Uninterrupted virtual private network (VPN) connection service with dynamic policy enforcement

• US 8,516,569 B2
• Filed: 06/25/2012
• Issued: 08/20/2013
• Est. Priority Date: 09/17/2008
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Babula, Allu, Attur, Vishnu Govind, Ananda, Gautham Chambrakana
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US13/531,694
• Publication Number:
  US 20120260314A1
• Time in Patent Office: 421 Days
• Field of Search: None
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Techniques for uninterrupted virtual private network (VPN) connection service with dynamic policy enforcement are provided. An existing VPN session between a VPN client and a VPN server detects a change in a VPN network being used for the existing VPN session. New credentials and new policies are received by the VPN client. The new credentials are automatically used to re-authenticate the VPN client to the change during the existing VPN session, and the new policies are dynamically used to enforce the new policies during the existing VPN session on the VPN client.

Claims

1. A machine-implemented system, comprising:

a server machine having memory and a processor the memory configured with Virtual Private Network (VPN) connection manager that executes on the processor of the server machine within a network; and

a VPN connection table implemented in a non-transitory computer-readable storage medium and processed by the VPN connection manager on the server machine of the network;

wherein the VPN connection manager authenticates a request from a VPN client to change VPN information for an existing VPN session while allowing the VPN client to maintain the existing VPN session, and wherein the VPN connection manager updates an entry for the existing VPN session within the VPN connection table to include new credentials that permit the VPN client to automatically and dynamically re-authenticate to the existing VPN session with changed VPN information, wherein the new credentials replace existing credentials being used with existing network information for the existing VPN session, and wherein the new credentials and new policies for the changed VPN information and the existing VPN session are provided to the VPN client for dynamic re-authentication to the existing VPN session.

2. The system of claim 1, wherein the request is received from a control channel manager that processes on the VPN client.

3. The system of claim 2, wherein the request is generated by the control channel manager in response to notification raised by a network detection module on the VPN client that indicates the presence of the changed VPN information that occurs during the existing VPN session.

4. The system of claim 1, wherein the request is received when the existing VPN session is reset to have the new policies dynamically enforced on the VPN client during the existing VPN session.

5. The system of claim 1, wherein the request is received when the changed VPN information indicates an Internet Protocol (IP) address associated with a VPN sever that the VPN client uses for the existing VPN session has changed to a new IP address.

6. The system of claim 1, wherein the VPN connection manager sets an attribute in the entry in the VPN connection table to indicate that the existing VPN session is uninitialized when the new credentials are provided to the VPN client and resets the attribute in the entry to connected once the VPN connection manager automatically re-authenticates with the new credentials.

7. A machine-implemented system, comprising:

a Virtual Private Network (VPN) client having memory and a processor, the memory configured with a network detection module that processes on the processor of the VPN client over a network;

the memory configured with a control channel manager that processes on the processor of the VPN client over the network; and

the memory also configured with a data channel manager that processes on the processor of the VPN client over the network;

wherein the network detection module is to detect a change in an existing VPN session between the VPN client and a VPN server and sends a notification of the change to the control channel manager, the control channel manager reports the change to a VPN connection manager over the network and receives new credentials and new policies for the existing VPN session that are supplied to the data channel manager, the data channel manager uses the new credentials to automatically re-authenticate the existing VPN session without losing the VPN session and the data channel manager enforces the new policies within the existing VPN session.

8. The system of claim 7, wherein the control channel manager remains connected to the VPN connection manager even with the change that the network detection module notified the control channel manager of.

9. The system of claim 7, wherein the control channel manager authenticates to the VPN connection manager to have the new credentials and new policies delivered back to the control channel manager.

10. The system of claim 7, wherein the change is recognized as a new Internet Protocol (IP) address that is different from an existing IP address being used by the data channel manager with the existing VPN session.

11. A method residing as instructions in a non-transitory computer-readable storage medium that execute on a processor, the processor when accessed performing the method, comprising:

replacing, by the processor, an existing Internet Protocol (IP) address with a new IP address, the new IP address replaces the existing IP address being used in an existing Virtual Private Network (VPN) session; and

supplying, by the processor, a new credential to a VPN client for automatically re-authenticating to the existing VPN session using the new IP address without losing service to the existing VPN session.

12. The method of claim 11 further comprising, managing, by the processor, the existing VPN session as a Secure Socket Layer VPN session.

13. The method of claim 11 further comprising, processing, by the processor, the method within the VPN client.

14. The method of claim 11 further comprising, acquiring, by the processor, different policies for enforcement against the VPN client during the existing VPN session while using the new IP address.

15. The method of claim 11, wherein replacing further includes replacing the existing IP address in response to a request received.

16. The method of claim 15, wherein replacing further includes receiving the request from a control path manager that manages a control path for the existing VPN session on the VPN client.

17. The method of claim 15, wherein replacing further includes verifying the request via a cookie on the VPN client.

18. The method of claim 11, wherein supplying further includes generating the new credential as a randomly generated identifier and password combination for the VPN client.

19. The method of claim 11, wherein supplying further includes supplying new policies that are different from previous policies with the new credential for enforcement on the VPN client with the new IP address during the existing VPN session.

20. The method of claim 11, wherein supplying further includes automatically generating the new credential for the new IP address and maintaining the existing VPN session while the new IP address is being re-authenticated to the existing VPN session on behalf of the VPN client.