Method and system for providing secure access to private networks

• US 8,738,731 B2
• Filed: 12/03/2012
• Issued: 05/27/2014
• Est. Priority Date: 09/26/2000
• Status: Expired due to Term

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tock, Theron, Srinivas, Sampath
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US13/692,443
• Publication Number:
  US 20130117821A1
• Time in Patent Office: 540 Days
• Field of Search: 709200-203, 709217-227, 709/228, 709/229
• US Class Current: 709/217
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Improved approaches for providing secure access to resources maintained on private networks are disclosed. The secure access can be provided through a public network using a standard network browser. Multiple remote users are able to gain restricted and controlled access to at least portions of a private network through a common access point. The solution provided by the invention is not only easily set up and managed, but also able to support many remote users in a cost-effective manner.

Claims

1. A method comprising:

receiving, by a first server, a request from a client device;

determining, by the first server, a time associated with the request;

determining, by the first server and based on the time associated with the request, that the client device is permitted to access a second server that is connected to the first server via a private network;

obtaining, by the first server and based on the request, content from the second server after determining that the client device is permitted to access the second server;

modifying, by the first server, the content to form modified content; and

transmitting, by the first server, the modified content to the client device.

2. The method of claim 1, where modifying the content includes:

inserting a toolbar into the content to form the modified content.

3. The method of claim 1, where modifying the content includes:

modifying one or more links of the content to include an address associated with the first device to form the modified content.

4. The method of claim 1, where determining that the client device is permitted to access the second server includes:

determining access limitations associated with the client device,

the access limitations specifying one or more time periods when the client device is permitted to access the second server, and

determine that the client device is permitted to access the second server based on the time being within one of the one or more time periods.

5. The method of claim 1, where obtaining the content includes:

obtaining the content by communicating with the private network via a firewall.

6. The method of claim 1, where determining that the client device is permitted to access the second server includes:

determining access information associated with the client device, and

determining that the client device is permitted to access the second server based on the time associated with the request and the access information.

7. The method of claim 6, where the access information indicates that the client device is permitted to access the second server and is not permitted to access a third server connected to the first server via the private network.

8. The method of claim 1, further comprising:

receiving a login request from the client device; and

authenticating, before receiving the request, the client device or a user of the client device based on the login request.

9. The method of claim 1, where determining that the client device is permitted to access the second server includes:

determining that the request includes an identifier that indicates at least one of that the client device is authenticated or that a session associated with the client device is valid, and

determining that the client device is permitted to access the second server based on the time associated with the request and after determining that the request includes the identifier.

10. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by at least one processor of a first server, cause the at least one processor to;

receive a request from a client device;

determine a time associated with the request;

determine, based on the time associated with the request, that the client device is permitted to access resources available on a private network connected to the first server;

obtain, based on the request, content from a second server connected to the private network after determining that the client device is permitted to access resources available on the private network;

modify the content to form modified content; and

transmit the modified content to the client device.

11. The non-transitory computer-readable medium of claim 10, where the one or more instructions to determine that the client device is permitted to access resources available on the private network include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

determine an address associated with the client device, and

determine that the client device is permitted to access resources available on the private network based on the address and the time associated with the request.

12. The non-transitory computer-readable medium of claim 10, where the one or more instructions to determine that the client device is permitted to access resources available on the private network include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

determine access limitations associated with the client device,

the access limitations specifying one or more time periods when the client device is permitted to access resources available on the private network, and

determine that the client device is permitted to access resources available on the private network based on the time being within one of the one or more time periods.

13. The non-transitory computer-readable medium of claim 10, where the one or more instructions to determine that the client device is permitted to access resources available on the private network include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

determine a particular type of operation associated with the request,

the particular type of operation corresponding to obtaining the content from the second server, and

determine that the client device is permitted to access resources available on the private network based on the time associated with the request and the particular type of operation being one of one or more operations that are permitted for the client device or a user of the client device.

14. The non-transitory computer-readable medium of claim 10, where the one or more instructions to determine that the client device is permitted to access resources available on the private network include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

determine that the request is associated with the second server,

determine one or more servers that are accessible by the client device or a user of the client device, and

determine that the client device is permitted to access resources available on the private network based on the time associated with the request and the second server being one of the one or more servers.

15. The non-transitory computer-readable medium of claim 10, where the instructions further include:

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

receive, before receiving the request, a login request from the client device,

transmit, based on the login request, information to an authentication server connected to the private network, and

receive a response from the authentication server that indicates that the client device is authenticated, and

where the one or more instructions to determine that the client device is permitted to access resources available on the private network include;

one or more instructions that, when executed by the at least one processor, cause the at least one processor to;

determine that the client device is permitted to access resources available on the private network based on the time associated with the request and the client device being authenticated.

16. A system comprising:

one or more processors to;

receive a request from a client device;

determine a time associated with the request;

determine, based on the time associated with the request, that the client device is permitted to access a server that is connected to a private network;

obtain, based on the request, content from the server after determining that the client device is permitted to access the server;

modify the content to form modified content; and

transmit the modified content to the client device.

17. The system of claim 16, where, when obtaining the content from the server, the one or more processors are to:

determine an identifier associated with the server,

obtain an address associated with the server based on the identifier, and

obtain the content from the server based on the address and the request.

18. The system of claim 16, where, when obtaining the content from the server, the one or more processors are to:

transmit the request to the server, and

receive, from the server, the content as a response to the request.

19. The system of claim 16, where, when modifying the content, the one or more processors are to:

determine that the content is of a type that is to be modified, and

modify the content to form the modified content after determining that the content is of the type that is to be modified.

20. The system of claim 16, where, when modifying the content, the one or more processors are to one or more of:

insert a toolbar into the content to form the modified content, or

modify one or more links within the content to form the modified content by modifying a host name included in the one or more links or adding one or more suffixes to the one or more links.