Method and system to enable a virtual private network client

• US 10,243,947 B2
• Filed: 01/03/2017
• Issued: 03/26/2019
• Est. Priority Date: 04/01/2014
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Albisu, Luis Francisco
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas A
• Application Number:
  US15/396,987
• Publication Number:
  US 20170118199A1
• Time in Patent Office: 812 Days
• CPC Class Codes: H04L 12/2858 Access network architectures
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 92/10 between terminal device and access point, i.e. wireless air interface

Abstract

Aspects of the subject disclosure may include, for example, a method comprising transmitting, by a controller comprising a processor, a request to a server to enable initiation of a virtual private network session on behalf of devices other than the controller. The controller transmits authentication information to enable the server to validate the request, and receives a first list of computing devices. The controller transmits a first selection of a target device from the first list to cause the server to initiate the virtual private network session between the target device and a service node providing services to the target device via the virtual private network session. The controller receives a second list of applications executable on each of the computing devices, and transmits to the server a second selection of an application from the second list that is executable by the target device. Other embodiments are disclosed.

Claims

1. A device comprising:

a processing system including a processor; and

a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations comprising;

provisioning a client device with a virtual private network (VPN) service, wherein the provisioning is performed responsive to a request transmitted from a mobile device other than the client device, wherein the mobile device is not communicatively coupled to the client device at a time the request is transmitted, and wherein the provisioning includes;

transmitting authentication information to the client device, and

configuring the client device with a device certificate;

receiving polling from the client device regarding whether a VPN connection request is pending at the processing system; and

in accordance with a VPN connection request being pending;

signaling the client device, responsive to the polling, that a VPN connection is ready, and

initiating a VPN session at the client device, responsive to the client device initiating a tunnel to the processing system.

2. The device of claim 1, wherein the operations further comprise initiating an authentication process for the mobile device.

3. The device of claim 2, wherein the authentication process includes receiving data from the mobile device via a first encrypted stream.

4. The device of claim 3, wherein the authentication process includes transmitting a second encrypted stream to the mobile device, the second encrypted stream including a list of a plurality of applications executable at the client device in the VPN session.

5. The device of claim 4, wherein the operations further comprise receiving from the mobile device a selection of an application from the plurality of applications, and wherein the VPN session is limited to the selected application.

6. The device of claim 3, wherein the authentication process includes transmitting a third encrypted stream to the mobile device, the third encrypted stream including a list of devices authorized for a VPN connection.

7. The device of claim 1, wherein the polling is performed at a preset interval.

8. The device of claim 1, wherein the polling is performed responsive to a user input at the client device.

9. The device of claim 1, wherein the configuring is performed using a public-key infrastructure.

10. The device of claim 1, wherein the client device comprises a display indicating a status of the VPN connection.

11. A method comprising:

provisioning, by a processing system including a processor, a client device with a virtual private network (VPN) service, wherein the provisioning includes;

transmitting authentication information to the client device, and

configuring the client device with a device certificate;

receiving, by the processing system, polling from the client device regarding whether a VPN connection request is pending at the processing system; and

in accordance with a VPN connection request being pending;

signaling, by the processing system and responsive to the polling, that a VPN connection is ready, and

initiating, by the processing system, a VPN session at the client device, responsive to the client device initiating a tunnel to the processing system,

wherein the provisioning is performed responsive to a request transmitted from a mobile device other than the client device, wherein the mobile device is not communicatively coupled to the client device, and wherein the configuring is performed using a public-key infrastructure.

12. The method of claim 11, further comprising initiating, by the processing system, an authentication process for the mobile device, wherein the authentication process includes receiving data from the mobile device via a first encrypted stream.

13. The method of claim 12, wherein the authentication process includes transmitting, by the processing system, a second encrypted stream to the mobile device, the second encrypted stream including a list of a plurality of applications executable at the client device in the VPN session.

14. The method of claim 11, wherein the polling is performed at a preset interval.

15. The method of claim 11, wherein the polling is performed responsive to a user input at the client device.

16. A non-transitory machine-readable medium comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations comprising:

provisioning a client device with a virtual private network (VPN) service, wherein the provisioning is performed responsive to a request transmitted from a mobile device other than the client device, wherein the mobile device is not communicatively coupled to the client device, and wherein the provisioning includes;

transmitting authentication information to the client device, and

configuring the client device with a device certificate using a public-key infrastructure;

receiving polling from the client device regarding whether a VPN connection request is pending at the processing system; and

in accordance with a VPN connection request being pending;

signaling the client device, responsive to the polling, that a VPN connection is ready, and

initiating a VPN session at the client device.

17. The non-transitory machine-readable medium of claim 16, wherein the VPN session is initiated responsive to the client device initiating a tunnel to the processing system.

18. The non-transitory machine-readable medium of claim 16, wherein the operations further comprise initiating an authentication process for the mobile device.

19. The non-transitory machine-readable medium of claim 18, wherein the authentication process includes receiving data from the mobile device via a first encrypted stream.

20. The non-transitory machine-readable medium of claim 19, wherein the authentication process includes transmitting a second encrypted stream to the mobile device, the second encrypted stream including a list of a plurality of applications executable at the client device in the VPN session.