Selective tunneling based on a client configuration and request

A method for managing a network tunnel over a network, comprising:

• receiving at a network device a request for a network resource from a client device;
• downloading onto the client device a component that detects a configuration of the client device and provides the detected configuration to the network device;
• modifying a Selective Tunneling Management (STM) component based in part on at least one attribute of the detected configuration of the client device, to include at least one test that employs the at least one attribute;
• downloading the modified STM component to the client device such that the modified STM component is enabled to selectively establish a tunneled network connection, an un-tunneled connection, or to redirect the request based on at least one characteristic of the request, a result of the at least one test, and the at least one attribute of the detected configuration of the client device, and wherein downloading the modified STM component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the STM and when detected replacing in memory of the client device the at least one application or API with the modified STM component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource;
• and
• when it is determined that the modified STM component is terminated on the client device, the network device purging the client device of at least the modified STM component.

A network device for managing a network connection, comprising:

• a transceiver to send and receive data over the network;
• and
• a processor that is operative to perform actions, including:
• receiving a request for a network connection from a client device;
• downloading onto the client device a component that detects a configuration of the client device including information indicating whether the client device is a kiosk or is otherwise not managed by a defined business and provides such detected configuration to the network device;
• selecting a pre-modified Selective Tunneling Management (STM) component based in part on at least one attribute of the detected configuration of the client device including whether the client device is a kiosk or otherwise not managed by a defined business, wherein the pre-modified STM component includes at least one test that employs the at least one attribute;
• downloading at least the selected STM component to the client device such that at least the selected STM component is enabled to selectively establish a tunneled network connection, an un-tunneled connection, or to redirect the request based on at least one characteristic of the request, a result of the at least one test, and the at least one attribute of the detected configuration of the client device, and wherein downloading the modified STM component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the STM and when detected replacing in memory of the client device the at least one application or API with the modified STM component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource;
• and
• when the modified STM component is terminated, purging the client device of at least the modified STM component by the network device.

An apparatus useable in managing network connections over a network, comprising:

• at least one processor that is operative to provide a component to a client device to detect a configuration of client device and to provide the detected configuration to the apparatus;
• and
• wherein the at least one processor is operative to perform actions, including:
• providing to the client device at least one component that is dynamically modified prior to providing to the client device based on the detected configuration of the client device, and to include at least one test for at least one attribute of the detected configuration;
• enabling the client device to selectively tunnel a network connection, an un-tunneled connection, or to redirect the request based in part on at least one characteristic of a network request, a result of the at least one test, and at least one attribute of the client configuration, and wherein providing the modified component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the modified component and when detected replacing in memory of the client device the at least one application or API with the modified component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource;
• and
• operating on the apparatus for purging the client device of the at least one component when it is determined that the at least one component is terminated.