Applying network policies to devices based on their current access network

Abstract

This specification generally relates to describes methods and systems for applying network policies to devices based on their current access network. One example method includes receiving a message from a device over a network, the message associated with a source address; determining a current access network for the device based at least in part on the source address; and applying a network policy to the device based on the determined current access network.

What is claimed is: 
     
         1 . A computer-implemented method executed by one or more processors for applying network policies to devices based on their current access network, the method comprising:
 receiving a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address;   determining, for each of the plurality of devices, a current access network for the device based at least in part on the device's corresponding source address; and   applying, for each of the devices, a network policy to the device based on the device's determined current access network.   
     
     
         2 . The method of  claim 1 , wherein the plurality of messages from the plurality of devices are received by a server at an access network separate from the current access networks of the devices. 
     
     
         3 . The method of  claim 1 , wherein the network over which the message is received from the plurality of devices is the Internet. 
     
     
         4 . The method of  claim 1 , further comprising:
 identifying one or more known access networks each identified by a particular source address range;   
       wherein:
 the known access networks include each of the current access networks; and 
 determining, for each of the plurality of devices, the current access network of the device includes determining that the source address associated with the corresponding received message is included in the particular source address range associated with the corresponding current access network. 
 
     
     
         5 . The method of  claim 4 , wherein the particular source address range includes a subnet mask. 
     
     
         6 . The method of  claim 1 , wherein each of the current access networks are associated with one of a plurality of network providers that each operate a current access network. 
     
     
         7 . The method of  claim 1 , wherein applying, for each of the devices, the network policy to the device includes assigning a maximum bandwidth usage parameter to the device. 
     
     
         8 . The method of  claim 1 , wherein applying, for each of the devices, the network policy to the device includes restricting access to one or more network resources. 
     
     
         9 . The method of  claim 1 , wherein applying, for each of the devices, the network policy to the device includes permitting access to one or more network resources. 
     
     
         10 . The method of  claim 1 , wherein the received messages include heartbeat messages. 
     
     
         11 . The method of  claim 1 , wherein the received messages include requests for a proxy automatic configuration (PAC) script. 
     
     
         12 . A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:
 receiving a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address;   determining, for each of the plurality of devices, a current access network for the device based at least in part on the device's corresponding source address; and   applying, for each of the devices, a network policy to the device based on the device's determined current access network.   
     
     
         13 . The computer-readable medium of  claim 12 , wherein the plurality of messages from the plurality of devices are received by a server at an access network separate from the current access networks of the devices. 
     
     
         14 . The computer-readable medium of  claim 12 , wherein the network over which the message is received from the plurality of devices is the Internet. 
     
     
         15 . The computer-readable medium of  claim 12 , further comprising:
 identifying one or more known access networks each identified by a particular source address range;   
       wherein:
 the known access networks include each of the current access networks; and 
 determining, for each of the plurality of devices, the current access network of the device includes determining that the source address associated with the corresponding received message is included in the particular source address range associated with the corresponding current access network. 
 
     
     
         16 . The computer-readable medium of  claim 15 , wherein the particular source address range includes a subnet mask. 
     
     
         17 . The computer-readable medium of  claim 12 , wherein each of the current access networks are associated with one of a plurality of network providers that each operate a current access network. 
     
     
         18 . The computer-readable medium of  claim 12 , wherein applying, for each of the devices, the network policy to the device includes assigning a maximum bandwidth usage parameter to the device. 
     
     
         19 . The computer-readable medium of  claim 12 , wherein applying, for each of the devices, the network policy to the device includes restricting access to one or more network resources. 
     
     
         20 . A system for applying network policies to devices based on their current access network comprising:
 memory for storing data; and   one or more processors operable to perform operations comprising:
 receiving a plurality of messages from a plurality of devices over a network, each of the messages associated with a corresponding source address; 
 determining, for each of the plurality of devices, a current access network for the device based at least in part on the device's corresponding source address; and 
 applying, for each of the devices, a network policy to the device based on the device's determined current access network.