Patent Description:
The field of network security has become increasingly important and complicated in today's society. Network environments are configured for virtually every home, enterprise, or organization, typically with multiple interconnected computers (e.g., end user computers, laptops, servers, printing devices, Internet of Things (IoT) devices, etc.). In many enterprises, Information Technology (IT) administrators may be tasked with maintenance and control of the network environment, including executable software files (e.g., web application files) on hosts, servers, and other network computers. At home, a generally less experienced end user may handle such tasks with wide variety of devices operating in a generally less controlled network environment. As the number of executable software files in a network environment increases, the ability to control, maintain, and remediate these files efficiently can become more difficult. Furthermore, computer and communications networks today encompass mobile devices such as smartphones, tablet computers and the like, which allow users to download and install applications on these devices quickly and with minimal oversight. Thus, innovative tools are needed to assist home users and IT administrators in the effective control and management of applications and devices operating within their communication network environments. Such tools may include tools for security modes for enhanced network security.

Such tools may run on a routing device, such as a router. A routing device generally acts to forward packets, such as internet protocol (IP) packets between one network, such as the internet, to devices on another network, such as a local network, sometimes referred to as an internal network, intranet, or a local area network (LAN). The routing device may interconnect any number of networks together provided sufficient network interfaces, generally one network interface for each network. For example, a typical home router may include a network interface for the internet, a wired network, and a wireless network. The routing device may join multiple networks into a single logical network such that devices on the logical network appear to be on the same network, such as joining the wired network and wireless network together to form a single local network. Local networks may also include multiple routing devices operating together.

A routing device may also include an integrated switching device. The switching device generally functions to direct network traffic to a specific network port. For example, a switching device may maintain a record of the media access control (MAC) addresses of all devices connected to the switching device associated with the specific network port that each device is connected to. The switching device may then direct network traffic directly to the appropriate network port, rather than, for example, broadcasting the network traffic to all network ports.

As routing devices are used to interconnect a local network with the internet, certain routing devices, such as a router configured with McAfee® (McAfee is a registered trademark owned by McAfee, LLC) Secure Home Platform (SHP), may be configured with security tools such as tools to block, or pause internet access to certain devices.

According to certain aspects of the present disclosure, the block functionality may be extended in the context of network security. For example, malware needs a connection between two devices to spread. This connection may be between a device located on the external network and another device on the internal network, or between two devices connected to the internal network. Blocking a local device's network access to other devices, both on the internal network and on the internet, at the router helps increase security by blocking the typical connection through which malware may spread. Additionally, as the number and complexity of internet connected devices (e.g., video streamers, Internet of Things (IoT) devices, etc.) added to networks increase, it may be desirable to disable internet connectivity or alter other router security settings associated with a set of these devices in certain conditions, such as at night, to help increase privacy, increase data use efficiency, and prevent unauthorized access. Nighthawk X4S AC2600 Smart WiFi Router User Manual relates to a user manual for a Netgear WiFi router that describes techniques to control access to the Internet, manage the network, and customize Internet traffic rules for ports.

In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without these specific details. In other instances, structure and devices are shown in block diagram form in order to avoid obscuring the invention. References to numbers without subscripts or suffixes are understood to reference all instance of subscripts and suffixes corresponding to the referenced number. Moreover, the language used in this disclosure has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. Reference in the specification to "one embodiment" or to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least one embodiment of the invention, and multiple references to "one embodiment" or "an embodiment" should not be understood as necessarily all referring to the same embodiment.

As used herein, the term "a programmable device" can refer to a single programmable device or a plurality of programmable devices working together to perform the function described as being performed on or by the programmable device. Similarly, "a machine-readable medium" can refer to a single physical medium or a plurality of media that together may store the material described as being stored on the machine-readable medium.

As used herein, the term "a computer system" can refer to a single computer or a plurality of computers working together to perform the function described as being performed on or by a computer system.

As used herein, the term "medium" and "storage" refer to one or more non-transitory physical media that together store the contents described as being stored thereon. Embodiments may include non-volatile secondary storage, read-only memory (ROM), and/or random-access memory (RAM).

A routing device may be configured to adjust internet connectivity and security settings for a set of devices connected to the routing device. For example, network access may be disabled for a set of devices, the ability to add new devices to a local network may be disabled, and a guest network disabled, based on a request received from a user.

Referring now to <FIG>, a block diagram illustrating a system <NUM> for security modes for enhanced network security, in accordance with aspects of the present disclosure. The system <NUM> includes a local network <NUM> connected to a datacenter <NUM>, via a network <NUM>, such as the internet. The local network <NUM> includes multiple devices including a wireless device <NUM>, such as an IoT device, security camera, streaming device, etc., a portable device <NUM>, such as a laptop, handheld, tablet, etc., and a wired device <NUM>, such as a personal computer. These devices may be connected to the network <NUM> via a router <NUM>. Further, one or more of the devices <NUM>-<NUM> and router <NUM> may connect, via network <NUM> to server <NUM> running in the datacenter <NUM> and connected to a database <NUM>.

As an example, router <NUM> may be configured to run a client management and security platform implementing security modes to help secure the local network <NUM>. This client platform may be controlled or configured in conjunction with a client application, such as an app running on a mobile device, a web application within a browser on a user device, or some other device. The client application may communicate with the client platform on the router <NUM> directly over the local network <NUM>.

In certain cases the client application may communicate with server <NUM>, which then communicates with the client platform on the router <NUM>. For example, a mobile app may receive a request from a user to perform an action via an input to the mobile app UI. The mobile app may interface with server <NUM> and send an indication for the router <NUM> to perform an action to server <NUM>. After this request is received by the server <NUM>, the server <NUM> may relay, reformat, or otherwise send an indication to the router <NUM> directing the router <NUM> to perform the action. By communicating requests directly with the server <NUM>, the user may be able to adjust security modes not just while connected with the local network <NUM>, but also remotely while not connected to the local network <NUM>, such as when on a cellular network. The server <NUM> may also include logic to prevent blocking network access of a user device running the mobile app.

Referring to <FIG>, a block diagram illustrating a router <NUM> configured with security modes, in accordance with aspects of present disclosure. The router <NUM> includes multiple network interfaces, including a wide area network (WAN) interface <NUM> for connecting to an external network such as the internet, as well as a wireless local area network (LAN) interface <NUM> and a wired LAN interface <NUM>. The router <NUM> may also be configured to run software stored in storage <NUM>. This software may include multiple modules, such as a user interface (UI) <NUM> and a security module <NUM>. The security module <NUM> may include code configured to implement security modes. The UI <NUM> may include code and resources, such as icon and other UI elements, for implementing a UI. The storage <NUM> may also hold routing information <NUM> and security configuration information <NUM>. Security settings and security modes may be stored as a part of security configuration information <NUM>. Routing information <NUM> may comprise routing tables for routing data packets between the WAN and LAN devices.

Configuration and security information for the router <NUM>, in some cases, may be stored or tracked by the server <NUM>. For example, the server <NUM> may include the security module <NUM> and maintain security configuration information <NUM> for router <NUM>, such as device lists and security settings associated with various security modes. The server <NUM> may transmit an indication to the router <NUM> when changes are made. The indication may, for example, direct the router <NUM> to update or make changes to the routing information <NUM> stored on the router <NUM>.

It may be desirable to have enhanced network security by restricting network access of certain devices when the functionality of those devices are not being utilized. In such cases, it may be advantageous to disable network access for those device, allowing for a decreased attack surface, as well as reducing the use of network resources. For example, network access for an audio/video (AV) streaming device or smart TV may be restricted when the functionality of those devices are not needed, such as where there is no person there or late at night. There are multiple scenarios where functionality of devices may not be needed and different network security modes may be appropriate for these scenarios. For example, if no person is expected to be present for an extended period of time, the ability to add a new device to the network may be safely disabled. Disabling adding new devices may be less desirable, for example, at night, when someone may still add a device. Multiple security modes may be defined based on, for example, common situations where certain device functionality may not be needed. For example, in the case of a home user, security modes may be defined for scenarios where users are away from the home or when users are in the home, but not expected to be using certain devices, such as at night.

Different security modes may be associated with different sets of devices to allow for adaption of the security modes to different scenarios. For example, a first security mode, such as night mode, may be associated with a different set of devices connected to the LAN than a second security mode, such as away mode. <FIG> illustrates UI <NUM> for device selection for a security mode, in accordance with aspects of the present disclosure. In certain cases, UI <NUM>, UI <NUM>, and UI <NUM> may be displayed as a part of an app running on a mobile device. In such cases, the UI <NUM> may be generated by the app with information provided by the router. For example, data from the router, such as information about LAN connected devices, may be provided by the router. UI components such as the layout, icons, buttons, and other UI elements may be provided by the app and these UI components may be used based on the data from the router. In other cases, UI <NUM>, UI <NUM>, and UI <NUM> may be provided by the router, for example, as a web application. UI elements in <FIG>, <FIG>, and <FIG>, are illustrative and persons having ordinary skill in the arts would understand that there are other UI elements, layouts, and formats which may be used. After receiving an indication to display devices associated with a given security mode, UI <NUM> may be displayed.

The UI <NUM>, may be provided to allow a user to select devices from the LAN to associate with a certain security mode. The router may obtain information from devices connected to the LAN, such as from a wireless device <NUM>, wired device <NUM>, and a mobile device <NUM>. The information may be obtained, for example, using universal plug and play (UPnP) protocol, and may include device information, such a device name, description, MAC address, and IP address. The user may select one or more devices using a selection element <NUM>, such as a button, toggle, switch, etc., for inclusion in a security mode, as indicated by a security mode identifier element <NUM>.

Each security mode may be associated with a separate set of devices. The set of devices may be selected by a user, for example, during set up of a security mode, after devices have been connected to the LAN, or after a new device is added to the LAN. In certain cases, devices may be automatically added to one or more security modes. For example, during set up or if a new device is added, a given device may be profiled (e.g., fingerprinted) based on information obtained from the devices, such as UPnP information. This device profile may be compared to a database, such as a local or online database, and added to one or more security modes based on the comparison. For example, a newly added device may be automatically added to a certain security mode when the device has a device profile consistent with the device profile that a majority of other users have added to the security mode.

Multiple security modes allow for further adaption of the security modes to different scenarios. For example, a router may include one or more predefined security modes, such as, a night and/or an away security mode. User-defined security modes may also be configured. Each security mode may be configured to include a set of security settings which are enabled when the security mode is active. This set of security settings may be configurable, for example by a user, for each security mode.

<FIG> illustrates a UI <NUM> for security setting configuration, in accordance with aspects of the present disclosure. After receiving an indication to display security settings for a given security mode, UI <NUM> may be displayed. UI <NUM> includes a security mode identifier element <NUM> identifying the security mode for which security settings may be adjusted for. One or more UI elements may be provided that may enable or disable a security setting for the security mode. For example, away mode UI element <NUM> indicates that away mode is configured to block all network access for devices associated with away mode, guest network UI element <NUM> indicates that away mode is configured to disable a configured guest network, and block new devices UI element <NUM> indicates that away mode is configured to block adding new devices to the LAN. Other security settings may also be provided such as, but not limited to, blocking Internet access while allowing Intranet access, scheduled times for re-enabling network access, restricting Internet access only to pre-defined sites, or other such setting. Certain security settings may modify other security settings. For example a security setting to block just internet access may modify the security setting to disable network access. Security settings which modify other security settings may appear as sub-settings of the security setting which they modify. Security setting settings may also be user-defined or customizable.

Security settings may be implemented, for example, by adjusting an appropriate router configuration. For example, blocking all network access may be implemented by adjusting routing tables to throw away (e.g., discard) all packets sent to or received from a blocked device, or forwarding the packets to another security module for further scrutiny or processing. As an example of forwarding, packets sent or received to or from the blocked device may be forwarded to another security module, such as pattern recognition enabled security module which inspects the packets for conformity to packet patterns of similar devices. This forwarding may be internal to a routing device, across multiple devices, or across networks. Similarly, blocking new devices can discard or forward all packets sent or received by any device not previously connected to the router. In certain cases, security settings may adjust or configure features not traditionally associated with router functionality. For example, activating a security mode may increase a vigilance of network monitoring, such as by SHP. This increased vigilance may, for example, adjust a sensitivity level for alerts for which a user may be notified of, adjust content filters, etc. Certain security settings or a minimum number of security settings may also be required for the security modes. For example, each security mode may be required to block network access for the associated set of devices, or each security mode must have at least one associated security setting.

<FIG> illustrates a UI <NUM> for controlling security modes, in accordance with aspects of the present disclosure. Helping facilitate use of security modes, different security modes may be easily activated. For example, UI <NUM> illustrates a router configured with two security modes controlled by an away mode button <NUM> and a Night mode button <NUM>, respectively. The UI <NUM> may indicate which security mode is currently activated, such as by showing the Night mode button <NUM> as depressed or otherwise activated, along with a textual indication. While shown as buttons, security modes may be activated or deactivated using any applicable UI elements. In certain cases, a single security mode may be active at a time, and the router may operate in a normal mode and without restrictions associated with security modes when no security mode is activated, unless otherwise configured.

In certain cases, security modes may also be activated without going through a traditional displayed UI. For example, security modes may be tied to an IoT sensor or device. For example, a security mode may be based on an indication from the IoT sensor or a device such as a security keypad, that no person has been detected for a set period of time. A security mode may also be used to adjust a configuration of a device. For example, an instruction may be communicated to the device, such as a remote door lock, which deactivates the remote door lock, based on the security mode, or activate a home security system based on the indicated security mode. In certain cases, security modes may be scheduled, for example, to activate or deactivate a particular security mode based on a time schedule or a geofenced location.

<FIG> is a flow diagram illustrating a method <NUM> for security modes for enhanced network security, in accordance with aspects of the present disclosure. At block <NUM>, an indication of a security mode, of a plurality of security modes, is received. The indication may be received, for example, from an app running on a mobile device. The app may then directly interface with the router, or the app may interface with a server, which may then either relay the indication to the router, or direct the router to implement the indicated security mode. In other cases, the indication may be received from a web application executing, for example, in a browser on a client device. In yet other cases, the indication may be received from an IoT device, such as a sensor, keypad, or remote button. Multiple security modes may be predefined, for example on the router, to include a set of security settings and a set of devices connected by a local network to a router for each security mode. At block <NUM>, based on the indicated security mode, a set of network connected devices is selected and at block <NUM>, the security settings are applied for the selected set of network connected devices and network access for the selected set of network connected devices is blocked.

Referring now to <FIG>, a block diagram illustrates a programmable device <NUM> that may be used for implementing the techniques described herein in accordance with one embodiment. The programmable device <NUM> illustrated in <FIG> is a multiprocessor programmable device that includes a first processing element <NUM> and a second processing element <NUM>. While two processing elements <NUM> and <NUM> are shown, an embodiment of programmable device <NUM> may also include only one such processing element.

Programmable device <NUM> is illustrated as a point-to-point interconnect system, in which the first processing element <NUM> and second processing element <NUM> are coupled via a point-to-point interconnect <NUM>. Any or all of the interconnects illustrated in <FIG> may be implemented as a multi-drop bus rather than point-to-point interconnects.

As illustrated in <FIG>, each of processing elements <NUM> and <NUM> may be multicore processors, including first and second processor cores (i.e., processor cores 774a and 774b and processor cores 784a and 784b). Such cores 774a, 774b, 784a, 784b may be configured to execute instruction code. However, other embodiments may use processing elements that are single core processors as desired. In embodiments with multiple processing elements <NUM>, <NUM>, each processing element may be implemented with different numbers of cores as desired.

Each processing element <NUM>, <NUM> may include at least one shared cache <NUM>. The shared cache 746a, 746b may store data (e.g., instructions) that are utilized by one or more components of the processing element, such as the cores 774a, 774b and 784a, 784b, respectively. For example, the shared cache may locally cache data stored in a memory <NUM>, <NUM> for faster access by components of the processing elements <NUM>, <NUM>. In one or more embodiments, the shared cache 746a, 746b may include one or more mid-level caches, such as level <NUM> (L2), level <NUM> (L3), level <NUM> (L4), or other levels of cache, a last level cache (LLC), or combinations thereof.

While <FIG> illustrates a programmable device with two processing elements <NUM>, <NUM> for clarity of the drawing, the scope of the present invention is not so limited and any number of processing elements may be present. Alternatively, one or more of processing elements <NUM>, <NUM> may be an element other than a processor, such as an graphics processing unit (GPU), a digital signal processing (DSP) unit, a field programmable gate array, or any other programmable processing element. Processing element <NUM> may be heterogeneous or asymmetric to processing element <NUM>. There may be a variety of differences between processing elements <NUM>, <NUM> in terms of a spectrum of metrics of merit including architectural, microarchitectural, thermal, power consumption characteristics, and the like. These differences may effectively manifest themselves as asymmetry and heterogeneity amongst processing elements <NUM>, <NUM>. In some embodiments, the various processing elements <NUM>, <NUM> may reside in the same die package.

First processing element <NUM> may further include memory controller logic (MC) <NUM> and point-to-point (P-P) interconnects <NUM> and <NUM>. Similarly, second processing element <NUM> may include a MC <NUM> and P-P interconnects <NUM> and <NUM>. As illustrated in <FIG>, MCs <NUM> and <NUM> couple processing elements <NUM>, <NUM> to respective memories, namely a memory <NUM> and a memory <NUM>, which may be portions of main memory locally attached to the respective processors. While MC logic <NUM> and <NUM> is illustrated as integrated into processing elements <NUM>, <NUM>, in some embodiments the memory controller logic may be discrete logic outside processing elements <NUM>, <NUM> rather than integrated therein.

Processing element <NUM> and processing element <NUM> may be coupled to an I/O subsystem <NUM> via respective P-P interconnects <NUM> and <NUM> through links <NUM> and <NUM>. As illustrated in <FIG>, I/O subsystem <NUM> includes P-P interconnects <NUM> and <NUM>. Furthermore, I/O subsystem <NUM> includes an interface <NUM> to couple I/O subsystem <NUM> with a high performance graphics engine <NUM>. In one embodiment, a bus (not shown) may be used to couple graphics engine <NUM> to I/O subsystem <NUM>. Alternately, a point-to-point interconnect <NUM> may couple these components.

In turn, I/O subsystem <NUM> may be coupled to a first link <NUM> via an interface <NUM>. In one embodiment, first link <NUM> may be a Peripheral Component Interconnect (PCI) bus, or a bus such as a PCI Express bus or another I/O interconnect bus, although the scope of the present invention is not so limited.

As illustrated in <FIG>, various I/O devices <NUM>, <NUM> may be coupled to first link <NUM>, along with a bridge <NUM> that may couple first link <NUM> to a second link <NUM>. In one embodiment, second link <NUM> may be a low pin count (LPC) bus. Various devices may be coupled to second link <NUM> including, for example, a keyboard/mouse <NUM>, communication device(s) <NUM> (which may in turn be in communication with a network <NUM>), and a data storage unit <NUM> such as a disk drive or other mass storage device which may include code <NUM>, in one embodiment. The code <NUM> may include instructions for performing embodiments of one or more of the techniques described above. Further, an audio I/O <NUM> may be coupled to second link <NUM>.

Note that other embodiments are contemplated. For example, instead of the point-to-point architecture of <FIG>, a system may implement a multi-drop bus or another such communication topology. Although links <NUM> and <NUM> are illustrated as busses in <FIG>, any desired type of link may be used. In addition, the elements of <FIG> may alternatively be partitioned using more or fewer integrated chips than illustrated in <FIG>.

Referring now to <FIG>, a block diagram illustrates a programmable device <NUM> according to another embodiment. Certain aspects of <FIG> have been omitted from <FIG> in order to avoid obscuring other aspects of <FIG>.

<FIG> illustrates that processing elements <NUM>, <NUM> may include integrated memory and I/O control logic ("CL") <NUM> and <NUM>, respectively. In some embodiments, the <NUM>, <NUM> may include memory control logic (MC) such as that described above in connection with <FIG>. In addition, CL <NUM>, <NUM> may also include I/O control logic. <FIG> illustrates that not only may the memories <NUM>, <NUM> be coupled to the CL <NUM>, <NUM>, but also that I/O devices <NUM> may also be coupled to the control logic <NUM>, <NUM>. Legacy I/O devices <NUM> may be coupled to the I/O subsystem <NUM> by interface <NUM>. Each processing element <NUM>, <NUM> may include multiple processor cores, illustrated in <FIG> as processor cores 874A, 874B, 884A and 884B. As illustrated in <FIG>, I/O subsystem <NUM> includes point-to-point (P-P) interconnects <NUM> and <NUM> that connect to P-P interconnects <NUM> and <NUM> of the processing elements <NUM> and <NUM> with links <NUM> and <NUM>. Processing elements <NUM> and <NUM> may also be interconnected by link <NUM> and interconnects <NUM> and <NUM>, respectively.

The programmable devices depicted in <FIG> and <FIG> are schematic illustrations of embodiments of programmable devices that may be utilized to implement various embodiments discussed herein. Various components of the programmable devices depicted in <FIG> and <FIG> may be combined in a system-on-a-chip (SoC) architecture.

The following examples pertain to further embodiments.

Example <NUM> is a machine readable medium, on which are stored instructions for enhanced security modes for blocking network access for a set of devices, comprising instructions that when executed cause a programmable device to: receive an indication of a security mode of a plurality of security modes, the security mode comprising a set of security settings associated with a set of network connected devices, of a plurality of network connected devices connected to a local network, wherein each security mode of the plurality of security modes is associated with a different set of security settings, and wherein the set of security settings comprises at least blocking network access of the set of network connected devices; select the set of network connected devices based on the indicated security mode; and direct an application of the set of security settings to the selected set of network connected devices.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein blocking network access comprises blocking internet and intranet access.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the indication of a security mode is received from a user device over a separate network from the local network.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the set of security settings associated with the security mode is different from another set of security settings associated with another security mode of the set of security modes.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the instructions further comprise instructions that when executed cause the routing device to disable a guest network based on the indication of the security mode.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein receiving the indication of the security mode comprises receiving a user selection of the security mode from a plurality of security modes from a mobile device.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the instructions further comprise instruction that when executed cause the routing device to block joining a new device to the local network based on the indicated security mode.

Example <NUM>, is a method for enhanced security modes for blocking network access for a set of devices, the method comprising, receiving, from a user, a first indication of a first security mode selected from a plurality of security modes, selecting a first predetermined set of network connected devices based on the first security mode, directing blocking of network access of the first predetermined set of network connected devices, directing blocking of joining a new device to a local network based on the first security mode.

In Example <NUM>, the subject matter of Example <NUM> optionally includes receiving, from the user, a second indication of a second security mode selected from the plurality of security modes, selecting a second predetermined set of network connected devices based on the second security mode, blocking network access of the second predetermined set of network connected devices.

In Example <NUM>, the subject matter of Example <NUM> optionally includes receiving, from the user, a selection of one or more devices, and from a plurality of devices connected to the network, assigning the selection of one or more devices to the first predetermined set of network connected devices.

In Example <NUM>, the subject matter of Example <NUM> optionally includes disabling at least the blocking joining the new device to the network based on a third indication to disable the first security mode, determining that the new device is connected to the network, displaying, to the user, a fourth indication that the new device is connected to the network and the plurality of security modes to the user, receiving, from the user, a selection of the first security mode, and assigning the new device to the first predetermined set of network connected devices.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the first indication of the first security mode is received from a user device over a separate network from the local network.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the first predetermined set of network connected devices is a subset of all network connected devices on the network.

In Example <NUM>, the subject matter of Example <NUM> optionally includes further comprising directing another device to take one or more actions based on the indicated first security mode.

Example <NUM> is an apparatus for enhanced security modes for blocking network access for a set of devices, the apparatus comprising, a memory for storing instructions for enhanced security modes, one or more network interfaces operatively coupled to one or more network connected devices, a processor operatively coupled to the memory and one or more network interfaces and adapted to execute the instructions stored in the memory to cause the processor to, receive an indication of a security mode, receive an indication of a security mode, select a set of network connected devices based on the indication of the security mode, block network access of the set of network connected devices, and block joining a new device to a local network based on the indicated security mode.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein blocking network access further comprises one of throwing away packets sent to and from a blocked device or forwarding the packets for further security processing.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the set of network connected devices is a subset of all network connected devices on the network.

In Example <NUM>, the subject matter of Example <NUM> optionally includes wherein the instructions stored in the memory further cause the processor to disable a guest network based on the indicated security mode.

Claim 1:
A method (<NUM>) for enhanced security modes for blocking network access, the method comprising:
receiving, from a user, a first indication of an away security mode (<NUM>) controlled by an away mode button (<NUM>) on a user interface (<NUM>) displayed as part of an app running on a mobile device, the away security mode selected from a plurality of security modes;
selecting a first predetermined set of devices based on the away security mode (<NUM>), the first predetermined set of devices connected to a local network;
in response to the first indication of the away security mode:
blocking the first predetermined set of devices from accessing a wide area network (<NUM>); and
blocking a new device from joining the local network based on the away security mode (<NUM>).