VPN server or a cloud VPN server.

[0068] The VPN client computer 1 may be configured to be connected to the access network 5 through wireless and / or wired connection. The wireless connection may be, for example, Wi-Fi. The wired connection may be, for example, an ethernet cable. One or more interfaces, such as Wi-Fi, LTE, 5G and / or Bluetooth, may be disabled on the VPN client computer 1.

[0069] Other devices 3a, 3b, 3c are illustrated in fig. 1 as being connected to the access network 5. The other devices 3a, 3b, 3c may be, for example, computers, printers, mobile phones, and loT devices.

[0070] The VPN client computer 1 may comprise a processor. The processor may execute the VPN client software. The VPN client computer 1 may comprise a memory. The memory may store the VPN client software. The VPN client computer 1 may comprise an operating system, OS. The OS may be, for example, Microsoft Windows, Mac OS, or Linux.

[0071] The VPN client computer 1 may be configured to receive and send network packets to and from a router connected to the access network 5 for connection establishment with the access network 5. The network packets sent and received between the VPN client computer 1 and the router for connection establishment with the access network 5 may be unencrypted.

[0072] The VPN client computer 1 comprises a network stack. A network stack 10 is illustrated in fig. 2. The network stack 10 may be described with the OSI model. The network stack 10 of the VPN client computer 1 comprises one or more protocols for communication with the access network 5 and the untrusted network 4.

[0073] The network stack 10 further comprises a traffic filter. The traffic filter is provided as a device driver in the network stack 10. For example, if the OS of the VPN client computer is Microsoft Windows, the traffic filter may be provided near the Miniport Adapter drivers.The traffic filter may be a software program. The traffic filter may be stored in the memory of the VPN client computer 1. The traffic filter may be executed by the processor of the VPN client computer 1.

[0074] The traffic filter is configured to check, limit and / or rewrite all network packets, on a MAC level, being communicated to and from the VPN client computer 1.

[0075] The MAC level may be a layer 2 / data-link level 100 of the network stack 10. Figs. 3a-3b illustrates filtering of network packets 6a, 6b, 6c by the traffic filter 13.

[0076] The traffic filter 13 may be configured to check and / or limit reception of incoming network packets 6a, 6b, 6c to network packets 6a, 6b, 6c having the VPN server 2 as the source and the VPN client software as recipient.

[0077] Incoming network packets 6a, 6b being limited by the traffic filter 13 is shown in fig. 3a. Allowed incoming network packets 6a may correspond to network packets 6a having the VPN server 2 as the source and the VPN client software as recipient. Incoming network packets 6b not allowed may correspond to network packets 6b not having the VPN server 2 as the source and the VPN client software as recipient.

[0078] The traffic filter 13 may be configured to check and / or limit that outgoing network packets 6a, 6b, 6c has the VPN server 2 IP address as recipient and the VPN client software as sender.

[0079] The traffic filter 13 may be configured to check and / or limit that incoming and / or outgoing network packets 6a, 6b, 6c has one or more port numbers that are associated with the VPN connection.

[0080] The traffic filter 13 may be configured to limit outgoing and / or incoming network packets to known network packets 6a, 6b, 6c. The known network packets 6a, 6b, 6c may be necessary for connection establishment with the access network 5. The known network packets 6a, 6b, 6c may be necessary for connection establishment with the access network 5 via Wi-Fi and / or ethernet. The knownnetwork packets 6a, 6b, 6c may be necessary for connection establishment with the VPN server 2.

[0081] The known network packets 6a, 6b, 6c may comprise for instance ARP, DHCP, ICMP, NTP, DNS, IPv4, ICMPv6, DHCPv6, IPv6 and / or Wi-Fi Management and Control Frames packets. The known network packets 6a, 6b, 6c necessary for connection establishment with the access network 5 may comprise ARP and / or DHCP packets.

[0082] The traffic filter 13 may be configured to check and / or limit reception of incoming network packets 6a, 6b, 6c to network packets 6a, 6b, 6c having the VPN server 2 as the source and the VPN client software as recipient and to known network packets 6a, 6b, 6c necessary for connection establishment with the access network 5.

[0083] The traffic filter 13 may be configured to check and / or limit outgoing network packets 6a, 6b, 6c to network packets 6a, 6b, 6c having the VPN server 2 IP address as recipient and the VPN client software as sender and to known network packets 6a, 6b, 6c necessary for connection establishment with the access network 5.

[0084] Checking / limiting outgoing and incoming network packets 6a, 6b, 6c in this way may ensure that only network traffic between the VPN client software and the VPN server and network traffic necessary for establishment with the access network is allowed, and thereby limiting the risk of information leakage and non-authorized actors gaining access to the VPN server.

[0085] The traffic filter 13 may be configured to rewrite outgoing and / or incoming network packets 6a, 6b, 6c of one or more predefined packet types to the access network such that unexpected data or data not needed for the purpose of the packet type is removed from the outgoing network packets 6a, 6b, 6c. The predefined packet types may comprise ARP, DHCP, ICMP, NTP, DNS, IPv4, ICMPv6, DHCPv6, IPv6 and / or Wi-Fi Management and Control Frames. Rewriting an outgoing network packet 6c, 6c' is shown in fig. 3b. Outgoing network packet 6c, 6c' of a predefined packet type is shown being rewritten by the traffic filter 13 before being transmitted to the access network 5.The rewriting of outgoing and / or incoming network packets 6c, 6c' may comprise removal of data in the network packets 6c, 6c'. The outgoing and / or incoming networks packets 6c, 6c' may be rewritten to remove data in the network packets 6c, 6c' not necessary for the purpose of establishing or maintaining the connection with the access network 5. In fig. 3b, data 60b, 60b' in the network packet 6c, 6c' not necessary for the purpose of establishing or maintaining the connection with the access network 5 is shown being rewritten by the traffic filter 13 while data 60a necessary for the purpose of establishing or maintaining the connection with the access network 5 is unchanged by the traffic filter 13.

[0086] The traffic filter 13 may comprise a communication channel with the VPN client software. The traffic filter 13 may be configured to receive the IP address of the VPN server 2 from the VPN client software. The traffic filter 13 may be configured to receive VPN client software network ports.

[0087] The traffic filter 13 may comprise application programming interfaces, APIs. The VPN client software may comprise APIs. The traffic filter 13 may be configured to communicate with the VPN client software via the APIs of the VPN client software and / or the APIs of the traffic filter 13. The VPN client software may be configured to communicate with the traffic filter 13 via the APIs of the VPN client software and / or the APIs of the traffic filter 13.

[0088] The traffic filter 13 may be configured as a mandatory part of the network stack 10 for all physical network interfaces of the VPN client computer 1. The provision of the traffic filter 13 in the network stack may be mandatory.

[0089] The VPN client computer 1 may be configured to provide the traffic filter 13 before, or at the same time as, booting the OS of the VPN client computer 1 when starting the VPN client computer 1. The VPN client computer 1 may be configured to prohibit the OS of the VPN client computer 1 from booting before the traffic filter 13 is provided.

[0090] The VPN client computer 1 may be configured to monitor the function of the traffic filter 13. The monitoring may comprise run-time monitoring of the function of the traffic filter 13. The VPN client software may be configured to monitor thefunction of the traffic filter 13. The traffic filter 13 may be configured to monitor the function of the traffic filter 13.

[0091] The traffic filter 13 may be configured to send an error message to the VPN client software. The VPN client software may be configured to receive an error message from the traffic filter 13. The traffic filter may be configured to send the error message via the APIs of the traffic filter and / or the APIs of the VPN client software. The VPN client software may be configured to receive the error message via the APIs of the traffic filter 13 and / or the APIs of the VPN client software.

[0092] Both the VPN client software and the traffic filter 13 may be configured to monitor the function of the traffic filter 13. The advantage of the monitoring being performed by the traffic filter 13 may be that the traffic filter 13 may start monitoring earlier compared to the VPN client software since the traffic filter 13 may be configured to start before booting the OS. The advantage of the monitoring being performed by the VPN client software compared to the traffic filter 13 is that the VPN client software may monitor the presence of the traffic filter 13. The monitoring being performed by both the traffic filter 13 and the VPN client software ensures both early monitoring and monitoring of the presence of the traffic filter 13. However, the monitoring may be performed by only the traffic filter 13 or only the VPN client software.

[0093] The monitoring of the traffic filter 13 is not limited to being performed by the VPN client software or the traffic filter 13, the monitoring could also, for example, be performed by another software program of the VPN client computer 1.

[0094] The monitoring may comprise monitoring the traffic filter's 13 position in the network stack 10, the traffic filter's 13 presence in the network stack 10, and / or the number of packets being sent and / or received by the VPN client computer 1.

[0095] Monitoring the traffic filter's 13 position in the network stack 10 may comprise monitoring if the traffic filter 13 is provided in the lowest layer possible in the network stack 10. Monitoring the traffic filter's 13 position in the network stack 10 may comprise monitoring if the traffic filter 13 is provided at, adjacent, near, on top of, or directly on top of the network interface, the edge of the networkinterface, the hardware, or the network driver of the VPN client computer 1.

[0096] Monitoring the traffic filter's 13 position in the network stack may be performed by the VPN client software and / or the traffic filter 13.

[0097] Monitoring the traffic filters 13 presence in the network stack 10 may be performed by the VPN client software.

[0098] Monitoring the number of packets being sent and / or received by the VPN client computer 1 may comprise counting the number of packets being sent and / or received by physical network interfaces of the VPN client computer 1. Monitoring the number of packets being sent and / or received by the VPN client computer 1 may comprise counting the number of packets being sent and / or received by the traffic filter 13. Monitoring the number of packets being sent and / or received by the VPN client computer 1 may comprise comparing the counted number of packets being sent and / or received by the physical network interfaces with the counted number of packets being sent and / or received by the traffic filter 13.

[0099] Monitoring the number of packets being sent and / or received by the VPN client computer 1 may be performed by the VPN client software and / or the traffic filter 13.

[0100] The traffic filter 13 may be configured to send monitoring information to the VPN client software. The monitoring information may comprise the number of packets being sent and / or received by the traffic filter 13 and / or the position of the traffic filter 13. The traffic filter 13 may be configured to send monitoring information to the VPN client software via the APIs of the traffic filter 13 and / or the APIs of the VPN client software.

[0101] The VPN client computer 1 may be configured to block all network traffic based on the monitoring. The VPN client computer 1 may be configured to restart and / or display an error message on a display connected to the VPN client computer 1 based on the monitoring. The VPN client computer 1 may be configured to send a notification to a user equipment of a user and / or an administrator based on the monitoring.The traffic filter 13 may be configured to monitor the function of the VPN client software. The VPN client software may be configured to send monitoring information to the traffic filter 13. The monitoring information sent to the traffic filter 13 may comprise an error message. The monitoring information sent to the traffic filter 13 may be sent via the APIs of the traffic filter 13 or the APIs of the VPN client software.

[0102] The VPN client computer 1 may be configured to block all network traffic based on the monitoring of the VPN client software. The traffic filter 13 may be configured to block all network traffic based on the monitoring of the VPN client software.

[0103] The traffic filter 13 may be configured to block all network traffic if the VPN client computer 1 is not connected to any VPN server 2. The traffic filter 13 blocking all network traffic may comprise blocking traffic on any interface. The traffic filter 13 blocking all network traffic may comprise blocking traffic on any physical Ethernet port.

[0104] Fig. 4 illustrates a computer implemented method for filtering network packets communicated to and from a VPN client computer. The method may comprise starting up a VPN client computer SI. The method comprises providing a traffic filter as a device driver in the network stack of the VPN client computer S2. The method comprises checking, limiting and / or rewriting, by the traffic filter, all network packets being sent and received to and from the VPN client computer, on a Medium Access Control, MAC, level S3.

[0105] The method may comprise monitoring the traffic filter, the monitoring being performed by the traffic filter S4. The method may comprise booting up the OS of the VPN client computer S5. Providing the traffic filter may be performed before, or at the same time as, booting the OS of the VPN client computer. The OS may not boot if the traffic filter is missing. The method comprises connecting to an untrusted network via an access network S6. The method may comprise monitoring the traffic filter, performed by a VPN client software S7. The method comprises communicating with a VPN server via a VPN connection over the untrusted network S8.In the drawings and specification, there have been disclosed preferred embodiments and examples of the invention and, although specific terms are employed, they are used in a generic and descriptive sense only and not for the purpose of limitation, the scope of the invention being set forth in the following claims.

Claims

CLAIMS1. A Virtual Private Network, VPN, client computer (1) configured to communicate with a VPN server (2) via a VPN connection over an untrusted network (4), the VPN client computer (1) being configured to be connected to the untrusted network (4) via an access network (5), the VPN client computer (1) comprising: a VPN client software configured to route data packets for communication with the VPN server (2); anda network stack (10) comprising one or more protocols for communication with the access network (5) and the untrusted network (4);wherein the network stack (10) further comprises a traffic filter (13) provided as a device driver in the network stack (10), the traffic filter (13) being configured to check, limit and / or rewrite all network packets (6a, 6b, 6c), on a Medium Access Control, MAC, level, being communicated to and from the VPN client computer (1).

2. The VPN client computer (1) according to claim 1, wherein the traffic filter (13) is configured to:check and / or limit that outgoing network packets (6a, 6b, 6c) has the VPN server (2) IP address as recipient, the VPN client software as sender and / or one or more port numbers that are associated with the VPN connection; and / or check and / or limit reception of incoming network packets (6a, 6b, 6c) to network packets (6a, 6b, 6c) having the VPN server (2) as the source, the VPN client software as recipient and / or one or more port numbers that are associated with the VPN connection.

3. The VPN client computer (1) according to claim 1 or 2, wherein the traffic filter (13) is configured to limit outgoing and / or incoming network packets (6a, 6b, 6c) to known network packets (6a, 6b, 6c) necessary for connection establishment with the access network (5).

4. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is configured to rewrite outgoing and / or incoming network packets (6a, 6b, 6c) of one or more predefined packet types to the access network (5) such that unexpected data (60b) or data (60b) not needed for thepurpose of the packet type is removed from the outgoing and / or incoming network packets (6a, 6b, 6c).

5. The VPN client computer (1) according to claim 4, wherein the predefined packet types comprise ARP, one or more packet types of protocol IPv4, such as DHCP, ICMP, NTP, and DNS, one or more packet types of protocol IPv6, such as ICMPv6, and DHCPv6, and / or one or more packet types of IEEE802.il, such as Wi-Fi Management and Control Frames.

6. The VPN client computer (1) according to claim 4 or 5, wherein the rewriting of outgoing and / or incoming network packets (6a, 6b, 6c) comprises removal of data (60b) in the network packets (6a, 6b, 6c).

7. The VPN client computer (1) according to any one of claims 4-6, wherein the outgoing networks packets (6a, 6b, 6c) are rewritten to remove data (60b) in the network packets (6a, 6b, 6c) not necessary for the purpose of establishing or maintaining the connection with the access network (5).

8. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) comprises a communication channel with the VPN client software.

9. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is configured as a mandatory part of the network stack (10) for all physical network interfaces of the VPN client computer (1).

10. The VPN client computer (1) according to any of the preceding claims, wherein the VPN client computer (1) is configured to prohibit an operating system, OS, of the VPN client computer (1) from booting before the traffic filter (13) is provided.

11. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) and / or the VPN client software is configured to monitor the function of the traffic filter (13).

12. The VPN client computer (1) according to claim 11, wherein monitoring comprises monitoring the traffic filter's (13) position in the network stack (10), the traffic filter's (13) presence in the network stack (10), and / or the number of packets (6a, 6b, 6c) being sent and / or received by the VPN client computer (1).

13. The VPN client computer (1) according to claim 11 or 12, wherein the VPN client computer (1) is configured to block all network traffic based on the monitoring.

14. The VPN client computer (1) according to any one of the preceding claims, wherein the MAC level is a layer 2 level / data-link level (100) of the network stack (10).

15. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided as a device driver in the lowest layer possible in the network stack (10).

16. The VPN client computer (1) according to claim 15, wherein the lowest layer possible is the layer directly above the physical layer.

17. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided as far down in the network stack (10) as possible such that the traffic filter (13) has priority above functions that can be used to circumvent the traffic filter (13).

18. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided as close to the hardware of the VPN client computer (1) as possible for a software filter.2119. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided as closely as possible on top of a network driver, such as a Miniport Adapter.

20. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided at, adjacent, near, on top of, or directly on top of the network interface or the edge of the network interface.

21. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided at, adjacent, near, on top of, or directly on top of the hardware of the VPN client computer (1).

22. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided at, adjacent, near, on top of, or directly on top of a network driver, such as a Miniport Adapter.

23. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided such that the traffic filter has priority above functions that can be used to circumvent the traffic filter.

24. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided such that each network packet being communicated to the VPN client computer (1) is filtered by the traffic filter (13) before the network packet is used and / or received by any other function and / or program of the VPN client computer (1).

25. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided such that no function and / or program of the VPN client computer (1) can edit a network packet being communicated from the VPN client computer (1) after the network packet has been filtered by the traffic filter (13).2226. The VPN client computer (1) according to any one of the preceding claims, wherein the traffic filter (13) is provided in the data-link layer or the network layer.

27. A computer implemented method for filtering network packets communicated to and from a VPN client computer, the method comprises:providing a traffic filter as a device driver in the network stack of the VPN client computer (S2),checking, limiting and / or rewriting, by the traffic filter, all network packets being sent and received to and from the VPN client computer, on a Medium Access Control, MAC, level (S3),connecting to an untrusted network via an access network (S6), and communicating with a VPN server via a VPN connection over the untrusted network (S8).

Images