Dual-mode multi-service VPN network client for mobile device

• US 10,142,292 B2
• Filed: 12/14/2010
• Issued: 11/27/2018
• Est. Priority Date: 06/30/2010
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Inventors: Wei, Yin, Iyer, Subramanian, Campagna, Richard, Wood, James
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US12/968,095
• Publication Number:
  US 20120005746A1
• Time in Patent Office: 2,905 Days
• Field of Search: 713151
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/086 using security domains

Abstract

An integrated, multi-service network client for cellular mobile devices is described. The multi-service client includes a VPN handler having an interface programmed to exchange the network packets with the security manager for application of the security service, wherein the VPN handler is configurable to operate in one of an enterprise mode and in a non-enterprise mode, wherein in the enterprise mode the VPN handler establishes a VPN connection with a remote VPN security device and provides encryption services to securely tunnel the network packets between the cellular mobile device and the remote VPN security device, and wherein in the non-enterprise mode the VPN handler directs the network packets to the security manager without application of the encryption services and communicates the network packets to a packet-based network without tunneling the packets.

Claims

1. A cellular mobile device comprising:

a transmitter and receiver to send and receive cellular communications in the form of radio frequency signals;

a microprocessor;

an operating system executing on the microprocessor to provide an operating environment of application software;

a multi-service virtual private network (VPN) client registered with the operating system as a single application, wherein the multi-service VPN client comprises;

a security manager integrated within the multi-service VPN client to apply at least one security service to network packets;

a VPN handler having an interface to exchange the network packets with the security manager for application of the security service, wherein the VPN handler is configurable to operate in one of an enterprise mode or a non-enterprise mode, wherein in the enterprise mode the VPN handler establishes a VPN connection with a remote VPN security device and provides encryption services to securely tunnel the network packets between the cellular mobile device and the remote VPN security device, and wherein in the non-enterprise mode the VPN handler directs the network packets to the security manager without application of the encryption services and communicates the network packets to a packet-based network without tunneling the packets; and

a VPN control application that provides a unified user interface that allows a user to configure both the VPN handler and the security manager of the multi-service VPN client, to submit credentials, and to instruct the VPN handler to dynamically instantiate the VPN connection or deconstruct an existing VPN connection,

wherein upon establishing the VPN connection the VPN control application receives a web-based home page from the remote VPN security device via a Hypertext Transfer Protocol Secure (HTTPS) response,

wherein the VPN control application dynamically parses HyperText Markup Language (HTML) bookmark links from the HTTPS response and renders a bookmark window using input controls native to the cellular mobile device, where each of the input controls corresponds to a different one of the bookmarks parsed from the HTTPS response received from the remote VPN security device, and

wherein, upon selection of one of the input controls, the VPN control application formulates and outputs an appropriate HTTP string to the remote VPN security device as if a corresponding HTML link were selected by the user.

2. The cellular mobile device of claim 1, wherein the multi-service VPN client comprises a single distribution package.

3. The cellular mobile device of claim 1, wherein the VPN control application presents the unified user interface for configuring anti-virus settings and personal firewall settings of the security manager.

4. The cellular mobile device of claim 1,

wherein the security manager applies anti-virus and spyware services to the network packets,

wherein the security manager provides an interface by which the VPN handler determines whether a user of the cellular mobile device has activated and registered the security manager, and

wherein the VPN handler requires an affirmative indication from the security manager prior to establishing the VPN connection with the remote VPN security device.

5. The cellular mobile device of claim 1,

wherein the VPN handler comprises a host checker module that inventories a state of the cellular mobile device and builds a health status report, and

wherein the host checker outputs the health status report to the remote VPN security device prior to establishing the VPN connection for determining whether the cellular mobile device is compliant with corporate policies.

6. The cellular mobile device of claim 1, wherein the multi-service VPN client further comprises a data acceleration module that applies at least one acceleration service to the network packets from the VPN handler.

7. The cellular mobile device of claim 6, wherein the data acceleration module provides a local content cache.

8. The cellular mobile device of claim 6, wherein the data acceleration module provides a client-side decompression service that operates in conjunction with an upstream acceleration device to provide real-time, continuous pattern recognition and compression of data flows within the network packets.

9. The cellular mobile device of claim 6, wherein the data acceleration module provides application-specific protocol optimization for control flows within the network packets.

10. The cellular mobile device of claim 1, wherein the multi-service VPN client further comprises one or more collaboration components that process the packets from the VPN handler, wherein collaboration components provide collaboration services including at least one of a network meeting, a secure desktop or a document sharing service.

11. The cellular mobile device of claim 1,

wherein the VPN control application provides a user interface that allows a user to disable VPN connectivity, and

wherein, when VPN connectivity is disabled, the VPN handler exchanges the network packets with the operating system and transparently provides the packets to the security manager for application of the security service.

12. The cellular mobile device of claim 1,

wherein the VPN control application detects a bookmark within the HTTPS response that corresponds to a webmail for the user, and

wherein, upon detecting the bookmark for the webmail, the VPN control application dynamically constructs the user interface to have an input control for launching a native email client of the cellular mobile device to access the webmail without launching a web browser.

13. The cellular mobile device of claim 1, wherein the VPN handler and the VPN control application are configured to be independently upgradable.

14. The cellular mobile device of claim 1,

wherein the VPN handler establishes the VPN connection as an Internet Protocol Security (IPSec) connection over User Datagram Protocol (UDP), and

wherein the VPN handler includes a compression module that applies Lempel-Ziv (LZ) compression in conjunction with the IPSec connection to tunnel encrypted IP packets to the remote VPN security device.

15. The cellular mobile device of claim 1,

wherein the VPN handler establishes an Secure Socket Layer (SSL) control channel with the remote VPN security device and, upon a successful authentication, receives a session cookie with a unique identifier,

wherein, in the event communication with the secure VPN gateway is temporarily lost, the VPN handler performs a fast reconnect by issuing the session cookie to the remote VPN security device, and

wherein, when performing the fast reconnect, the VPN handler identifies a set of transport mechanisms currently available to the cellular mobile device and, when only a cellular network is available and not a wireless packet-based connection, the VPN handler defers the fast reconnect until application-layer data is received from a user application and ready to be sent via the VPN connection.

16. A method comprising:

receiving, with a cellular mobile device from an electronic repository, a single distribution software package that includes a multi-service network client, wherein the multi-service network client includes a virtual private network (VPN) handler, a security manager; and

a VPN control application that provides a unified user interface that allows a user to configure both the VPN handler and the security manager, to submit credentials, and to instruct the VPN handler to dynamically instantiate a secure VPN connection or deconstruct an existing secure VPN connection; and

installing the multi-service network client on the cellular mobile device including registering the VPN handler with an operating system of the cellular mobile device, wherein the VPN handler provides a single point of entry for network packets from the operating system to apply VPN services with the VPN handler and security services with the security manager;

when the multi-service network client is configured to operate within an enterprise mode, (a) establishing the secure VPN connection to a remote VPN security device of an enterprise, (b) providing encryption services with the VPN handler to network packets received from the operating system, (c) directing decrypted one of the network packets from the VPN

handler to the security manager for application of the security services, and (d) securely tunneling the network packets between the cellular mobile device and the remote VPN security device via the VPN connection;

when the multi-service network client is configured to operate within a non-enterprise mode, (e) receiving network packets from the operating system with the VPN handler, (f) directing the network packets from the VPN handler to the security manager for application of the security services without application of the encryption services, and (g) for communication the network packets to a packet-based network without tunneling the packets;

upon establishing the VPN, receiving a web-based home page from the remote VPN security device,

dynamically parsing, HyperText Markup Language (HTML) bookmark links from the home page and rendering a bookmark window using input controls native to the cellular mobile device, where each of the input controls corresponds to a different one of the bookmarks parsed from the HTTPS response received from the remote VPN security device, and

responsive to selection of one of the input controls, outputting an HTTP string to the remote VPN security device as if a corresponding HTML link were selected by the user.

17. The method of claim 16, wherein the multi-service network client comprises a single distribution package.

18. The method of claim 16, wherein the VPN control application presents the unified user interface for configuring anti-virus settings and personal firewall settings of the security manager.