# US 8,572,219 B1 · Selective tunneling based on a client configuration and request > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,219 B1 - Document ID: US8572219B1 - Status: Granted - Kind: B1 - Application number: 11/386,178 - Filed: 2006-03-22 - Granted: 2013-10-29 - Earliest claimed: 2006-03-02 - Assignees: F5 Networks, Inc. - Applicants: Andrey Shigapov - Inventors: Andrey Shigapov - Web page: https://patentgrep.com/patent/US8572219B1 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/0272: {Virtual private networks} - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, apparatus, and method are directed to network communication over a tunnel by downloading selective tunneling (STM) components into memory of a client device. The STM components selectively employ tunneling to route network traffic to a requested resource. The STM components may include a network API, application, and a tunnel manager that have been modified based in part on a client configuration. As a network request is made it is evaluated against the client configuration. If the connection is to be tunneled, a network tunnel is selectively established. If the client configuration and/or the request indicate that the request is to be un-tunneled, an un-tunneled network connection may instead be established. The client configuration may also indicate that the client device is to be redirected to enable remediation. When the application component is closed, or otherwise terminated, the client's memory may be purged of the loaded STM components. ## Claims ### Claim 1 A network device for managing a network connection, comprising: a transceiver to send and receive data over the network; and a processor that is operative to perform actions, including: receiving a request for a network connection from a client device; downloading onto the client device a component that detects a configuration of the client device and provides the detected configuration to the network device; modifying a Selective Tunneling Management (STM) component based in part on at least one attribute of the detected configuration of the client device, to include at least one test that employs the at least one attribute; downloading at least the modified STM component to the client device such that at least the modified STM component is enabled to selectively establish a tunneled network connection, an un-tunneled connection, or to redirect the request based on at least one characteristic of the request, a result of the at least one test, and the at least one attribute of the detected configuration of the client device, and wherein downloading the modified STM component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the STM and when detected replacing in memory of the client device the at least one application or API with the modified STM component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource; and when the modified STM component is terminated, purging the client device of at least the modified STM component. ### Claim 2 (depends on 1) The network device of claim 1, wherein the STM component further comprises at least one of a network API component, a tunnel manager, or an application component. ### Claim 3 (depends on 1) The network device of claim 1, wherein the STM component further comprises at least one of a sockets API component. ### Claim 4 (depends on 1) The network device of claim 1, wherein selectively establishing the tunneled network connection further comprises establishing an SSL VPN. ### Claim 5 (depends on 1) The network device of claim 1, the actions further comprising: employing the at least one attribute of the detected client configuration to determine whether to at least one of establish the tunneled network connection, deny the request, or redirect the request for remediation. ### Claim 6 (depends on 1) The network device of claim 1, wherein detecting a configuration of the client device further comprises downloading a component to the client device. ### Claim 7 (depends on 1) The network device of claim 1, wherein the request further comprises at least one of an IP address, a TCP port number, a Domain Name, an application requesting the network connection, a file being requested, a network resource location, or the network resource type being requested. ### Claim 8 (depends on 1) The network device of claim 1, wherein downloading at least the modified STM component to the client device further comprises: performing an examination of the client device to detect an other application than the STM capable of initiating a network request, and when the other application is detected, modifying the other application with at least some of the modified STM. ### Claim 9 A method for managing a network tunnel over a network, comprising: receiving at a network device a request for a network resource from a client device; downloading onto the client device a component that detects a configuration of the client device and provides the detected configuration to the network device; modifying a Selective Tunneling Management (STM) component based in part on at least one attribute of the detected configuration of the client device, to include at least one test that employs the at least one attribute; downloading the modified STM component to the client device such that the modified STM component is enabled to selectively establish a tunneled network connection, an un-tunneled connection, or to redirect the request based on at least one characteristic of the request, a result of the at least one test, and the at least one attribute of the detected configuration of the client device, and wherein downloading the modified STM component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the STM and when detected replacing in memory of the client device the at least one application or API with the modified STM component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource; and when it is determined that the modified STM component is terminated on the client device, the network device purging the client device of at least the modified STM component. ### Claim 10 (depends on 9) The method of claim 9, wherein selectively establishing the tunneled network connection further comprises if the requested resource is protected by a security perimeter, employing a tunnel through the security perimeter. ### Claim 11 (depends on 9) The method of claim 9, wherein selectively establishing the tunneled network connection further comprises if the requested resource is identified in a list of resources for tunneling, and the client configuration is above a threshold, establishing the tunneled network connection to the network resource. ### Claim 12 (depends on 9) The method of claim 9, further comprising: if the request is to a resource unprotected by a predetermined security perimeter, sharing at least one of a client configuration, a credential, or a certificate, with the resource. ### Claim 13 (depends on 9) The method of claim 9, wherein selectively establishing the tunneled network connection further comprises: if the detected client configuration is below the threshold, further redirecting the request for remediation. ### Claim 14 (depends on 9) The method of claim 9, wherein the at least one attribute of the client configuration further comprises at least one of information indicating which applications are residing on the client device, a configuration of an application on the client device, an operating system configuration, a software patch level, a certificate type, an encryption capability, a security product status, a management mechanism associated with the client device, or a type of client device. ### Claim 15 (depends on 9) A non-transitory computer readable storage medium configured to include program instructions for performing the method of claim 9. ### Claim 16 A network device for managing a network connection, comprising: a transceiver to send and receive data over the network; and a processor that is operative to perform actions, including: receiving a request for a network connection from a client device; downloading onto the client device a component that detects a configuration of the client device including information indicating whether the client device is a kiosk or is otherwise not managed by a defined business and provides such detected configuration to the network device; selecting a pre-modified Selective Tunneling Management (STM) component based in part on at least one attribute of the detected configuration of the client device including whether the client device is a kiosk or otherwise not managed by a defined business, wherein the pre-modified STM component includes at least one test that employs the at least one attribute; downloading at least the selected STM component to the client device such that at least the selected STM component is enabled to selectively establish a tunneled network connection, an un-tunneled connection, or to redirect the request based on at least one characteristic of the request, a result of the at least one test, and the at least one attribute of the detected configuration of the client device, and wherein downloading the modified STM component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the STM and when detected replacing in memory of the client device the at least one application or API with the modified STM component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource; and when the modified STM component is terminated, purging the client device of at least the modified STM component by the network device. ### Claim 17 (depends on 16) The network device of claim 16, wherein the pre-modified STM component is pre-modified based on an expected client configuration. ### Claim 18 (depends on 16) The network device of claim 16, wherein selecting the pre-modified STM component further comprises selecting the pre-modified STM component that is pre-modified based on an expected at least one attribute that most closely matches the at least one attribute of the detected client configuration. ### Claim 19 (depends on 16) The network device of claim 16, the actions further comprising: modifying the pre-modified STM component based in part on the at least one attribute of the detected configuration. ### Claim 20 An apparatus useable in managing network connections over a network, comprising: at least one processor that is operative to provide a component to a client device to detect a configuration of client device and to provide the detected configuration to the apparatus; and wherein the at least one processor is operative to perform actions, including: providing to the client device at least one component that is dynamically modified prior to providing to the client device based on the detected configuration of the client device, and to include at least one test for at least one attribute of the detected configuration; enabling the client device to selectively tunnel a network connection, an un-tunneled connection, or to redirect the request based in part on at least one characteristic of a network request, a result of the at least one test, and at least one attribute of the client configuration, and wherein providing the modified component further comprises detecting at least one other application or Application Programming Interface (API) capable of requesting a network connection other than the modified component and when detected replacing in memory of the client device the at least one application or API with the modified component, and wherein selectively establishing the tunneled network connection further comprises if the detected configuration of the client device indicates a level of security below a threshold then establishing the tunneled network connection to a security enhancing resource while restricting access to at least one other resource; and operating on the apparatus for purging the client device of the at least one component when it is determined that the at least one component is terminated. ### Claim 21 (depends on 20) The apparatus of claim 20, wherein the at least one processor is operative to perform actions, including: receiving the network request; and if a security level of the client device is below the threshold, further redirecting the network request for remediation. ### Claim 22 (depends on 20) The apparatus of claim 20, wherein the at least one attribute comprises a security level associated with the client.