VPN network client for mobile device having dynamically constructed display for native access to web mail

• US 8,474,035 B2
• Filed: 12/14/2010
• Issued: 06/25/2013
• Est. Priority Date: 06/30/2010
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Wei, Yin, Iyer, Subramanian, Campagna, Richard, Wood, James
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US12/968,013
• Publication Number:
  US 20120002814A1
• Time in Patent Office: 924 Days
• Field of Search: 380/270, 726/15
• US Class Current: 726/15
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/086 using security domains

Abstract

An integrated, multi-service network client for cellular mobile devices is described. The multi-service network client can be deployed as a single software package on cellular mobile network devices to provide integrated services including secure enterprise virtual private network (VPN) connectivity, acceleration, security management including monitored and enforced endpoint compliance, and collaboration services. The VPN network client is programmed to receive a web-based home page from an enterprise VPN appliance, process the web-based home page to identify a bookmark embedded within the response that corresponds to an enterprise webmail for the user and dynamically construct a user interface to have an input control native to the cellular mobile device for launching a native email client of the cellular mobile device to access the email without launching a web browser.

Claims

1. A cellular mobile device comprising:

a transmitter and receiver to send and receive cellular communications in the form of radio frequency signals;

a microprocessor;

a native email application executing on the microprocessor; and

a virtual private network (VPN) network client executing on the microprocessor to establish a VPN connection with a remote VPN security device, wherein the VPN network client processes network packets for securely tunneling the network packets between the cellular mobile device and the remote VPN security device,

wherein, upon establishing the VPN connection, the VPN network client receives a web-based home page from the secure VPN device via a secure response, and

wherein the VPN network client processes the web-based home page to identify a bookmark embedded within the secure response that corresponds to a webmail for the user and dynamically constructs a user interface to have an input control native to the cellular mobile device for launching the native email application of the cellular mobile device to access the webmail without launching a web browser as if the bookmark within the web-based home page were selected by the user.

2. The cellular mobile device of claim 1,

wherein the web-based home page comprises a HyperText Markup Language (HTML) web page having a plurality of embedded HTML bookmark links,

wherein the secure response comprises an Hypertext Transfer Protocol Secure (HTTPS) response, and

wherein the VPN network client outputs the request to the remote VPN security device as an HTTP string upon selection of one of the input controls.

3. The cellular mobile device of claim 1, further comprising:

an operating system executing on the microprocessor to provide an operating environment of application software,

wherein the VPN network client exchanges the network packets with the operating system to encrypt output network packets and decrypt inbound network packets.

4. The cellular mobile device of claim 3,

wherein the VPN handler registers a pre-defined URL format with the operating system, and

wherein, upon receiving a request for a URL that matches the pre-defined URL format, the operating system redirects the requested URL to the VPN handler.

5. The cellular mobile device of claim 3, wherein the VPN network client comprises a multi-service network client registered with the operating system as a single application.

6. The cellular mobile device of claim 5, wherein the multi-service network client comprises:

a VPN handler to exchange the network packets with the operating system;

a security manager to receive the decrypted network packets from the VPN handler and apply at least one security service to the decrypted network packets; and

a VPN control application that provides a unified user interface that allows a user to configure both the VPN handler and the security manager.

7. The cellular mobile device of claim 6, wherein the multi-service network client comprises a single distribution package.

8. The cellular mobile device of claim 6, wherein the VPN control application presents a unified user interface for configuring anti-virus settings and personal firewall settings of the security manager.

9. The cellular mobile device of claim 6,

wherein the security manager applies anti-virus and spyware services to the network packets,

wherein the security manager provides an interface by which the VPN handler determines whether a user of the cellular mobile device has activated and registered the security manager, and

wherein the VPN handler requires an affirmative indication from the security manager prior to allowing the VPN connection to be established with the remote VPN security device, wherein the affirmative indication from the security manager indicates to the VPN handler that the security manager have been activated to apply the anti-virus and spyware services to the network packets using up-to-date virus definitions.

10. The cellular mobile device of claim 6,

wherein the VPN handler comprises a host checker module that inventories a state of the cellular mobile device and builds a health status report, and

wherein the host checker outputs the health status report to the remote VPN security device prior to establishing the VPN connection for determining whether the cellular mobile device is compliant with corporate policies.

11. The cellular mobile device of claim 6, wherein the multi-service network client further comprises a data acceleration module that applies at least one acceleration service to the network packets from the VPN handler.

12. The cellular mobile device of claim 11, wherein the data acceleration module provides a local content cache.

13. The cellular mobile device of claim 11, wherein the data acceleration module provides a client-side decompression service that operates in conjunction with an upstream acceleration device to provide real-time, continuous pattern recognition and compression of data flows within the network packets.

14. The cellular mobile device of claim 11, wherein the data acceleration module provides application-specific protocol optimization for control flows within the network packets.

15. The cellular mobile device of claim 6, wherein the multi-service network client further comprises one or more collaboration components that process the packets from the VPN handler, wherein collaboration components provide collaboration services including at least one of a network meeting, a secure desktop or a document sharing service.

16. The cellular mobile device of claim 6,

wherein the VPN control application provides a user interface that allows a user to disable VPN connectivity, and

wherein, when VPN connectivity is disabled, the VPN handler exchanges the network packets with the operating system and transparently provides the packets to the security manager for application of the security service.

17. The cellular mobile device of claim 6, wherein the user interface of the VPN control applications allows the user to submit credentials and instruct the VPN handler to dynamically instantiate the secure VPN connection or deconstruct an existing VPN connection.

18. The cellular mobile device of claim 6, wherein the VPN handler and the VPN control application are configured to be independently upgradable.

19. The cellular mobile device of claim 6,

wherein the VPN handler establishes the VPN connection as an Internet Protocol Security (IPSec) connection over User Datagram Protocol (UDP), and

wherein the VPN handler includes a compression module that applies Lempel-Ziv (LZ) compression in conjunction with the IPSec connection to tunnel encrypted IP packets to the remote VPN security device.

20. The cellular mobile device of claim 6,

wherein the VPN handler establishes an Secure Socket Layer (SSL) control channel with the remote VPN security device and, upon a successful authentication, receives a session cookie with a unique identifier,

wherein, in the event communication with the remote VPN security device is temporarily lost, the VPN handler performs a fast reconnect by issuing the session cookie to the remote VPN security device, and

wherein, when performing the fast reconnect, the VPN handler identifies a set of transport mechanisms currently available to the cellular mobile device and, when only a cellular network is available and not a wireless packet-based connection, the VPN handler defers the fast reconnect until application-layer data is received from a user application and ready to be sent via the VPN connection.

21. A system comprising:

a virtual private network (VPN) security device coupled to a packet network;

a cellular mobile device comprising;

a microprocessor;

an email application native to the cellular mobile device; and

a virtual private network (VPN) network client to establish a VPN connection with the VPN security device,

wherein the VPN network client processes securely tunnels network packets between the cellular mobile device and the remote VPN security device,

wherein upon establishing the VPN connection the VPN network client receives a web-based home page from the secure VPN device via a secure response,

wherein the VPN network client processes the web-based home page to identify a bookmark embedded within the secure response that corresponds to a webmail service for the user and dynamically constructs a user interface to have an input control native to the cellular mobile device for launching the native email application of the cellular mobile device without launching a web browser to access an email as if the bookmark within the web-based home page were selected by the user.

22. The system of claim 21,

wherein the web-based home page comprises a HyperText Markup Language (HTML) web pages having a plurality of embedded HTML bookmark links,

wherein the secure response comprises an Hypertext Transfer Protocol Secure (HTTPS) response, and

wherein the VPN network client outputs the request to the VPN security device as an HTTP string upon selection of one of the input controls.

23. A method comprising:

executing a VPN client on a cellular mobile device to establish a VPN connection with a remote VPN security device and securely exchange network packets between the cellular mobile device and the remote VPN security device,

upon establishing the VPN connection, receiving a web-based home page from the secure VPN device via a secure response,

parsing bookmark links from the secure response with the VPN network client to identify a bookmark link embedded within the secure response that corresponds to a webmail service for the user;

dynamically constructing a user interface of the cellular mobile device with the VPN network client to include an input control native to the cellular mobile device for the identified bookmark link; and

upon selection of the input control and without invoking a web browser on the cellular mobile device, launching a native email client of the cellular mobile device to access an email as if the bookmark link within the web-based home page were selected by the user.

25. The non-transitory computer-readable storage medium of claim 23,

wherein the web-based home page comprises a HyperText Markup Language (HTML) web page having a plurality of embedded HTML bookmark links,

wherein the secure response comprises an Hypertext Transfer Protocol Secure (HTTPS) response, and

wherein the VPN network client is programmed to output the request to the secure VPN gateway as an HTTP string upon selection of one of the input controls.

24. A non-transitory computer-readable medium storing a downloadable distribution package comprising software program code to execute a multi-service network client on a processor within a mobile cellular device,

wherein the VPN network client is programmed to process network packets for securely tunneling the network packets between the cellular mobile device and the remote VPN security device, and

wherein the VPN network client is programmed to receive a web-based home page from the secure VPN device via a secure response, process the web-based home page to identify a bookmark embedded within the secure response that corresponds to a webmail for the user and dynamically construct a user interface to have an input control native to the cellular mobile device for launching a native email client of the cellular mobile device to access an email without launching a web browser as if the bookmark within the web-based home page were selected by the user.