Systems and Methods for Application Based Interception SSI/VPN Traffic

• US 20080034418A1
• Filed: 08/03/2006
• Published: 02/07/2008
• Est. Priority Date: 08/03/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Soni, Ajay, Venkatraman, Charu, Harris, James, He, Junxiao, Mullick, Amarnath, Nanjundaswami, Shashi
• Granted Patent: US 8,495,181 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for intercepting, by an agent of a client, communications from the client to be transmitted via a virtual private network connection includes the step of intercepting communications based on identification of an application from which the communication originates. The agent receives information identifying a first application. The agent determines a network communication transmitted by the client originates from the first application and intercepts that communication. The agent transmits the intercepted communication via the virtual private network connection.

Claims

1. A method for an agent of a client to intercept communications from the client to be transmitted via a virtual private network connection based on identification of the application, the method comprising the steps of:

(a) receiving, by an agent of a client of a first network, information identifying a first application from which to intercept network communications for transmission via a virtual private network connection established by an appliance to a second network;

(b) determining, by the agent, a network communication from a plurality of network communications transmitted by the client originates from the first application;

(c) intercepting, by the agent, the network communication of the first application; and

(d) transmitting, by the agent, the network communication of the first application via the virtual private network connection to the second network.

2. The method of claim 1, comprising determining, by the agent, a second network communication from the plurality of network communications originates from a second application on the client, and not intercepting the network communication.

3. The method of claim 2, comprising transmitting, by the client, the second network communication via the first network.

4. The method of claim 1, comprising transmitting, by the appliance, the information to the agent.

5. The method of claim 1, comprising transmitting, by the appliance, to the agent a name of the first application.

6. The method of claim 1, comprising intercepting, by agent, network communications of a first set of applications on the client identified for transmission via the virtual private network connection, and not intercepting, by the agent, network communications of a second set of one or more applications on the client.

7. The method of claim 1, comprising establishing, by the agent, the virtual private network connection to the second network via an appliance.

8. The method of claim 7, comprising one of granting or denying, by the appliance, a level of access to the first application based on identification of the first application.

9. The method of claim 8, comprising transmitting, by the agent, to the appliance an identification of the first application.

10. A system for an agent of a client to intercept communications from the client to be transmitted via a virtual private network connection based on identification of the application, the system comprising:

a means for receiving, by an agent of a client of a first network, information identifying a first application from which to intercept network communications for transmission via a virtual private network connection established by an appliance to a second network;

a means for determining, by the agent, a network communication from a plurality of network communications transmitted by the client originates from the first application;

a means for intercepting, by the agent, the network communication of the first application; and

a means for transmitting, by the agent, the network communication of the first application via the virtual private network connection to the second network.

11. The system of claim 10, comprising a means for determining, by the agent, a second network communication from the plurality of network communications originates from a second application on the client, and not intercepting the network communication.

12. The system of claim 11, comprising a means for transmitting, by the client, the second network communication via the first network.

13. The system of claim 10, comprising a means for transmitting, by the appliance, the information to the agent.

14. The system of claim 10, comprising a means for transmitting, by the appliance, to the agent a name of the first application.

15. The system of claim 10, comprising a means for intercepting, by agent, network communications of a first set of applications on the client identified for transmission via the virtual private network connection, and not intercepting, by the agent, network communications of a second set of one or more applications on the client.

16. The system of claim 10, comprising a means for establishing, by the agent, the virtual private network connection to the second network via an appliance.

17. The system of claim 16, comprising a means for one of granting or denying, by the appliance, a level of access to the first application based on identification of the first application.

18. The system of claim 17, comprising a means for transmitting, by the agent, to the appliance an identification of the first application.