Rule-based routing to resources through a network

• US 10,003,576 B2
• Filed: 06/13/2016
• Issued: 06/19/2018
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Hopen, Chris, Sauve, Bryan, Hoover, Paul, Perry, Bill
• Primary Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US15/180,329
• Publication Number:
  US 20160294778A1
• Time in Patent Office: 736 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Techniques for determining which resource access requests are handled locally at a remote computer, and which resource access requests are routed or “redirected” through a virtual private network. One or more routing or “redirection” rules are downloaded from a redirection rule server to a remote computer. When the node of the virtual private network running on the remote computer receives a resource access request, it compares the identified resource with the rules. Based upon how the identified resource matches one or more rules, the node will determine whether the resource access request is redirected through the virtual private network or handled locally (e.g., retrieved locally from another network). A single set of redirection rules can be distributed to and employed by a variety of different virtual private network communication techniques.

Claims

1. A method for routing requests to a resource in a computer network, the method comprising:

receiving, using hardware processor, a redirection rule list at a client device from a redirection rule server in the computer network, wherein the redirection rule list includes a redirection rule specifying that resource requests having an identified spoofed address are to be forwarded to a first resource server;

sorting the redirection rule list by the client device;

obtaining an existing Proxy Auto Configuration (PAC) file and logic associated with an evaluation logic template;

merging the sorted redirection rule list, the existing PAC file, and the logic associated with the evaluation logic template to create a new PAC file,

initializing a local circuit proxy at the client device;

registering the new PAC file to enable redirection of Virtual Private Network (VPN) resource access requests;

receiving a request to access a first resource at the first resource server in the computer network;

evaluating the request to access the first resource at the first resource server in the computer network via execution of the logic associated with the evaluation logic template included in the new PAC file to determine whether the request includes the identified spoofed address; and

processing the evaluated request,

wherein the processing of the evaluated request when the evaluated request includes the identified spoofed address includes;

providing the identified spoofed address to the local circuit proxy at the client device for accessing the first resource at the first resource server in the computer network via a VPN connection based on the new PAC file that enables the redirection of the VPN resource access requests, wherein the identified spoofed address is mapped to a second address in the computer network that corresponds to the first resource at the first resource server in the computer network; and

forwarding the evaluated request to a server associated with the second address in the computer network according to the redirection rule mapping of the identified spoofed address to the second address, wherein the evaluated request is forwarded by the local circuit proxy at the client device over the computer network to the server associated with the second address in the computer network, and the first resource is accessed from the server in the computer network according to the redirection rule via the VPN connection based on the forwarded evaluated request; and

wherein the processing of the evaluated request when the evaluated request does not include the identified spoofed address includes;

matching a resource identifier referenced in the evaluated request against an address rule list, and

redirecting the evaluated request via the local circuit proxy of the client device based on the matched resource identifier in the address rule list.

2. The method of claim 1, wherein the request is from the application program executing at the client device.

3. The method of claim 1, wherein the server is a proxy server that forwards the request to a VPN server.

4. The method of claim 1, wherein the server that the request is forwarded to is a VPN server.

5. The method of claim 1, wherein the request is forwarded through a firewall that protects at least the first resource at the computer network.

6. The method of claim 1, wherein the first resource server and the server are a same computing device.

7. A non-transitory computer readable storage medium having embodied thereon a program that when executed by a processor performs operations comprising:

receiving a redirection rule list at a client device from a redirection rule server in a computer network, wherein the redirection rule list includes a redirection rule specifying that resource requests having an identified spoofed address are to be forwarded to a first resource server;

sorting the redirection rule list by the client device;

obtaining an existing Proxy Auto Configuration (PAC) file and logic associated with an evaluation logic template;

merging the sorted redirection rule list, the existing PAC file, and the logic associated with the evaluation logic template to create a new PAC file,

initializing a local circuit proxy at the client device;

registering the new PAC file to enable redirection of Virtual Private Network (VPN) resource access requests;

receiving a request to access a first resource at the first resource server in the computer network;

evaluating the request to access the first resource at the first resource server in the computer network via execution of the logic associated with the evaluation logic template included in the new PAC file to determine whether the request includes the identified spoofed address; and

processing the evaluated request,

wherein the processing of the evaluated request when the evaluated request includes the identified spoofed address includes;

providing the identified spoofed address to the local circuit proxy at the client device for accessing the first resource at the first resource server in the computer network via a VPN connection based on the new PAC file that enables the redirection of the VPN resource access requests, wherein the identified spoofed address is mapped to a second address in the computer network that corresponds to the first resource at the first resource server in the computer network; and

forwarding the evaluated request to a server associated with the second address in the computer network according to the redirection rule mapping of the identified spoofed address to the second address, wherein the evaluated request is forwarded by the local circuit proxy at the client device over the computer network to the server associated with the second address in the computer network, and the first resource is accessed from the server in the computer network according to the redirection rule via the VPN connection based on the forwarded evaluated request; and

wherein the processing of the evaluated request when the evaluated request does not include the identified spoofed address includes;

matching a resource identifier referenced in the evaluated request against an address rule list, and

redirecting the evaluated request via the local circuit proxy of the client device based on the matched resource identifier in the address rule list.

8. The non-transitory computer readable storage medium of claim 7, wherein the request is from the application program at the client device.

9. The non-transitory computer readable storage medium of claim 7, wherein the server is a proxy server that subsequently forwards the request to a VPN server.

10. The non-transitory computer readable storage medium of claim 7, wherein the server that the request is forwarded to is a VPN server.

11. The non-transitory computer readable storage medium of claim 7, wherein the request is forwarded through a firewall that protects at least the first resource at the computer network.

12. The non-transitory computer readable storage medium of claim 7, wherein the first resource server and the server are a same computing device.

13. An apparatus for routing requests to a resource in a computer network, the apparatus comprising:

a memory;

a computer network interface of a client device that receives a redirection rule list from a redirection rule server in the computer network, wherein the redirection rule list includes a redirection rule specifying that resource requests having an identified spoofed address are to be forwarded to a first resource server;

a user interface that receives a request to access a first resource at the first resource server in the computer network;

a processor of the client device, wherein the processor of the client device;

sorts the redirection rule list received by the computer network interface of the client device,

obtains an existing Proxy Auto Configuration (PAC) file and logic associated with an evaluation logic template,

merges the sorted redirection rule list, the existing PAC file, and the logic associated with the evaluation logic template to create a new PAC file,

initializes a local circuit proxy at the client device,

registers the new PAC file to enable redirection of Virtual Private Network (VPN) resource access requests,

performs evaluation of the request to access the first resource at the first resource server in the computer network received by the user interface via execution of the logic associated with the evaluation logic template included in the new PAC file, and determines whether the request includes the identified spoofed address, and processes the evaluated request,

wherein when the evaluated request includes the identified spoofed address, the processor provides the identified spoofed address to the local circuit proxy at the client device for accessing the first resource at the first resource server in the computer network via a VPN connection, accesses the redirection rule list based on the new PAC file that enables the redirection of the VPN resource access requests, identifies that the redirection rule list maps the identified spoofed address to a second address that corresponds to the first resource at the first resource server in the computer network, and

forwards the evaluated request to a server associated with the second address in the computer network according to the redirection rule mapping of the identified spoofed address to the second address, wherein the evaluated request is forwarded by the local circuit proxy at the client device over the computer network to the server associated with the second address in the computer network, and the first resource is accessed from the server in the computer network according to the redirection rule via the VPN connection based on the forwarded evaluated request, and

wherein when the evaluated request does not include the spoofed address, the processor matches a resource identifier referenced in the evaluated request against an address rule list, and redirects the evaluated request via the local circuit proxy of the client device based on the matched resource identifier in the address rule list.

14. The apparatus of claim 13, wherein the request is from an application program at the client device is executed by the processor out of the memory.

15. The apparatus of claim 13, wherein the server that the request is forwarded to is a proxy server and the request is forwarded from the proxy server to a VPN server.

16. The apparatus of claim 13, wherein the server that the request is forwarded to is a VPN server.

17. The apparatus of claim 13, wherein the request is forwarded through a firewall that protects at least the first resource at the computer network.

18. The apparatus of claim 13, wherein the first resource server and the server are a same computing device.