Network services platform

• US 8,615,572 B1
• Filed: 12/13/2012
• Issued: 12/24/2013
• Est. Priority Date: 06/28/2010
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: nCircle Network Security, Inc. (Belden Inc.)
• Inventors: Quilter, Alexander L., Keanini, Timothy D., Lavery, Oliver, Meltzer, David J.
• Primary Examiner(s): Nguyen, Quang N
• Application Number:
  US13/714,022
• Time in Patent Office: 376 Days
• Field of Search: 709/222, 709/226, 709/228, 709/231, 709/238
• US Class Current: 709/222
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 61/2503 Translation of Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/2535 Multiple local networks, e.g. resolving potential IP address conflicts
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A network services platform provides services to remote enterprise networks. The services platform provides a control module to a computer in the enterprise network. The control module executes on the computer and interacts with the services platform to establish an Internet Protocol (IP) tunnel between the services platform and the computer. The control module also establishes a bridge between the IP tunnel and the enterprise network. The services platform allocates a unique private IP address space to the enterprise network, and translates IP addresses in network communications between enterprise network addresses and corresponding services platform addresses in the allocated unique private address space. The services platform provides network services to the enterprise network via the IP tunnel and bridge.

Claims

1. A computer-implemented method of using a services platform to provide a network service to a remote enterprise network, comprising:

using a computer to perform steps comprising;

establishing an Internet Protocol (IP) tunnel between the services platform and an endpoint of the remote enterprise network responsive to execution of a control module on the endpoint;

establishing a bridge between the IP tunnel and the remote enterprise network responsive to the execution of the control module on the endpoint;

allocating a unique private IP address space to the remote enterprise network;

inventorying the remote enterprise network to identify a plurality of endpoints on the remote enterprise network, ones of the plurality of endpoints being identified with enterprise network IP addresses in an enterprise address space;

assigning services platform IP addresses within the unique private IP address space to identified ones of the plurality of endpoints; and

providing the network service to the remote enterprise network via the IP tunnel and bridge,

wherein the services platform provides network services to a plurality of remote enterprise networks and wherein a different unique private IP address space is allocated to one or more of the plurality of remote enterprise networks.

2. The computer-implemented method of claim 1, wherein the control module is provided from the services platform to the endpoint responsive to a request for the network service from a user of the endpoint.

3. The computer-implemented method of claim 1, wherein the tunnel is formed at a layer of an Open Systems Interconnection model.

4. The computer-implemented method of claim 1, wherein establishing the bridge comprises the control module using packet injection at the endpoint to inject packets from the IP tunnel to the enterprise network, the packets injected to the enterprise network appearing to originate from the endpoint, and the control module sending packets from the enterprise network received by the endpoint through the IP tunnel.

5. The computer-implemented method of claim 1, further comprising:

translating IP addresses in network traffic received by the services platform from the enterprise network via the IP tunnel from enterprise network IP addresses to corresponding service platform IP addresses; and

translating IP addresses in network traffic destined from the services platform to the enterprise network via the IP tunnel from services platform IP addresses to corresponding IP enterprise network addresses.

6. The computer-implemented method of claim 1, wherein providing the network service to the enterprise network comprises providing one or more network services from the set consisting of:

vulnerability management, configuration auditing, file integrity monitoring, and compliance auditing.

7. A services platform for providing a network service to a remote enterprise network comprising:

a non-transitory computer-readable storage medium storing executable computer program modules; and

a computer processor for executing the computer program modules for performing steps comprising;

establishing an Internet Protocol (IP) tunnel between the services platform and an endpoint of the remote enterprise network responsive to execution of a control module on the endpoint;

establishing a bridge between the IP tunnel and the remote enterprise network responsive to the execution of the control module on the endpoint;

allocating a unique private IP address space to the remote enterprise network;

inventorying the remote enterprise network to identify a plurality of endpoints on the remote enterprise network, ones of the plurality of endpoints being identified with enterprise network IP addresses in an enterprise address space;

assigning services platform IP addresses within the unique private IP address space to identified ones of the plurality of endpoints; and

providing the network service to the remote enterprise network via the IP tunnel and bridge,

wherein the services platform provides network services to a plurality of remote enterprise networks and wherein a different unique private IP address space is allocated to one or more of the plurality of remote enterprise networks.

8. The services platform of claim 7, wherein the control module is provided from the services platform to the endpoint responsive to the request for network service from a user of the endpoint.

9. The services platform of claim 7, wherein the tunnel is formed at a layer of an Open Systems Interconnection model.

10. The services platform of claim 7, wherein establishing the bridge comprises the control module using packet injection at the endpoint to inject packets from the IP tunnel to the enterprise network, the packets injected to the enterprise network appearing to originate from the endpoint, and the control module sending packets from the enterprise network received by the endpoint through the IP tunnel.

11. The services platform of claim 7, further comprising:

translating IP addresses in network traffic received by the services platform from the enterprise network via the IP tunnel from enterprise network IP addresses to corresponding service platform IP addresses; and

translating IP addresses in network traffic destined from the services platform to the enterprise network via the IP tunnel from services platform IP addresses to corresponding IP enterprise network addresses.

12. The services platform of claim 7, wherein providing the network service to the enterprise network comprises providing one or more network services from the set consisting of:

vulnerability management, configuration auditing, file integrity monitoring, and compliance auditing.

13. A non-transitory computer-readable storage medium storing executable computer program modules for enabling a services platform to provide a network service to a remote enterprise network, the modules comprising:

an interaction module for interacting with a user of an endpoint of the remote enterprise network to enable the user to request the network service from the services platform;

a tunnel creation module for creating an IP tunnel between the endpoint and the services platform; and

a bridging module for bridging the IP tunnel with the remote enterprise network;

wherein the services platform performs;

allocating a unique private IP address space to the remote enterprise network;

inventorying the remote enterprise network to identify a plurality of endpoints on the remote enterprise network, ones of the plurality of endpoints being identified with enterprise network IP addresses in an enterprise address space;

assigning service platform IP addresses within the unique private IP address space to identified ones of the plurality of endpoints; and

providing the requested network service via the IP tunnel bridged with the remote enterprise network;

wherein the services platform provides network services to a plurality of remote enterprise networks and wherein a different unique private IP address space is allocated to one or more of the plurality of remote enterprise networks.

14. The computer-readable storage medium of claim 13, wherein the tunnel creation module creates the IP tunnel responsive to the request for the network service from the user of the endpoint.

15. The computer-readable storage medium of claim 13, wherein bridging the IP tunnel with the enterprise network comprises using packet injection at the endpoint to inject packets from the IP tunnel to the enterprise network, the packets injected to the enterprise network appearing to originate from the endpoint, and sending packets from the enterprise network received by the endpoint through the IP tunnel.

16. The computer-readable storage medium of claim 13, wherein the network service comprises a network service from the set consisting of:

vulnerability management, configuration auditing, file integrity monitoring, and compliance auditing.