Rule-based routing to resources through a network

• US 8,590,032 B2
• Filed: 10/14/2005
• Issued: 11/19/2013
• Est. Priority Date: 12/10/2003
• Status: Expired due to Fees

• Current Assignee: Aventail LLC
• Original Assignee: Aventail LLC
• Inventors: Hopen, Chris, Sauve, Bryan, Hoover, Paul, Perry, Bill
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US11/251,592
• Publication Number:
  US 20060143703A1
• Time in Patent Office: 2,958 Days
• Field of Search: 726/15, 726/13, 709/223, 709/225, 709/229, 709/204, 709/219, 709/224, 709/232, 709/245, 370/224, 370/442
• US Class Current: 726/13
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Techniques for determining which resource access requests are handled locally at a remote computer, and which resource access requests are routed or “redirected” through a virtual private network. One or more routing or “redirection” rules are downloaded from a redirection rule server to a remote computer. When the node of the virtual private network running on the remote computer receives a resource access request, it compares the identified resource with the rules. Based upon how the identified resource matches one or more rules, the node will determine whether the resource access request is redirected through the virtual private network or handled locally (e.g., retrieved locally from another network). A single set of redirection rules can be distributed to and employed by a variety of different virtual private network communication techniques.

Claims

1. A method of routing resource access requests to a network, the method comprising:

establishing a first virtual private network between the network and a first client, such that the first client uses a first connection method to establish a secure virtual private network connection with the network;

establishing a second virtual private network between the network and a second client, such that the second client uses a second connection method to establish a secure virtual private network connection with the network, wherein the second connection method is different from the first connection method;

creating a redirection rule list including a plurality of inclusion redirection rules, wherein each inclusion redirection rule redirects a resource access request to the network and is associated with an inclusion resource; and

providing the redirection rule list to both the first client and the second client for routing resource access requests, wherein the resource name is defined by WINS, Windows Internet name service, wherein a resource access request for the inclusion resource is routed in accordance with the inclusion redirection rule stored on the client, the resource access request routed to the network through the secure virtual private network connection provided by the established first or second virtual private network.

2. The method of claim 1, wherein the redirection rule list further includes at least one exclusion redirection rule associated with an exclusion resource, wherein a resource access request for the exclusion resource is handled locally by a requesting client in accordance with the exclusion redirection rule, and further comprising providing the at least one exclusion redirection rule with the redirection rule list to both the first client and the second client for routing resource access requests.

3. The method of claim 1, wherein the first connection method is selected from the group consisting of:

employing a local forward Web server to establish a virtual private network connection with the network, employing a local circuit proxy to establish a virtual private network connection with the network, employing a local IP tunnel adaptor to establish a virtual private network connection with the network, and employing a network based implementation of a reverse web proxy to establish a virtual private network connection with the network.

4. The method of claim 2, wherein the first client handles a resource access request concerning a resource locally based on the exclusion redirection rule included in the redirection rule list.

5. The method of claim 2, wherein the exclusion redirection rule is associated with the same resource as the inclusion redirection rule, and wherein the exclusion redirection rule is given precedence over the inclusion redirection rule.

6. The method of claim 1, wherein creating the redirection rule list includes compiling rules based on user authority to access resources in the network.

7. The method of claim 1, wherein a redirection rule on the redirection rule list specifies at least one Internet Protocol address, the at least one Internet Protocol address being further associated with a range of Internet Protocol addresses.

8. A method of routing resource access requests to a network, the method comprising:

establishing a first virtual private network between the network and a first client, such that the first client uses a first connection method to establish a secure connection with the network;

establishing a second virtual private network between the network and a second client, such that the second client uses a second connection method to establish a secure connection with the network, wherein the second connection method is different from the first connection method;

creating a redirection rule list including a plurality of inclusion redirection rules, wherein each inclusion redirection rule redirects a resource access request to the network and is associated with an inclusion resource; and

providing the redirection rule list to both the first client and the second client for routing resource access requests, wherein the resource name is defined by WINS, Windows Internet name service, wherein a resource access request in compliance with an inclusion redirection rule stored on the client is routed to the network through the secure connection provided by the established first or second virtual private network.