Providing Virtualized Private Network Tunnels

• US 20150067769A1
• Filed: 11/07/2014
• Published: 03/05/2015
• Est. Priority Date: 10/15/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Barton, Gary, Lang, Zhongmin, Desai, Nitin, Walker, James Robert
• Granted Patent: US 9,521,117 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Various aspects of the disclosure relate to providing a per-application policy-controlled virtual private network (VPN) tunnel. In some embodiments, tickets may be used to provide access to an enterprise resource without separate authentication of the application and, in some instances, can be used in such a manner as to provide a seamless experience to the user when reestablishing a per-application policy controlled VPN tunnel during the lifetime of the ticket. Additional aspects relate to an access gateway providing updated policy information and tickets to a mobile device. Other aspects relate to selectively wiping the tickets from a secure container of the mobile device. Yet further aspects relate to operating applications in multiple modes, such as a managed mode and an unmanaged mode, and providing authentication-related services based on one or more of the above aspects.

Claims

1. A method, comprising:

transmitting, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway;

receiving, by the access gateway, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration;

providing access to the at least one resource via the per-application policy-controlled VPN tunnel;

receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time;

closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and

after closing the per-application policy-controlled VPN tunnel, receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.

2. The method of claim 1, further comprising:

performing an initial authentication with the mobile device and transmitting the ticket to the mobile device.

3. The method of claim 1, further comprising:

performing an update to the policy information, resulting in updated policy information;

determining to transmit the updated policy information to the mobile device; and

transmitting, by the access gateway, the updated policy information to the mobile device;

4. The method of claim 3, wherein performing the update to the policy information is based on a listing of applications that are installed on the mobile device.

5. The method of claim 3, wherein performing the update to the policy information is based on a listing of tickets that are issued and currently valid for the mobile device.

6. The method of claim 3, wherein determining to transmit the updated policy information is based on receiving a request for policy information from the mobile device.

7. The method of claim 1, further comprising:

transmitting, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device.

8. The method of claim 1, further comprising:

transmitting, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel.

9. The method of claim 9, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket.

10. An apparatus, comprising:

at least one processor; and

memory storing executable instructions configured to, when executed by the at least one processor, cause the apparatus to;

transmit, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through the apparatus;

receive, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration;

provide access to the at least one resource via the per-application policy-controlled VPN tunnel;

receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a first time;

close the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and

after closing the per-application policy-controlled VPN tunnel, receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a second time.

11. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

perform an update to the policy information, resulting in updated policy information;

determine to transmit the updated policy information to the mobile device; and

transmit the updated policy information to the mobile device;

12. The apparatus of claim 11, wherein causing the apparatus to determine to transmit the updated policy information is based on receipt of a request for policy information from the mobile device.

13. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device.

14. The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to:

transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel.

15. The apparatus of claim 14, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket.

16. One or more non-transitory computer-readable media storing instructions configured to, when executed, cause a computing device to:

transmit, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through the apparatus;

receive, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration;

provide access to the at least one resource via the per-application policy-controlled VPN tunnel;

receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a first time;

close the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and

after closing the per-application policy-controlled VPN tunnel, receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a second time.

17. The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to:

perform an update to the policy information, resulting in updated policy information;

determine to transmit the updated policy information to the mobile device; and

transmit the updated policy information to the mobile device;

18. The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to:

transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device.

19. The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to:

transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel.

20. The one or more non-transitory computer-readable media of claim 19, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket.