METHOD AND SYSTEM FOR PROVIDING SECURE ACCESS TO PRIVATE NETWORKS WITH CLIENT REDIRECTION

• US 20110208838A1
• Filed: 04/29/2011
• Published: 08/25/2011
• Est. Priority Date: 11/02/2001
• Status: Abandoned Application

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: THOMAS, Christopher, Tock, Theron, Ramachandran, Sriram
• Application Number:
  US13/098,133
• Publication Number:
  US 20110208838A1
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Improved approaches for providing secure access to resources maintained on private networks are disclosed. The secure access can be provided through a public network using client software of client-server software and/or with file system software. Multiple remote users are able to gain restricted and controlled access to at least portions of a private network through a common access point, such as an intermediate server of the remote network.

Claims

1-39. -39. (canceled)

40. A method comprising:

generating a network connection request at a computer on a first network, the network connection request indicating a destination server on a second network;

redirecting the network connection request within a namespace provider or a layered service provider of a socket layer on the computer, the network connection request being redirected away from a transport service provider of the computer to an intermediate server in the second network; and

sending data from the computer towards the intermediate server, where the data is sent from the intermediate server toward the destination server when a connection is provided between the computer and the destination server.

41. The method of claim 40, where the layered service provider is utilized for redirecting the data of the client application from the first network to the second network.

42. The method of claim 40, where the namespace provider is utilized for domain name service lookups on the second network.

43. The method of claim 40, where the transport service provider includes a TCI/IP transport service provider.

44. The method of claim 40, further comprising:

encrypting the data sent between the computer and the intermediate server.

45. The method of claim 40, further comprising:

providing an indication when the connection is a secure connection.

46. The method of claim 45, where the indication is a visual indication.

47. A system comprising:

a processor to;

receive a network connection request on a computer, the network connection request corresponding to a remote network, the network connection request including a name of a destination device on the remote network;

redirect the network connection request away from a transport driver on the computer, the network connection request being redirected to an intermediate server in the remote network; and

receive, at the computer, data of the destination device from the intermediate server when a connection is provided between the computer and the destination device, where the data of the destination device is transferred between the intermediate server and the destination device on the remote network.

48. The system of claim 47, where the processor is further to:

pass the network connection request through a transport driver interface filter prior to the redirecting.

49. The system of claim 47, where the transport driver includes a TCI/IP transport driver.

50. The system of claim 47, where the processor is further to:

encrypt the data.

51. The system of claim 47, where the processor is further to:

redirect the network connection request based on a destination server or a destination port.

52. The system of claim 47, where the processor is further to:

automatically install a transport driver interface on the computer.

53. The system of claim 47, where the processor is further to:

automatically uninstall a transport driver interface from the computer.

54. A computer-readable memory device including instructions for performing a method for network communication, the method comprising:

generating a network connection request at a computer on a first network, the network connection request indicating a destination server on a second network;

redirecting the network connection request within a namespace provider or a layered service provider of a socket layer on the computer, the network connection request being redirected away from a transport service provider interface of the computer to an intermediate server in the second network; and

sending data from the computer towards the intermediate server, where the data is sent from the intermediate server toward the destination server when a connection is provided between the computer and the destination server in response to the network connection request.

55. The computer-readable memory device of claim 54, where the layered service provider is utilized for redirecting the data from the first network to the second network.

56. The computer-readable memory device of claim 54, where the namespace provider is utilized for domain name service lookups on the second network.

57. The computer-readable memory device of claim 54, where the transport service provider interface includes a TCI/IP transport service provider interface.

58. The computer-readable memory device of claim 54, where the method further comprises:

encrypting the data sent between the computer and the intermediate server.

59. The computer-readable memory device of claim 54, where the method further comprises:

providing a visual indication when the connection is a secure connection.