A METHOD AND SYSTEMS FOR SECURING REMOTE ACCESS TO PRIVATE NETWORKS

• US 20060037071A1
• Filed: 07/22/2005
• Published: 02/16/2006
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Brueggemann, Eric R., Rodriguez, Robert A.
• Granted Patent: US 8,291,119 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for securing remote access to private networks includes a receiver intercepting from a data link layer a packet in a first plurality of packets destined for a first system on a private network. A filter intercepts from the data link layer a packet in a second plurality of packets transmitted from a second system on the private network, destined for an system on a second network. A transmitter in communication with the receiver and the filter performing a network address translation on at least one intercepted packet and transmitting the at least one intercepted packet to a destination.

Claims

1. A device for routing packets comprising:

a receiver intercepting from a data link layer a packet in a first plurality of packets destined for a first system on a private network;

a filter intercepting from the data link layer a packet in a second plurality of packets transmitted from a second system on the private network, destined for a system on a second network; and

a transmitter in communication with the receiver and the filter performing a network address translation on at least one intercepted packet and transmitting the at least one intercepted packet to a destination.

2. The device of claim 1, further comprising an addressing element associating a private IP address with a system having a public IP address.

3. The device of claim 1, further comprising a policy engine, in communication with the filter and the receiver, applying policy to an intercepted packet.

4. The device of claim 1, further comprising a policy engine, in communication with the filter and the receiver, applying an access control list to an intercepted packet.

5. The device of claim 1, wherein the transmitter transmits the at least one intercepted packet across a communications tunnel to the system on the second network.

6. The device of claim 1, wherein the transmitter transmits the at least one intercepted packet across a secure Transmission Control Protocol (TCP) connection to the system on the second network.

7. The device of claim 1, wherein the transmitter performs a reverse network address translation on the at least one intercepted packet.

8. The device of claim 1, wherein the transmitter transmits a remote process to the system on the second network.

9. The device of claim 1, wherein the receiver further comprises intercepting from the data link layer a real-time packet in a first plurality of real-time packets destined for a first system on a private network.

10. The device of claim 1, wherein the filter further comprises intercepting from the data link layer a real-time packet in a second plurality of real-time packets transmitted from a second system on the private network, destined for an system on a second network.

11. The device of claim 1, wherein the receiver further comprises intercepting from the data link layer a User Datagram Protocol (UDP) packet in a first plurality of User Datagram Protocol (UDP) packets destined for a first system on a private network.

12. The device of claim 1, wherein the filter further comprises intercepting from the data link layer a User Datagram Protocol (UDP) packet in a second plurality of User Datagram Protocol (UDP) packets transmitted from a second system on the private network, destined for a system on a second network.

13. A method of routing packets, comprising:

(a) intercepting from a data link layer a packet in a first plurality of packets destined for a first system on a private network;

(b) intercepting from the data link layer a packet in a second plurality of packets transmitted from a second system on the private network, destined for a system on a second network;

(c) performing a network address translation on at least one intercepted packet; and

(d) transmitting the at least one intercepted packet to a destination.

14. The method of claim 13, further comprising the step of associating a private IP address with a system having a public IP address.

15. The method of claim 13, further comprising the step of applying policy to an intercepted packet.

16. The method of claim 13, further comprising the step of applying an access control list to an intercepted packet.

17. The method of claim 13, wherein step (d) further comprises transmitting the at least one intercepted packet across a communications tunnel to the system on the second network.

18. The method of claim 13, wherein step (d) further comprises transmitting the at least one intercepted packet across a secure Transmission Control Protocol (TCP) connection to the system on the second network.

19. The method of claim 13, wherein step (d) further comprises performing a reverse network address translation on the at least one intercepted packet.

20. The method of claim 13, wherein step (d) further comprises transmitting a remote process to the system on the second network.

21. The method of claim 13, wherein step (a) further comprises intercepting from the data link layer a real-time packet in a first plurality of real-time packets destined for a first system on a private network.

22. The method of claim 13, wherein step (b) further comprises intercepting from the data link layer a real-time packet in a second plurality of real-time packets transmitted from a second system on the private network, destined for an system on a second network.

23. The method of claim 13, wherein step (a) further comprises intercepting from the data link layer a User Datagram Protocol (UDP) packet in a first plurality of User Datagram Protocol (UDP) packets destined for a first system on a private network.

24. The method of claim 13, wherein step (b) further comprises intercepting from the data link layer a User Datagram Protocol (UDP) packet in a second plurality of User Datagram Protocol (UDP) packets transmitted from a second system on the private network, destined for an system on a second network.