Virtual private network software system

• US 20020199007A1
• Filed: 05/21/2002
• Published: 12/26/2002
• Est. Priority Date: 06/12/2001
• Status: Active Grant

• Current Assignee: Varian Medical Systems Incorporated (Siemens AG)
• Original Assignee: Varian Medical Systems Technologies Inc (Siemens AG)
• Inventors: Rakes, Richard Bruce, Clayton, Tom
• Granted Patent: US 7,216,173 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A virtual private network service provider, wherein virtual private network (“VPN”) software for setting up a virtual private network connection is delivered from a server computer to one or more client computers over a computer network, such as the Internet. Once the VPN software is delivered to the client computers, it can be executed so that data communications are made as virtual private network communications under control of the VPN software. Because the VPN software is stored and maintained on a server computer, and preferably delivered to the various client computers on an as-needed basis, the distribution, integrity and updating of the VPN software is improved because the “master” version of the VPN software can be controlled and revised by merely accessing the server computer system, rather than by attempting to control and revise numerous copies of the VPN software resident on various, scattered client computers.

Claims

1. A computer network communication system comprising:

a client computer system;

a first computer network; and

a server computer system comprising;

a storage device, with VPN software being stored on the storage device, and

VPN server software for communicating the VPN software to the client computer system over the first network, with the VPN software being executable by the client computer system;

wherein the VPN software comprises machine readable instructions and data for;

restructuring first-network-unready machine readable data at the client computer system into corresponding first-network-ready machine readable data, and

sending the first-network-ready data from the client computer system to a destination computer system over the first computer network.

2. The computer network communication system of claim 1 wherein:

the first-network-unready machine readable data is structured according to a first protocol; and

the first-network-ready machine readable data is structured according to a second protocol, with the second protocol being different than the first protocol.

3. The computer network communication system of claim 2 wherein the first protocol is different than the second protocol at least because different communication ports are specified.

4. The computer network communication system of claim 2 wherein the differences between the first protocol and the second protocol occur at the Transport layer or higher.

5. The computer network of claim 1 wherein the destination computer system is the server computer system.

6. The computer network of claim 1 wherein the client computer system comprises:

a second computer network;

a VPN client computer; and

a source computer, with the source computer being structured to send the first-network-unready data to the VPN client computer over the second network.

7. The computer network of claim 6 wherein:

the source computer is structured to send the first-network-unready data such that the first-network-unready data comprises destination data which corresponds to a destination for the data;

the destination data indicates a destination other than the VPN client computer; and

the VPN software further comprises machine readable proxy instructions for causing the VPN client computer from receiving the first-network-unready data despite the destination data'"'"'s indication that the destination of the first-network-unready data is other than the VPN client computer.

8. The computer network communication system of claim 1 wherein:

the client computer system further comprises browser software comprising machine readable instructions for encrypting data; and

the VPN software further comprises machine readable instructions for utilizing the encryption capability of the browser software to encrypt the first-network-ready data when the execution of the VPN software by the client computer restructures the first-network-unready data into corresponding first-network-ready data.

9. The computer network communication system of claim 8 wherein:

the browser is an Internet browser; and

the encryption is SSL encryption.

10. The computer network communication system of claim 1 further comprising VPN server software for subsequent communication with the VPN software on the client computer system.

11. The computer network communication system of claim 1 wherein the client computer system includes a plurality of clients.

12. The computer network communication system of claim 1 wherein the server computer system includes a plurality of servers.

13. The computer network communication system of claim 1 wherein:

the client computer system includes a plurality of clients; and

the server computer system includes a plurality of servers

15. The computer network communication system of claim 14 wherein:

the VPN software further comprises machine readable instructions and data for restructuring the first-network-ready data received over the unsolicited-input connection into corresponding second-network-ready data;

the first-network-ready machine readable data is structured according to a first protocol; and

the second-network-ready machine readable data is structured according to a second protocol, with the second protocol being different than the first protocol.

16. The computer network communication system of claim 15 wherein:

the first protocol is a protocol adapted for data communications over a public network; and

the second protocol is a protocol adapted for data communications over a private network.

17. The computer network communication system of claim 14 wherein:

the first protocol is a TCP/IP protocol at a first layer; and

the second protocol is DICOM at a second layer.

18. The computer network communication system of claim 14 wherein the client computer system comprises:

a second computer network;

a VPN client computer; and

a destination computer, with the destination computer being structured to receive the second-network-ready data from the VPN client computer over the second network.

19. The computer network communication system of claim 14 wherein the first-network-ready data is sent to the client computer system over the first network by the server computer system.

20. The computer network communication system of claim 14 wherein:

the client computer system further comprises browser software comprising machine readable instructions for decrypting data; and

the VPN software further comprises machine readable instructions for utilizing the decryption capability of the browser software to decrypt the first-network-ready data when the execution of the VPN software by the client computer restructures the first-network-unready data into corresponding second-network-ready data.

21. The computer network communication system of claim 20 wherein:

the browser is an Internet browser; and

the encryption is SSL encryption.

14. A computer network communication system comprising:

a client computer system;

a first computer network; and

a server computer system comprising;

a storage device, VPN software stored on the storage device, and

VPN server software for communicating the VPN software to a client computer system over the first network, with the VPN software being executable by the client computer system;

wherein the VPN software comprises machine readable instructions and data for causing the client computer to set up an unsolicited-input connection with the first network such that the client computer will receive first-network-ready machine readable data from the first network over the unsolicited-input connection, regardless of whether the first-network ready data has been requested by the client computer system.

22. A computer network communication system comprising:

a private computer network;

a proxy client computer;

a source computer in data communicative connection with the proxy client computer over the private computer network, with the source computer being structured to send a first data communication over the private computer network, with the first data communication including destination data indicative of the intended destination of the first data communication, and with the destination being a location that is not present on the private network;

a public computer network;

a server computer system in data communicative connection with the proxy client computer over the public computer network, with the server computer system comprising;

a storage device, proxy software stored on the storage device, and

proxy server software for communicating the proxy software to the proxy client computer system over the public network;

wherein the proxy software is executable by the proxy client computer system, the proxy software comprises machine readable instructions and data for proxying the first data communication to allow the first data communication to be sent from the source computer to the proxy client computer.

23. The computer network communication system of claim 22 wherein the proxy software comprises machine readable instructions and data for:

restructuring first data communication into a corresponding second data communication, with the second data communication being adapted to be sent by the proxy client computer over the public network; and

sending the second data communication from the proxy client computer to the server computer system over the public network.

25. The method of claim 24 wherein:

the step of restructuring the first data communication into the corresponding second data communication includes encryption of the data of the first data communication so that the second data communication is an encrypted data communication; and

the step of restructuring the second data communication into the corresponding third data communication includes decryption of the data of the second data communication so that the third data communication is a decrypted data communication.

26. The method of claim 25 wherein:

the first client computer system comprises encryption software, which encryption software is included in preexisting browser software stored in the first client computer system;

the encryption of the first data communication is accomplished through invocation of the encryption software by the downloaded VPN software at the first client computer system;

the second client computer system comprises decryption software, which decryption software is included in preexisting browser software stored in the second client computer system; and

the decryption of the second data communication is accomplished through invocation of the encryption software by the downloaded VPN software at the second client computer system.

27. The method of claim 24 wherein the first protocol is the same as the third protocol.

28. The method of claim 24 wherein the first client computer system comprises a source computer, a first VPN client computer and a private network, the method further comprising the following steps:

generating the first data communication the source computer; and

sending the first data communication from the source computer to the first VPN client computer over the private network.

29. The method of claim 28 wherein:

the generating step includes the step of providing the first data communication with destination information;

the destination information indicates a destination for the first data communication that is located in the second client computer system; and

in the sending the first data communication step, the first VPN client computer, under control of the VPN software, receives the first data communication as a proxy for the destination indicated in the destination information.

30. The method of claim 24 wherein the sending the second data communication steps includes the sub-steps of:

sending the second data communication from the first client computer system to the VPN server computer system over the public network; and

sending the second data communication from the VPN server computer system to the second client computer system over the public network.

31. The method of claim 24 wherein the sending the second data communication steps includes the sub-step of:

sending the second data communication from the first client computer system to the second client computer system over the public network without sending the second data communication over the VPN server computer system.

32. The method of claim 30 further comprising the step of:

prior to the sub-step of sending the second data communication from the VPN computer system, establishing an unsolicited-input connection such that the VPN server computer system can initiate the transfer of the second data communication to the second client computer system.

33. The method of claim 32 wherein the unsolicited-input connection is established by issuing GET commands on an open socket.

35. The method of claim 34 wherein the communication software is a port proxy.

36. The method of claim 34 wherein:

the communication software is virtual private network (VPN) software; and

the network data communication is an encrypted communication.

37. The method of claim 34 wherein:

the communication software is virtual private network service (VPNSP) software; and

the network data communication is an encrypted communication; and

the network data communication is routed through a service provider site.

38. The method of claim 34 wherein the communication software modifies a machine identification code present in the network data communication.

39. The method of claim 34 wherein the communication software encrypts the network data communication using encryption software resident on the second computer, but which encryption software is not included in the communication software downloaded at the downloading step.

40. The method of claim 34 wherein the communication software modifies a port number code present in the network data communication.

41. The method of claim 34 wherein the communication software modifies an originating IP address present in the network data communication.

42. The method of claim 34 wherein the communication software modifies a destination IP address present in the network data communication.

43. The method of claim 34 wherein the communication software modifies a protocol of the network communication software at an application layer level or at a higher level.

44. The method of claim 34 wherein the communication software is downloaded, at the downloading step, in the form of an applet.

46. The computer network communication system of claim 45, wherein the downloading is second type automatic.

48. The computer network communication system of claim 45, wherein the communication software is router software.

49. The computer network communication system of claim 48, wherein the router software is VPN software.

50. The computer network communication system of claim 48, wherein the router software is VPNSP software.

24. A method of communicating machine readable data over a computer network comprising the steps of:

storing and maintaining VPN software on a VPN server computer system, with the server computer system being in data communication with a public computer network;

downloading a copy of the VPN software from the VPN server computer system to a first client computer system over the public computer network;

downloading a copy of the VPN software from the VPN server computer system to a second client computer system over the public computer network;

restructuring, at the first client computer system under the control of the downloaded VPN software, a first data communication of machine readable data structured according to a first protocol into a corresponding second data communication of machine readable data structured according to a second protocol, with the first protocol being unsuitable for communication over the public network, and with the second protocol being suitable for communication over the public computer network;

sending the second data communication from the first client computer system to the second client computer system over the computer network;

restructuring, at the second client computer system under the control of the downloaded VPN software, the second data communication into a corresponding third data communication of machine readable data structured according to a third protocol, with the third protocol being unsuitable for communication over the public network.

34. A method of making network communications comprising the following steps:

providing network communication software at a first computer;

downloading the communication software from the first computer to a second computer, which is remote from the first computer, over a computer network; and

executing the communication software at the second computer to make a network data communication.

45. A computer network communication system comprising:

a client computer system;

a first computer network; and

a server computer system comprising;

a storage device, with communication software being stored on the storage device, and

communication server software for communicating the communication software to the client computer system over the first network, with the communication software being executable by the client computer system;

wherein the communication software comprises machine readable instructions and data for;

restructuring first-network-unready machine readable data at the client computer system into corresponding first-network-ready machine readable data,

sending the first-network-ready data from the client computer system to a destination computer system over the first computer network, and

downloading a copy of the communication software from the server computer system to the client computer system, wherein the downloading is first type automatic.

47. A computer network communication system comprising:

a client computer system;

a first computer network; and

a server computer system comprising;

a storage device, with communication software being stored on the storage device, and

communication server software for communicating the communication software to the client computer system over the first network, with the communication software being executable by the client computer system;

wherein the communication software comprises machine readable instructions and data for;

restructuring first-network-unready machine readable data at the client computer system into corresponding first-network-ready machine readable data,

sending the first-network-ready data from the client computer system to a destination computer system over the first computer network, and

downloading a copy of the communication software from the server computer system to the client computer system, wherein the downloading is third type automatic.