# US 8,543,710 B2 · Method and system for controlling network access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,710 B2 - Document ID: US8543710B2 - Status: Granted - Kind: B2 - Application number: 11/076,591 - Filed: 2005-03-10 - Published: 2005-09-15 - Granted: 2013-09-24 - Earliest claimed: 2004-03-10 - Assignees: RPX Corporation - Applicants: Patrick Turley; Keith Johnston; Steven D. Tonnesen - Inventors: Patrick Turley; Keith Johnston; Steven D. Tonnesen - Web page: https://patentgrep.com/patent/US8543710B2 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods intended to control a network devices access to a network are disclosed. Embodiments of the current invention expose a method for confining a network client's network access to a specific logical region of the network. A network communication may be received and the client that originated this communication determined. This client is associated with a set of rules or walled garden that specifies the access allowed by that client. The destination of the communication may also be determined and if the destination is allowed by the set of rules associated with the client and access to the destination allowed if access to the destination is allowed by the set of rules. ## Claims ### Claim 1 A method of network traffic quarantine control, comprising: at a network access gateway device between a local network and the Internet, selecting a client device in a first network segment of the network; at the network access gateway device, performing a plurality of quarantine control functions over the client device, wherein the plurality of quarantine control functions comprises: a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment; b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to implementation of one of the plurality of quarantine control function of the client device. ### Claim 2 (depends on 1) The method according to claim 1, wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses. ### Claim 3 (depends on 1) The method according to claim 1, further comprising: evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: filtering the network traffic emanating from the client device to limit network packet flow by the client device. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: routing the network traffic emanating from the client device to limit network packet traversal by the client device. ### Claim 6 (depends on 1) The method according to claim 1, wherein the plurality of quarantine control functions further comprises: restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment. ### Claim 7 (depends on 1) The method according to claim 1, further comprising: performing all of the plurality of quarantine control functions over the client device. ### Claim 8 A computer program product comprising at least one non-transitory computer readable medium storing instructions translatable by at least one processor to perform: a plurality of quarantine control functions over a client device coupled to the network access gateway device, wherein the network access gateway device is between a local network and the Internet, wherein the client device is in a first network segment of the network, and wherein the plurality of quarantine control functions comprises: a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment; b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to the implementation of one of the plurality of quarantine control function of the client device. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses. ### Claim 10 (depends on 8) The computer program product of claim 8, wherein the instructions are further translatable by the at least one processor to perform: evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert. ### Claim 11 (depends on 8) The computer program product of claim 8, wherein the instructions are further translatable by the at least one processor to perform: filtering the network traffic emanating from the client device to limit network packet flow by the client device. ### Claim 12 (depends on 8) The computer program product of claim 8, wherein the instructions are further translatable by the at least one processor to perform: routing the network, traffic emanating from the client device to limit network packet traversal by the client device. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein the plurality of quarantine control functions further comprises: restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment. ### Claim 14 (depends on 8) The computer program product of claim 8, wherein the instructions are further translatable by the at least one processor to perform: all of the plurality of quarantine control functions over the client device. ### Claim 15 A network access gateway device, comprising: at least one processor; and at least one non-transitory computer readable medium storing instructions translatable by the at least one processor to perform: a plurality of quarantine control functions over a client device coupled to the network access gateway device, wherein the network access gateway device is between a local network and the Internet, wherein the client device is in a first network segment of the network, and wherein the plurality of quarantine control functions comprises: a) restricting all network traffic emanating from the client device to one or more network destination addresses that are not in or subordinate to the first network segment; b) restricting all network traffic emanating from the client device to an allowed network destination address to selected one or more network protocols; and rendering a web page to display on the client device from the network access gateway device, wherein the web page contains an offer for a user of the client device to perform an action in order to obtain unrestricted access to the Internet responsive to implementation of one of the plurality of quarantine control function of the client device. ### Claim 16 (depends on 15) The system of claim 15, wherein the action requires the user to obtain and execute abnormal behavior scanning software from a server machine running at one of the one or more allowed network destination addresses. ### Claim 17 (depends on 15) The system of claim 15, wherein the instructions are further translatable by the at least one processor to perform: evaluating network traffic emanating from the client device after the client device has been scanned and abnormal behavior has been removed, mitigated or rendered inert. ### Claim 18 (depends on 15) The system of claim 15, wherein the instructions are further translatable by the at least one processor to perform: filtering the network traffic emanating from the client device to limit network packet flow by the client device. ### Claim 19 (depends on 15) The system of claim 15, wherein the instructions are further translatable by the at least one processor to perform: routing the network traffic emanating from the client device to limit network packet traversal by the client device. ### Claim 20 (depends on 15) The system of claim 15, wherein the plurality of quarantine control functions further comprises: restricting all network traffic emanating from the client device to one or more network destination addresses in one or more network segments that are not in or subordinate to the first network segment.