System and method to secure communications over a public network

• US 8,762,447 B2
• Filed: 05/02/2008
• Issued: 06/24/2014
• Est. Priority Date: 05/02/2008
• Status: Active Grant

• Current Assignee: General Electric Company
• Original Assignee: General Electric Company
• Inventors: Oren-Dahan, Ofir
• Primary Examiner(s): DOAN, DUYEN MY
• Application Number:
  US12/114,118
• Publication Number:
  US 20090323718A1
• Time in Patent Office: 2,244 Days
• Field of Search: 709/203, 709/230, 726 14- 15
• US Class Current: 709/203
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Systems, methods and apparatus are provided through which in some aspects a method to provide secure communications between a plurality of computers over a public network includes establishing a connection over the public network between the plurality of computers by mimicking hypertext transport protocol (HTTP) enterprise tunnel (HET) server protocol and changing the connection to a multiplexing protocol.

Claims

1. A system comprising:

a processor; and

a storage device coupled to the processor comprising executable instructions capable of directing the processor to control;

a tunnel layer that includes a multiplexing tunnel component and a hypertext transport protocol enterprise tunnel component that is operably coupled to the multiplexing tunnel component,

wherein the hypertext transport protocol enterprise tunnel component includes a universal secure socket layer wrapper that is configured to secure communication through the tunnel layer,

wherein the multiplexing tunnel component is configured to tunnel local clients communication to persistent remote access control services over a public network without opening any incoming ports.

2. The system of claim 1, wherein the multiplexing tunnel component is operable to:

establish a connection over the public network between a plurality of computers by starting with the hypertext transport protocol enterprise tunnel component; and

after the tunnel is established change the connection to a multiplexing protocol.

3. The system of claim 1, wherein the multiplexing tunnel component further comprises:

multiplex communication on a connection over a single transmission control protocol Internet protocol port.

4. The system of claim 1, wherein the multiplexing tunnel component is operable to tunnel remote clients communication to persistent local access control services.

5. The system of claim 1, wherein the multiplexing tunnel component is operable to send event notifications between two MT components using a control channel.

17. The system of claim 1, wherein the tunnel layer does not comprise virtual private network (VPN) Internet protocol security (IPSEC), OpenVPN, or a secure shell (SSH).

18. The system of claim 1, wherein the multiplexing tunnel component is configured to provide up to 65534 sockets to tunnel local clients communication to remote services over the public network without opening any incoming ports.

19. The system of claim 1, wherein the persistent remote access control services comprise virtual network computing (VNC) services, Telnet services, or a combination thereof.

20. The system of claim 4, wherein the persistent local access control services comprise virtual network computing (VNC) services, Telnet services, or a combination thereof.

6. A method to provide secure communications between a plurality of computers over a public network, the method comprising:

establishing a connection over the public network between the plurality of computers by using a hypertext transport protocol enterprise tunnel protocol;

changing a protocol of the connection to a multiplexing protocol; and

multiplexing communication on the connection over a single transmission control protocol Internet protocol port by tunneling local clients communication to remote services over the public network without opening any incoming ports, wherein the remote services comprise one or both of a Telnet service or a virtual network computing (VNC) service.

7. The method of claim 6, wherein establishing the connection further comprises:

sending a first buffer as a handshake authentication, the first buffer including a signature and version information.

8. The method of claim 6, comprising:

respectively associating a plurality of local sockets with a plurality of channel numbers of the connection, wherein the plurality of channel numbers respectively correspond to a plurality of channels; and

maintaining a mapping between the plurality of local sockets and the plurality of channel numbers wherein.

9. The method of claim 8, wherein the plurality of channels includes a control channel.

10. The method of claim 8, wherein:

reading data on the local socket from a first of the plurality of computers,

transmitting the data with a header to a second of the plurality of computers, the header including the channel number and a buffer size; and

the transmitted data is decoded by the second of the plurality computers, and the decoded data is written by the second of the plurality computers to an appropriate local socket according to the channel number.

11. The method of claim 6, wherein the changing is performed by a multiplexing tunnel data source.

12. The method of claim 11, wherein the multiplexing tunnel data source performs:

launching a communication tool without waiting for establishment of additional tunnels.

13. A non-transitory computer-accessible medium to secure communications over a public network, the medium comprising:

a component that is compliant with a hypertext transport protocol enterprise tunnel protocol; and

a non-transitory component configured to couple to the hypertext transport protocol enterprise tunnel and configured to establish a persistent connection over the public network between a plurality of computers by using the hypertext transport protocol enterprise tunnel protocol, the non-transitory component configured to switch the connection to a multiplexing protocol, thereby tunneling a single transmission control protocol Internet protocol port over the public network without opening an incoming port.

14. The medium of claim 13, wherein the non-transitory component comprises:

a multiplexing tunnel data source operable to couple to the hypertext transport protocol enterprise tunnel and operable to establish the connection over the public network between the plurality of computers by mimicking the hypertext transport protocol enterprise tunnel protocol and operable to switch the connection to the multiplexing protocol.

15. The medium of claim 13, wherein the medium is operable to control:

a tunnel layer,

wherein the tunnel layer includes a multiplexing tunnel and a hypertext transport protocol enterprise tunnel coupled to the multiplexing tunnel.

16. The medium of claim 13, wherein the multiplexing protocol includes a plurality of packets, and wherein each of the plurality of packets comprises two bytes for channel number and two bytes for buffer size and data.