Providing Virtualized Private Network Tunnels

• US 20140109172A1
• Filed: 09/17/2013
• Published: 04/17/2014
• Est. Priority Date: 10/15/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Lang, Zhongmin, Desai, Nitin, Walker, James Robert
• Granted Patent: US 8,914,845 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Various aspects of the disclosure relate to providing a per-application policy-controlled virtual private network (VPN) tunnel. In some embodiments, tickets may be used to provide access to an enterprise resource without separate authentication of the application and, in some instances, can be used in such a manner as to provide a seamless experience to the user when reestablishing a per-application policy controlled VPN tunnel during the lifetime of the ticket. Additional aspects relate to an access gateway providing updated policy information and tickets to a mobile device. Other aspects relate to selectively wiping the tickets from a secure container of the mobile device. Yet further aspects relate to operating applications in multiple modes, such as a managed mode and an unmanaged mode, and providing authentication-related services based on one or more of the above aspects.

Claims

1. A method, comprising:

receiving, at a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway;

determining that the mobile device has a ticket that is valid, said ticket being configured to provide authentication in connection with creating a virtual private network (VPN) tunnel for the application to said at least one resource;

analyzing policy information to determine that network access to the at least one resource is permitted;

transmitting the ticket to the access gateway; and

creating the VPN tunnel for the application to access said at least one resource.

2. The method of claim 1, further comprising:

performing an initial authentication with the access gateway, resulting in the mobile device receiving the ticket, wherein the ticket includes an indication of when the ticket is to expire; and

wherein determining that the mobile device has a ticket that is valid includes determining that the ticket has not expired based on the indication of when the ticket is to expire.

3. The method of claim 1, further comprising:

receiving the policy information from the access gateway; and

storing the policy information in a secure container of the mobile device.

4. The method of claim 3, further comprising:

storing the ticket in the secure container; and

wherein determining that the mobile device has a ticket that is valid includes searching the secure container for the ticket.

5. The method of claim 1, further comprising:

closing the VPN tunnel;

subsequent to closing the VPN tunnel;

determining that the mobile device does not have a ticket that is valid based on determining that the ticket has expired,

obtaining a new ticket,

determining that the mobile device has a ticket that is valid based on the new ticket,

transmitting the new ticket to the access gateway, and

creating a new VPN tunnel for the application.

6. The method of claim 1, further comprising:

closing the VPN tunnel;

subsequent to closing the VPN tunnel;

determining that the mobile device has a ticket that is valid based on determining that the ticket has not expired,

transmitting the ticket to the access gateway a second time, and

creating a new VPN tunnel for the application.

7. The method of claim 1, wherein the application is a managed application and the VPN tunnel is a per-application policy-controlled VPN tunnel that is inaccessible to other applications of the mobile device.

8. The method of claim 1, further comprising:

using the ticket in connection with opening a plurality of VPN tunnels to the at least one resource without requiring a user of the mobile device input or select a credential for authentication, wherein each of the plurality of VPN tunnels provides the application with access to the at least one resource.

9. The method of claim 1, further comprising:

based on the ticket, providing one or more servers accessible through the access gateway with information required to enable presence-related functionality that informs of a user'"'"'s presence, said user being associated with the mobile device.

10. An apparatus, comprising:

at least one processor; and

memory storing executable instructions configured to, when executed by the at least one processor, cause the apparatus to;

receive policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource that is accessible through an access gateway,

determine that the mobile device has a ticket that is valid, said ticket being configured to provide authentication in connection with creating a virtual private network (VPN) tunnel for the application to said at least one resource,

analyze policy information to determine that network access to the at least one resource is permitted,

transmit the ticket to the access gateway, and

create the VPN tunnel for the application to access said at least one resource.

11. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, further cause the apparatus to perform an initial authentication with the access gateway, resulting in the mobile device receiving the ticket, wherein the ticket includes an indication of when the ticket is to expire;

and

wherein determining that the mobile device has a ticket that is valid includes determining that the ticket has not expired based on the indication of when the ticket is to expire.

12. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, further cause the apparatus to:

close the VPN tunnel;

subsequent to closing the VPN tunnel;

determine that the mobile device does not have a ticket that is valid based on determining that the ticket has expired,

obtain a new ticket,

determine that the mobile device has a ticket that is valid based on the new ticket,

transmit the new ticket to the access gateway, and

create a new VPN tunnel for the application.

13. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, further cause the apparatus to:

close the VPN tunnel;

subsequent to closing the VPN tunnel;

determine that the mobile device has a ticket that is valid based on determining that the ticket has not expired,

transmit the ticket to the access gateway a second time, and

create a new VPN tunnel for the application.

14. The apparatus of claim 10, wherein the application is a managed application and the VPN tunnel is a per-application policy-controlled VPN tunnel that is inaccessible to other applications of the mobile device.

15. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, further cause the apparatus to:

use the ticket in connection with opening a plurality of VPN tunnels to the at least one resource without requiring a user of the mobile device input or select a credential for authentication, wherein each of the plurality of VPN tunnels provides the application with access to the at least one resource.

16. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, further cause the apparatus to:

based on the ticket, provide one or more servers accessible through the access gateway with information required to enable presence-related functionality that informs of a user'"'"'s presence, said user being associated with the mobile device.

17. One or more non-transitory computer-readable media storing instructions configured to, when executed, cause at least one computing device to:

receive policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway;

determine that the mobile device has a ticket that is valid, said ticket being configured to provide authentication in connection with creating a virtual private network (VPN) tunnel for the application to said at least one resource;

analyze policy information to determine that network access to the at least one resource is permitted;

transmit the ticket to the access gateway; and

create the VPN tunnel for the application to access said at least one resource.

18. The one or more non-transitory computer-readable media of claim 17, wherein the instructions are configured to, when executed, further cause said at least one computing device to perform an initial authentication with the access gateway, resulting in the mobile device receiving the ticket, wherein the ticket includes an indication of when the ticket is to expire;

and

wherein determining that the mobile device has a ticket that is valid includes determining that the ticket has not expired based on the indication of when the ticket is to expire.

19. The one or more non-transitory computer-readable media of claim 17, wherein the instructions are configured to, when executed, further cause said at least one computing device to:

close the VPN tunnel;

subsequent to closing the VPN tunnel;

determine that the mobile device does not have a ticket that is valid based on determining that the ticket has expired,

obtain a new ticket,

determine that the mobile device has a ticket that is valid based on the new ticket,

transmit the new ticket to the access gateway, and

create a new VPN tunnel for the application.

20. The one or more non-transitory computer-readable media of claim 17, wherein the instructions are configured to, when executed, further cause said at least one computing device to:

close the VPN tunnel;

subsequent to closing the VPN tunnel;

determine that the mobile device has a ticket that is valid based on determining that the ticket has not expired,

transmit the ticket to the access gateway a second time, and create a new VPN tunnel for the application.