Systems and methods of providing server initiated connections on a virtual private network

• US 8,271,661 B2
• Filed: 06/25/2010
• Issued: 09/18/2012
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Harris, James, Kumar, Arkesh, Venkatraman, Charu, Soni, Ajay, He, Junxiao
• Primary Examiner(s): WON, MICHAEL YOUNG
• Application Number:
  US12/823,643
• Publication Number:
  US 20100281162A1
• Time in Patent Office: 816 Days
• Field of Search: 709/203, 709/227, 709/230, 709/238, 709/218, 709/228, 709/244, 709/249, 709/202
• US Class Current: 709/227
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol

Abstract

The present invention is related to a method for establishing via an appliance a transport layer protocol connection initiated by a server on a first network to a client connected from a second network to the first network via a secure socket layer virtual private network (SSL VPN) connection. The method includes the step of receiving, by an appliance, a transport layer connection request from a server on a first network to connect to a client connected to the first network via a SSL VPN connection from a second network. The transport layer connection request identifies a client destination internet protocol address and a client destination port on the first network. The method includes establishing, by the appliance, a first transport layer connection to the server on the first network, determining, by the appliance, the client on the second network associated with the client destination internet protocol address on the first network, and transmitting, by the appliance, connection information identifying the client destination port to an agent on the client. The agent establishes a second transport layer connection to the client destination port using a local internet protocol address of the client on the second network and establishes a third transport layer connection to the appliance, which it associates with the second transport layer connection.

Claims

1. A method comprising:

(a) receiving, by a device intermediary to a server operating on a first network and a plurality of clients, a transport layer connection request from the server to connect to a client, the client operating on a second network, the transport layer connection request identifying a destination internet protocol address and a destination port of the client on the first network;

(b) establishing, by the device, a first transport layer connection to the server on the first network;

(c) determining, by the device, an internet protocol address of the client on the second network corresponding to the destination internet protocol address of the client on the first network;

(d) establishing, by the device, a second transport layer connection with an agent on the client at the internet protocol address on the second network, the agent establishing a third transport layer connection to the identified destination port; and

(e) associating, by the device, a first connection record for the first transport layer connection with a second connection record for the second transport layer connection linked to the first transport layer connection.

2. The method of claim 1, wherein step (a) further comprises receiving, by the device, the transport layer connection request from the server responsive to initiating by the server to connect to the client.

3. The method of claim 1, wherein step (a) further comprises receiving, by the device, the transport layer connection request from the server responsive to the client triggering the server to initiate connection to the client.

4. The method of claim 1, wherein step (a) further comprises receiving, by the device, the transport layer connection request from the server responsive to the server deriving information about the client from a payload of a transport layer packet.

5. The method of claim 1, further comprising forwarding, by the device, data sent by the server via the first transport layer connection to the client via the second transport layer connection.

6. The method of claim 1, further comprising forwarding, by the device, to the server data received by the client that identifies the server'"'"'s internet protocol address on the second network.

7. The method of claim 1, wherein step (a) further comprises hosting, by the device, the destination internet protocol address of the client on the first network.

8. The method of claim 1, wherein step (a) further comprises establishing, by the device, a listener process to listen for network traffic from the first network on the destination internet protocol address of the client on the first network.

9. The method of claim 1, wherein step (c) further comprises identifying the internet protocol address of the client on the second network mapped to the destination internet protocol address of the client hosted by the device on the first network.

10. The method of claim 1, wherein step (c) further comprises identifying the port of the client on the second network mapped to a destination port of the client hosted by the device on the first network.

11. A system comprising:

a device, intermediary to a server operating on a first network and a plurality of clients, receiving a transport layer connection request from the server to connect to a client, the client operating on a second network, the transport layer connection request identifying a destination internet protocol address and a destination port of the client on the first network; and

a virtual server of the device establishing a first transport layer connection to the server on the first network, determining an internet protocol address of the client on the second network corresponding to the destination internet protocol address of the client on the first network, and establishing a second transport layer connection with an agent on the client at the internet protocol address on the second network, the agent establishing a third transport layer connection to the identified destination port,

wherein the device associates a first connection record for the first transport layer connection with a second connection record for the second transport layer connection linked to the first transport layer connection.

12. The system of claim 11, wherein the second network is not routable from the first network.

13. The system of claim 11, wherein the device receives the transport layer connection request from the server responsive to initiating by the server to connect to the client.

14. The system of claim 11, wherein the device receives the transport layer connection request from the server responsive to the client triggering the server to initiate connection to the client.

15. The system of claim 11, wherein the device receives the transport layer connection request from the server responsive to the server deriving information about the client from a payload of a transport layer packet.

16. The system of claim 11, wherein the device forwards data sent by the server via the first transport layer connection to the client via the second transport layer connection and forwards to the server data received by the client that identifies the server'"'"'s internet protocol address on the second network.

17. The system of claim 11, wherein the device hosts the destination internet protocol address of the client on the first network.

18. The system of claim 11, wherein the device establishes a listener process to listen for network traffic from the first network on the destination internet protocol address of the client on the first network.

19. The system of claim 11, wherein the virtual server identifies the internet protocol address of the client on the second network mapped to the destination internet protocol address of the client hosted by the device on the first network.

20. The system of claim 11, wherein the virtual server identifies the port of the client on the second network mapped to a destination port of the client hosted by the device on the first network.