METHOD AND SYSTEM FOR PROVIDING SECURE ACCESS TO PRIVATE NETWORKS

• US 20100049795A1
• Filed: 10/02/2009
• Published: 02/25/2010
• Est. Priority Date: 11/03/2000
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: XIA, Zeqing, TOCK, Theron
• Granted Patent: US 9,130,936 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

Improved approaches for providing secure remote access to resources maintained on private networks are disclosed. According to one aspect, predetermined elements, such as applets, can be modified to redirect all communications to and from an application server through an intermediate server. The intermediate server in turn communicates with the application servers. According to another aspect, a communication framework can be provided to funnel communication between an applet and a server through a communication layer so as to provide managed and/or secured communications there between.

Claims

1-25. -25. (canceled)

26. A method for communicating between a client and a server, the client including an applet, said method comprising:

determining whether a socket connection between the applet at the client and server is available;

establishing a socket connection between the applet at the client and the server when said determining determines that a socket connection is available;

establishing a pair of unidirectional secure connections provided by said communication layer when said determining determines that a socket connection is not available; and

thereafter communicating data between the applet at the client and the server is using whichever of the socket connection and the pair of unidirectional secure connections has been established.

27. A method as recited in claim 26, where the pair of unidirectional secure connections are URL connections.

28. A system for communicating between a client and a server, said system comprising:

a communication layer at a client, said communication layer transforming one or more socket connections into a pair of unidirectional secure URL connections;

an applet operating at the client to perform operations and to create at least one socket connection with said communication layer; and

a server operatively connected with the pair of unidirectional secure URL connections, said server communicating with said applet via the pair of unidirectional secure URL connections provided by said communication layer.

29. A system as recited in claim 28, where communications between said server and said applet are performed using packets of data.

30. A system as recited in claim 29, where the packets include a header and data, and where the header includes at least a browser identifier and a socket identifier.

31. A system as recited in claim 28, where said server includes one or more server socket connections with remote content servers, and where said server receives packets from said applet via one of the unidirectional secure URL connections provided by said communication layer, and where said server directs the packets received to an appropriate one of the server socket connections based on at least the browser identifier and the socket identifier.

32. A system as recited in claim 28,

where communications between said server and said applet are performed using packets of data,

where the packets include a header and data, and the header includes at least a socket identifier,

where said server includes one or more server socket connections with remote content servers, and

where said server receives packets from said applet via one of the unidirectional secure URL connections provided by said communication layer, and directs the packets received to an appropriate one of the server socket connections based on at least the socket identifier.

33. A system as recited in claim 28, where said communication layer comprises:

an outgoing queue for buffering outgoing packets of data received from the at least one socket connection with said applet; and

a sender thread that sends the packets of data stored in said outgoing queue to said server.

34. A system as recited in claim 33, where said communication layer comprises:

a reader thread that receives packets of data being sent from said server to said applet via said communication layer; and

at least one incoming queue for buffering incoming packets of data received from said server.

35. A system as recited in claim 34, where said at least one incoming queue operatively connects with the at least one socket connection of said applet.

36. A system as recited in claim 34, where flow control messages are sent between said communication layer and said server.

37. A system as recited in claim 34, where acknowledgement messages are sent between said communication layer and said server.

38. A system as recited in claim 28, where one of the pair of the unidirectional secure URL connections is an outgoing unidirectional secure URL connection, and the other of the pair of the unidirectional secure URL connections is an incoming unidirectional secure URL connection.

39. A system as recited in claim 38, where the outgoing unidirectional secure URL connection is a transient connection.

40. A system as recited in claim 39, where the incoming unidirectional secure URL connection is a persistent connection.

41. A system as recited in claim 28, where said communication layer is an applet communication layer.

42. A system for communicating between a client and a server, said system comprising:

a plurality of browser applications, at least a plurality of said browser applications utilizing at least one operating applet and a communication layer, said applet operating to perform operations and to create at least one socket connection with said communication layer, and said communication layer for each of said browsers operates to transform said socket connections into a pair of unidirectional URL connections; and

a server operatively connected with the pair of unidirectional URL connections associated with said communication layer associated with each of said plurality of browser applications, said server communicating with said at least one operating applet of said plurality of browser applications via the pair of unidirectional URL connections provided by said communication layer corresponding thereto.

43. A system as recited in claim 42, where the pair of unidirectional URL connections are secure connections.

44. A system as recited in claim 42, where the pair of unidirectional URL connections are HTTPS connections.

45. A system as recited in claim 42, where said server is an intermediate server that is provided as an intermediary between said browser application and remote content servers.

46. A system as recited in claim 42, where one of the pair of unidirectional URL connections is a transient connection, and the other of the pair of unidirectional URL connections is a persistent connection.

47. A system for communicating between a client and a server, said system comprising:

a plurality of browser applications, at least a plurality of said browser applications utilizing at least one operating applet and a communication layer, said applet operating to perform operations and to create at least one socket connection with said communication layer, and said communication layer for each of said browsers operates to form an intermediate socket connection or to transform said socket connections into a pair of unidirectional URL connections; and

a server operatively connected with the intermediate socket connection or the pair of unidirectional URL connections associated with said communication layer associated with each of said plurality of browser applications, said server communicating with said at least one operating applet of said plurality of browser applications via the intermediate socket connection or the pair of unidirectional URL connections provided by said communication layer corresponding thereto.

48. A system as recited in claim 47, where said server communicates with said at least one operating applet of said plurality of browser applications via the intermediate socket connection if such connection can be established, otherwise via the pair of unidirectional URL connections.