Device and method for virtual private network connection establishment

• US 10,547,649 B2
• Filed: 09/08/2017
• Issued: 01/28/2020
• Est. Priority Date: 05/28/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Pauly, Thomas F.
• Primary Examiner(s): Vu, Viet D
• Application Number:
  US15/699,006
• Publication Number:
  US 20170374110A1
• Time in Patent Office: 872 Days
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

A method, client device and non-transitory computer readable storage medium for connecting to a virtual private network (VPN). A request to connect to a destination identified by a hostname is received from an application executed on the client device and a domain name system (DNS) lookup functionality is performed on the hostname, the DNS lookup functionality returning an address. It is then determined whether the returned address is a redirected address, whether a hypertext transmission protocol secure (HTTPS) probe configured for the hostname fails, or whether the returned address matches a cached route in which a transmission control protocol (TCP) connection establishment is unsuccessful. If any of the returned address is a redirected address, the HTTPS probe fails or the returned address matches the cached route and the TCP connection establishment is unsuccessful, the client device is connected to the VPN.

Claims

1. A method for use in virtual private network (VPN) communications, the method comprising:

at a client device;

receiving, from an application executed on the client device, a request to connect to a destination identified by a hostname;

performing a domain name system (DNS) lookup functionality on the hostname, the DNS lookup functionality returning an address,

determining whether the returned address is a redirected address based on whether the returned address matches an entry in a stored list of redirected addresses;

determining whether a hypertext transmission protocol secure (HTTPS) probe configured for the hostname fails;

determining whether the returned address matches a cached route in which a transmission control protocol (TCP) connection establishment is unsuccessful; and

connecting to a VPN when;

the returned address is a redirected address;

the HTTPS probe fails;

or

the returned address matches the cached route and the TCP connection establishment is unsuccessful.

2. The method of claim 1, wherein performing the DNS lookup functionality includes,

transmitting a DNS lookup to one or more trusted servers only, and

setting a DNS lookup timeout period based at least in part on one or more measured network parameters.

3. The method of claim 1, wherein the HTTPS probe failing is indicative of a second destination being unavailable in a public network, wherein the HTTPS probe succeeding is indicative of the second destination being publicly available on the public network.

4. The method of claim 3, wherein the TCP connection establishment being unsuccessful is indicative of the destination being unavailable in the public network, wherein the TCP connection establishment succeeding is indicative of a connection being established with the destination on the public network.

5. The method of claim 1, wherein determining whether the returned address is a redirected address includes:

generating, by the client device, the list of redirected addresses by;

sending a dummy hostname request;

receiving a return address in response to the dummy hostname request; and

storing, by the client device, in the list of redirected addresses, the return address received in response to the dummy hostname request.

6. The method of claim 1, wherein the stored list of redirected addresses comprises a least one address that redirects to at least one of a landing page or a further page.

7. The method of claim 1, wherein the stored list or redirected addresses is updated by the client device when the client device connects to a new network.

8. A client device, comprising:

communications circuitry; and

a processor,

wherein the processor and communications circuitry are configured to establish a connection to a virtual private network (VPN) by;

receiving, from an application executed on the client device, a request to connect to a destination identified by a hostname;

performing a domain name system (DNS) lookup functionality on the hostname, the DNS lookup functionality returning an address,

determining whether the returned address is a redirected address based on whether the returned address matches an entry in a stored list of redirected addresses;

determining whether a hypertext transmission protocol secure (HTTPS) probe configured for the hostname fails;

determining whether the returned address matches a cached route in which a transmission control protocol (TCP) connection establishment is unsuccessful; and

connecting to a VPN when;

the returned address is a redirected address;

the HTTPS probe fails;

or

the returned address matches the cached route and the TCP connection establishment is unsuccessful.

9. The client device of claim 8, wherein performing the DNS lookup functionality includes the processor and the communications circuitry;

transmitting a DNS lookup to one or more trusted servers only, and

setting a DNS lookup timeout period based at least in part on one or more measured network parameters.

10. The client device of claim 8, wherein the HTTPS probe failing is indicative of a second destination being unavailable in a public network, wherein the HTTPS probe succeeding is indicative of the second destination being publicly available on the public network.

11. The client device of claim 10, wherein the TCP connection establishment being unsuccessful is indicative of the destination being unavailable in the public network, wherein the TCP connection establishment succeeding is indicative of a connection being established with the destination on the public network.

12. The client device of claim 8, wherein the processor and the communications circuitry is further configured to:

generate the list of redirected addresses by;

send a dummy hostname request;

receive a return address in response to the dummy hostname request, wherein

a memory arrangement stores in the list of redirected addresses, the return address received in response to the dummy hostname request.

13. The client device of claim 8, wherein the stored list of redirected addresses comprises a least one address that redirects to at least one of a landing page or a further page.

14. The client device of claim 8, wherein the stored list or redirected addresses is updated by the client device when the client device connects to a new network.

15. A non-transitory computer readable storage medium with an executable program stored thereon, wherein the program instructs a microprocessor to perform operations comprising:

receiving, from an application executed on a client device, a request to connect to a destination identified by a hostname;

performing a domain name system (DNS) lookup functionality on the hostname, the DNS lookup functionality returning an address,

determining whether the returned address is a redirected address based on whether the returned address matches an entry in a stored list of redirected addresses;

determining whether a hypertext transmission protocol secure (HTTPS) probe configured for the hostname fails;

determining whether the returned address matches a cached route in which a transmission control protocol (TCP) connection establishment is unsuccessful; and

connecting to a VPN when;

the returned address is a redirected address;

the HTTPS probe fails;

or

the returned address matches the cached route and the TCP connection establishment is unsuccessful.

16. The non-transitory computer readable storage medium of claim 15, wherein performing the DNS lookup functionality includes the microprocessor performing operations comprising;

transmitting a DNS lookup to one or more trusted servers only, and

setting a DNS lookup timeout period based at least in part on one or more measured network parameters.

17. The non-transitory computer readable storage medium of claim 15, wherein the HTTPS probe failing is indicative of a second destination being unavailable in a public network, wherein the HTTPS probe succeeding is indicative of the second destination being publicly available on the public network.

18. The non-transitory computer readable storage medium of claim 17, wherein the TCP connection establishment being unsuccessful is indicative of the destination being unavailable in the public network, wherein the TCP connection establishment succeeding is indicative of a connection being established with the destination on the public network.

19. The non-transitory computer readable storage medium of claim 15, wherein the microprocessor further performs operations comprising:

generating the list of redirected addresses by;

sending a dummy hostname request;

receiving a return address in response to the dummy hostname request, and

storing, in the list of redirected addresses, the return address received in response to the dummy hostname request.

20. The non-transitory computer readable storage medium of claim 15, wherein the stored list of redirected addresses comprises a least one address that redirects to at least one of a landing page or a further page.