Redirection of secure data connection requests

• US 8,613,072 B2
• Filed: 02/26/2009
• Issued: 12/17/2013
• Est. Priority Date: 02/26/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Nice, Nir, Schultz, Benjamin M., Venkataramaiah, Narasimhan A.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US12/393,046
• Publication Number:
  US 20100218248A1
• Time in Patent Office: 1,755 Days
• Field of Search: 726/12, 709/228
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Methods, systems, and computer-readable media are disclosed for processing a secure data connection request. A particular method receives, at a first gateway, a secure data connection request from a client identifying a server to connect to. The first gateway sends the client device a redirect message instructing the client device to attempt alternate connection via a second gateway. The client sends a secure data connection request to the second gateway and the second gateway facilitates the secure data connection between the client and the server.

Claims

1. A method comprising:

receiving a first secure data connection request from a client device at a first gateway, the first secure data connection request identifying a target server;

sending a request from the first gateway to a redirect determination service and receiving a response from the redirect determination service, the response identifying a second gateway based on one or more server connection attributes and one or more gateway connection attributes; and

sending a redirect message from the first gateway to the client device instructing the client device to send a second secure data connection request to the second gateway, such that the client device initiates a secure data connection to the target server via the second gateway, wherein the first gateway has a non-hierarchical relationship with the second gateway.

2. The method of claim 1, wherein at least one of the first secure data connection request and the second secure data connection request is carried out over a Hypertext Transfer Protocol Secure (HTTPS) connection.

3. The method of claim 2, wherein the HTTPS connection is one of an IPv6-HTTPS connection and an IPv4-HTTPS connection.

4. The method of claim 1, wherein the secure data connection is a Secure Socket Layer based Virtual Private Network (SSL-VPN) connection.

5. The method of claim 1, wherein at least one of the first secure data connection request and the second secure data connection request is carried out over a Secure Socket Tunneling Protocol (SSTP) connection.

6. The method of claim 1, wherein the client device is one of:

a computer, a kiosk, and a mobile device.

7. The method of claim 1, wherein the redirect message is an HTTP redirect message.

8. The method of claim 1, wherein the second gateway is selected from a plurality of gateways based on at least one of:

a location of the client device, a location of the target server, a unique identification of the client device, a type of service requested by the client device, and a priority level of the client device.

9. The method of claim 1, wherein the client device stores an address of the second gateway.

10. The method of claim 1, wherein the first gateway sends a request to a redirect determination service located at the target server and receives a response from the redirect determination service prior to sending the redirect message, wherein the response specifies the second gateway.

11. The method of claim 10, wherein the client device attempts to establish a second secure data connection with a second target server while maintaining the secure data connection to the target server.

12. The method of claim 11, wherein the redirect determination service identifies the second gateway at least partly based on a gateway connection attribute measured at the target server, the gateway connection attribute included in the redirect message.

13. The method of claim 12, wherein the gateway connection attribute is related to at least one of:

a first count of a number of connections between the first gateway and the target server and a second count of a number of connections between the second gateway and the target server.

14. The method of claim 1, wherein the first gateway is a randomly selected gateway.

15. A system comprising:

a server accessible by a client device using a secure data connection via a gateway;

a plurality of gateways, wherein each gateway of the plurality of gateways is capable of;

receiving a secure data connection request from the client device;

sending a redirect message to the client device instructing the client device to send a second secure data connection request to a different gateway; and

facilitating a secure data connection between the client device and the server via the different gateway, wherein the gateway has a non-hierarchical relationship with the different gateway, and wherein facilitation of the secure data connection includes sending a request to a redirect determination service and receiving a response from the redirect determination service, the response identifying the different gateway based on one or more server connection attributes and one or more gateway connection attributes.

16. The system of claim 15, wherein each of the plurality of gateways is a virtual private network entry point to a firewall-protected data network within which the server is located, and wherein the redirect determination service is in the firewall-protected data network.

17. The system of claim 16, wherein the firewall-protected data network includes a corporate network, and wherein the server provides file sharing applications and database applications.

18. The system of claim 16, wherein each of the virtual private network entry points is further capable of providing at least one of support for single sign-on functionality, a customized portal page for the client device, file upload restrictions, file download restrictions, and file modification restrictions.

19. A computer-readable storage device comprising instructions, that when executed by a computer, cause the computer to:

receive a first Hypertext Transfer Protocol Secure (HTTPS) connection request from a client device at a first virtual private network (VPN) gateway; and

send an HTTP redirect message from the first VPN gateway to the client device instructing the client device to send a second HTTPS connection request to a second VPN gateway that has a non-hierarchical relationship with the first VPN gateway, such that a VPN connection is initiated between the client device and a target computing device via the second VPN gateway, wherein the first VPN gateway receives a response to a redirect determination query, wherein the res onse identifies the second VPN gateway and wherein the second VPN gateway is determined based on one or more server connection attributes and one or more gateway connection attributes.

20. The computer-readable storage device of claim 19, further comprising instructions, that when executed by the computer, cause the computer to communicate between the first VPN gateway and the second VPN gateway prior to sending the HTTP redirect message.