A METHOD AND SYSTEMS FOR ROUTING PACKETS FROM AN ENDPOINT TO A GATEWAY

• US 20060029064A1
• Filed: 07/22/2005
• Published: 02/09/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Granted Patent: US 7,606,902 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for routing packets from an endpoint to a gateway includes the step of receiving a filtering table. An outbound packet is intercepted. The outbound packet is transmitted to a client application, responsive to the filtering table. The client application transmits the outbound packet to a gateway responsive to an application of a policy to the outbound packet.

Claims

1. A method for routing packets from an endpoint to a gateway, the method comprising:

(a) receiving a filtering table;

(b) intercepting an outbound packet;

(c) transmitting the outbound packet to a client application, responsive to the filtering table; and

(d) transmitting, by the client application, the outbound packet to a gateway responsive to an application of a policy to the outbound packet.

2. The method of claim 1, wherein step (a) further comprises receiving the filtering table from a client application.

3. The method of claim 1, wherein step (c) further comprises transmitting information about the outbound packet to the client application.

4. The method of claim 1, wherein step (c) further comprises transmitting the outbound packet to the client application, responsive to a routing table.

5. The method of claim 1, wherein step (c) further comprises transmitting the outbound packet to a port monitored by the client application.

6. The method of claim 1, wherein step (d) further comprises authentication, by the client application, of the endpoint to the gateway.

7. The method of claim 1, wherein step (d) further comprises encrypting, by the client application, the outbound packet.

8. The method of claim 1, wherein step (d) further comprises establishing, by the client application, a secure sockets layer (SSL) tunnel to the gateway.

9. The method of claim 1, further comprising the step of transmitting an encrypted outbound packet to a gateway via an SSL tunnel to the gateway.

10. A device for routing packets to a gateway, the device comprising:

a filter intercepting an outbound packet and transmitting the outbound packet, responsive to a filter table; and

a client application, in communication with the filter, receiving the outbound packet, and determining to transmit the outbound packet to a gateway, responsive to applying a policy to the outbound packet.

11. The device of claim 10, wherein the filter comprises a driver.

12. The device of claim 11, wherein the driver complies with a Network Driver Interface Specification (NDIS).

13. The device of claim 10, wherein the filter transmits the outbound packet to the client application, responsive to a routing table.

14. The device of claim 10, wherein the filter and the client application reside on a computer system.

15. The device of claim 10, wherein the filter is a process.

16. The device of claim 15, wherein the filter process executes in kernel mode.

17. The device of claim 10, wherein the client application is a process

18. The device of claim 17, wherein the client application process executes in user mode.

19. A system for routing packets to a gateway, the system comprising:

a computer system, comprising a kernel and an application space, receiving at least one outbound packet; and

a device, in communication with the computer system, comprising;

a filter intercepting an outbound packet and transmitting the outbound packet, responsive to a filter table; and

a client application, in communication with the filter, receiving the outbound packet, and determining to transmit the outbound packet to a gateway, responsive to applying a policy to the outbound packet.

20. The system of claim 19, wherein the filter comprises a driver.

21. The system of claim 20, wherein the driver complies with a Network Driver Interface Specification (NDIS).

22. The system of claim 19, wherein the filter transmits the outbound packet to the client application, responsive to a routing table.

23. The system of claim 19, wherein the filter and the client application reside on a computer system.

24. The system of claim 19, wherein the filter is a process.

25. The system of claim 24, wherein the filter process executes in kernel mode.

26. The system of claim 19, wherein the client application is a process 27. The system of claim 26, wherein the client application process executes in user mode.