Smart tunneling to resources in a network

• US 20070061887A1
• Filed: 03/07/2006
• Published: 03/15/2007
• Est. Priority Date: 12/10/2003
• Status: Active Grant

• Current Assignee: Aventail LLC
• Original Assignee: Aventail Corporation (SonicWall Holdings Ltd.)
• Inventors: Sauve, Bryan, Hoover, Paul, Erickson, Rodger
• Granted Patent: US 8,661,158 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 45/021 Ensuring consistency of routing table updates, e.g. by using epoch numbers
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

A client computer hosts a virtual private network tool to establish a virtual private network connection with a remote network. Upon startup, the virtual private network tool collects critical network information for the client computer, and sends this critical network information to an address assignment server in the remote network. The address assignment server compares the critical network information with a pool of available addresses in the remote network, and assigns addresses for use by the client computer that do not conflict with the addresses for local resources. The address assignment server also provides routing information for resources in the remote network to the virtual private network tool. The virtual private network tool will postpone loading this routing information into the routing tables of the client computer until the client computer requests access to a specific resource in the remote network. When the client computer requests access to a specific resource in the remote network, the virtual private network tool will only provide the routing table with the routing information for that specific remote resource.

Claims

1. A method of establishing communication between a client computer and a network remote from the client computer, comprising:

receiving critical network information for a client computer;

comparing the received critical network information with a pool of available network addresses in a network remote from the client computer, to identify at least one available network address that does not conflict with the critical network information; and

providing the at least one non-conflicting available network address to the client computer for use in communicating with the remote network.

2. A method of establishing communication between a client computer and a network remote from the client computer, comprising:

collecting critical network information for a client computer;

providing the critical network information to a server for comparison with a pool of available network addresses in a network remote from the client computer, to identify at least one available network address that does not conflict with the critical network information;

receiving the at least one non-conflicting available network address; and

employing the at least one non-conflicting available network address to communicate with the remote network.

3. A method of providing a client computer with access to a resource in a remote network, comprising:

receiving resource information identifying a resource in a remote network;

receiving a request to access the resource from an application hosted by the client computer;

in response to the request, using the resource information to add routing information to a routing table employed by the client computer for routing communications from the client computer to the resource.

4. A method of providing a client computer with access to a resource in a remote network, comprising:

receiving resource information identifying a resource in a remote network;

receiving a communication from the resource to an application hosted by the client computer;

identifying the resource from the received communication; and

in response to identifying the resource from the received communication, using the resource information to add routing information to a routing table employed by the client computer for routing communications from a client computer to the resource.

5. A method of providing a client computer with access to a resource in a remote network, comprising:

receiving one or more routing rules, each routing rule being associated with a corresponding resource in a remote network and including,

resource information identifying the remote resource, and

permission information for determining when routing information for the remote resource will be added to a routing table employed by a client computer;

receiving a request to access a resource from an application hosted by the client computer;

in response to the request, determining if the requested resource corresponds to resource information in at least one of the routing rules;

if the requested resource corresponds to resource information in at least one of the routing rules, determining if the permission information in the at least one routing rule allows routing information for the remote resource to be added to the routing table employed by the client computer; and

if the permission information in the at least one routing rule allows routing information for the remote resource to be added to the routing table employed by the client computer, adding routing information for the remote resource to be added to the routing table employed by the client computer.

6. A method of providing a client computer with access to a resource in a remote network, comprising:

receiving first resource information identifying a resource in a remote network;

receiving a reply to a first request to access a resource from an application hosted by the client computer, the reply including second resource information identifying the resource;

receiving a second request to access the resource from the application; and

in response to receiving the second request, using the second resource information to add routing information to a routing table employed by the client computer for routing communications from the client computer to the resource.

7. A method of providing a client computer with access to a resource in a remote network, comprising:

receiving one or more routing rules, each routing rule being associated with a corresponding resource in a remote network and including,

a resource name identifying the remote resource, and

permission information associated with the resource, for determining when routing information for the remote resource will be added to a routing table employed by a client computer;

receiving a reply to a request to access a resource from an application hosted by the client computer, the reply including

a name identifying the requested resource, and

one or more network addresses for the requested resource;

in response to receiving the reply, determining if the name identifying the requested resource matches a resource name in at least one of the routing rules; and

if the name identifying the requested resource matches a resource name in at least one of the routing rules, generating a new routing rule for each of the network addresses that contains

one of the one or more network address for the requested resource, and

the permission information contained in the at least one of the routing rules.

8. An address assignment server system, comprising:

an address pool of available network addresses in a network remote from a client computer; and

an address assignment server that

receives critical network information from the client computer

compares the received critical network information with the address pool to identify at least one available network address that does not conflict with the critical network information; and

provides the at least one non-conflicting available network address to the client computer for use in communicating with the remote network.

9. A computer, comprising:

a physical network interface;

an application; and

a virtual private network tool that

collects critical network information associated with the physical network interface;

provides the critical network information to a server for comparison with a pool of available network addresses in a network remote from the computer, to identify at least one available network address that does not conflict with the critical network information,

receives the at least one non-conflicting available network address, and

employs the non-conflicting available network address to communicate with the remote network.

10. A computer, comprising:

an application;

a routing table; and

a virtual private network tool that

receives resource information identifying a resource in a remote network,

receives a request to access the resource from the application, and

in response to the request, uses the resource information to add routing information to the routing table.