# US 2021/0243083 A1 · Applying network policies to devices based on their current access network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243083 A1 - Document ID: US20210243083A1 - Status: Published application - Kind: A1 - Application number: 17/021,649 - Filed: 2020-09-15 - Published: 2021-08-05 - Earliest claimed: 2016-05-12 - Assignees: iboss, Inc. - Applicants: iboss, Inc. - Inventors: Paul Michael Martini; Peter Anthony Martini - Web page: https://patentgrep.com/patent/US20210243083A1 ## CPC - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L 41/0894: Policy-based network configuration management - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/52: specially adapted for the location of the user terminal - H04L 61/2514: between local and global IP addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems are described for managing device access to a particular network from various access networks. One example method includes receiving, by a server of a distributed computing system that is at least partially hosted on a particular access network, a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address. For each of the plurality of devices, a current access network is determined for the device. For each of the devices with a current access network being the particular access network, a first network policy is applied to the device. For each of the devices with a current access network being other than the particular access network, a second network policy is applied to the device, the second network policy defining a second encryption requirement. ## Claims ### Claim 1 A computer-implemented method executed by one or more processors for applying network policies to devices based on their current access network, the method comprising: receiving, by a server connected to a particular network, a message from a device separate from the server over the particular network, the message associated with a source address; determining, by the server, a current access network for the device based at least in part on the source address, wherein the current access network is external to the particular network, and the message received from the device on the particular network is transmitted by the device over the current access network; and applying a network policy for the particular network to the device based on the determined current access network including assigning a maximum bandwidth usage parameter to the device that defines a maximum bandwidth usage permitted for the device. ### Claim 2 (depends on 1) The method of claim 1, wherein the message from the device is received by a server at an access network separate from the current access network of the device. ### Claim 3 (depends on 1) The method of claim 1, wherein the network over which the message is received from the device is the Internet. ### Claim 4 (depends on 1) The method of claim 1, further comprising identifying one or more known access networks each identified by a particular source address range, wherein the known access networks includes the current access network, and wherein determining the current access network of the device includes determining that the source address associated with the received message is included in the particular source address range associated with the current access network. ### Claim 5 (depends on 4) The method of claim 4, wherein the particular source address range includes a subnet mask. ### Claim 6 (depends on 1) The method of claim 1, wherein the current access network is associated with a network provider that operates the current access network. ### Claim 7 (depends on 1) The method of claim 1, wherein applying the network policy to the device includes restricting access to one or more network resources. ### Claim 8 (depends on 1) The method of claim 1, wherein applying the network policy to the device includes permitting access to one or more network resources. ### Claim 9 (depends on 1) The method of claim 1, wherein the received message is a heartbeat message. ### Claim 10 (depends on 1) The method of claim 1, wherein the received message is a request for a proxy automatic configuration (PAC) script. ### Claim 11 A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising: receiving, by a server connected to a particular network, a message from a device separate from the server over the particular network, the message associated with a source address; determining, by the server, a current access network for the device based at least in part on the source address, wherein the current access network is external to the particular network, and the message received from the device on the particular network is transmitted by the device over the current access network; and applying a network policy for the particular network to the device based on the determined current access network including assigning a maximum bandwidth usage parameter to the device that defines a maximum bandwidth usage permitted for the device. ### Claim 12 (depends on 11) The computer-readable medium of claim 11, wherein the message from the device is received by a server at an access network separate from the current access network of the device. ### Claim 13 (depends on 11) The computer-readable medium of claim 11, wherein the network over which the message is received from the device is the Internet. ### Claim 14 (depends on 11) The computer-readable medium of claim 11, further comprising identifying one or more known access networks each identified by a particular source address range, wherein the known access networks includes the current access network, and wherein determining the current access network of the device includes determining that the source address associated with the received message is included in the particular source address range associated with the current access network. ### Claim 15 (depends on 14) The computer-readable medium of claim 14, wherein the particular source address range includes a subnet mask. ### Claim 16 (depends on 11) The computer-readable medium of claim 11, wherein the current access network is associated with a network provider that operates the current access network. ### Claim 17 (depends on 11) The computer-readable medium of claim 11, wherein applying the network policy to the device includes restricting access to one or more network resources. ### Claim 18 A system for applying network policies to devices based on their current access network comprising: memory for storing data; and one or more processors operable to perform operations comprising: receiving, by a server connected to a particular network, a message from a device separate from the server over the particular network, the message associated with a source address; determining, by the server, a current access network for the device based at least in part on the source address, wherein the current access network is external to the particular network, and the message received from the device on the particular network is transmitted by the device over the current access network; and applying a network policy for the particular network to the device based on the determined current access network including assigning a maximum bandwidth usage parameter to the device that defines a maximum bandwidth usage permitted for the device. ### Claim 19 A computer-implemented method executed by one or more processors for applying network policies to devices based on their current access network, the method comprising: receiving, by a server of a distributed computing system that is at least partially hosted on a particular access network, a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address; determining, by the server for each device of the plurality of devices, a current access network for each device based at least in part on each device's corresponding source address, devices of a subset of the plurality of devices being determined to have a current access network other than the particular access network; applying, to the devices of the subset, a first network policy based on the determining, the first network policy defining a first encryption requirement; and applying, to the devices of the plurality of devices that are not of the subset, a second network policy based on the determining, the second network policy defining a second encryption requirement, wherein the first network policy and the second network policy each assign a maximum bandwidth usage parameter. ### Claim 20 (depends on 19) The method of claim 19, wherein the network over which the message is received from the plurality of devices is the Internet. ### Claim 21 (depends on 19) The method of claim 19, further comprising: identifying one or more known access networks each identified by a particular source address range; wherein: the known access networks include each of the current access networks; and determining, for each of the plurality of devices, the current access network of the device includes determining that the source address associated with the corresponding received message is included in the particular source address range associated with the corresponding current access network. ### Claim 22 (depends on 21) The method of claim 21, wherein the particular source address range includes a subnet mask. ### Claim 23 (depends on 19) The method of claim 19, wherein each of the current access networks are associated with one of a plurality of network providers that each operate a current access network. ### Claim 24 (canceled) ### Claim 25 (depends on 19) The method of claim 19, wherein the first network policy and the second network policy each specify restricting access to one or more network resources. ### Claim 26 (depends on 19) The method of claim 19, wherein the first network policy and the second network policy each specify permitting access to one or more network resources. ### Claim 27 (depends on 19) The method of claim 19, wherein the received messages include heartbeat messages. ### Claim 28 (depends on 19) The method of claim 19, wherein the received messages include requests for a proxy automatic configuration (PAC) script. ### Claim 29 A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising: receiving, by a server of a distributed computing system that is at least partially hosted on a particular access network, a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address; determining, by the server for each device of the plurality of devices, a current access network for each device based at least in part on each device's corresponding source address, devices of a subset of the plurality of devices being determined to have a current access network other than the particular access network; applying, to the devices of the subset, a first network policy based on the determining, the first network policy defining a first encryption requirement; and applying, to the devices of the plurality of devices that are not of the subset, a second network policy based on the determining, the second network policy defining a second encryption requirement, wherein the first network policy and the second network policy each assign a maximum bandwidth usage parameter. ### Claim 30 (depends on 29) The computer-readable medium of claim 29, wherein the network over which the message is received from the plurality of devices is the Internet. ### Claim 31 (depends on 29) The computer-readable medium of claim 29, further comprising: identifying one or more known access networks each identified by a particular source address range; wherein: the known access networks include each of the current access networks; and determining, for each of the plurality of devices, the current access network of the device includes determining that the source address associated with the corresponding received message is included in the particular source address range associated with the corresponding current access network. ### Claim 32 (depends on 31) The computer-readable medium of claim 31, wherein the particular source address range includes a subnet mask. ### Claim 33 (depends on 29) The computer-readable medium of claim 29, wherein each of the current access networks are associated with one of a plurality of network providers that each operate a current access network. ### Claim 34 (canceled) ### Claim 35 (depends on 29) The computer-readable medium of claim 29, wherein the first network policy and the second network policy each specify restricting access to one or more network resources. ### Claim 36 A system for applying network policies to devices based on their current access network comprising: memory for storing data; and one or more processors operable to perform operations comprising: receiving, by a server of a distributed computing system that is at least partially hosted on a particular access network, a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address; determining, by the server for each device of the plurality of devices, a current access network for each device based at least in part on each device's corresponding source address, devices of a subset of the plurality of devices being determined to have a current access network other than the particular access network; applying, to the devices of the subset, a first network policy based on the determining, the first network policy defining a first encryption requirement; and applying, to the devices of the plurality of devices that are not of the subset, a second network policy based on the determining, the second network policy defining a second encryption requirement, wherein the first network policy and the second network policy each assign a maximum bandwidth usage parameter.