Client-side network access polices and management applications

• US 20050022012A1
• Filed: 09/30/2002
• Published: 01/27/2005
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: Ginegar LLC (K.Mizra LLC)
• Original Assignee: Fiberlink Communications Corporation (International Business Machines Corporation)
• Inventors: Bluestone, Derek, Adams, Clint, Lebel, Pierre-Philippe, Yalamarti, Sriniyas
• Granted Patent: US 8,200,773 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2859 Point-to-point connection between the data network and the subscribers encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A remote access client is provided for enabling communication between a remote data terminal configured to access a public network, and an enterprise network by way of a VPN tunnel through the public network. The remote access client includes at least one application program interface (API) to receive a first verification of the operating state of a predetermined application of the remote data terminal to enable a connection agent for establishing a point of presence on the public network. Upon connection to the point of presence, the API exchanges data between the remote access client and the predetermined application of the remote data terminal. The remote access client receives a second periodic verification of the operating state of the predetermined application via the API for terminating the connection to the point of presence upon the absence of the second verification. The point of presence enables the VPN tunnel for transporting data from the remote data terminal to the enterprise network across the public network.

Claims

1. A remote access client for enabling communication between a remote data terminal configured to access a public network, and an enterprise network by way of a VPN tunnel through the public network, the remote access client comprising:

a connection agent configured to establish, in accordance with a selected carrier of the public network, a connection to a point of presence on the public network for transporting data between the remote data terminal and the enterprise network via the VPN tunnel; and

at least one application program interface (API), the remote access client employing the API to receive verification of the operating state of a predetermined application of the remote data terminal, the remote access client enabling the connection agent upon the verification to establish the point of presence,

wherein, the point of presence enables the VPN tunnel in accordance with a VPN client for transporting data from the remote data terminal to the enterprise network across the public network.

2. The remote access client of claim 1, wherein a client policy identifies the predetermined application.

3. The remote access client of claim 1, wherein the selected carrier of the public network is one of a plurality of available carriers.

4. The remote access client of claim 3, wherein the client policy is resident in a memory of the remote data terminal and identifies a firewall program as the predetermined application.

5. A remote access client for enabling communication between a remote data terminal configured to access a public network, and an enterprise network by way of a VPN tunnel through the public network, the remote access client comprising:

a connection agent configured to establish, in accordance with a selected carrier of the public network, a connection to a point of presence on the public network for transporting data between the remote data terminal and the enterprise network via the VPN tunnel; and

at least one application program interface (API), the remote access client employing the API for exchanging data with a predetermined application of the remote data terminal upon connection to of the point of presence, the API receiving periodic verification of the operating state of the predetermined application, the connection agent terminating the connection to the point of presence upon the absence of verification,

wherein, the point of presence enables as the VPN tunnel in accordance with a VPN client for transporting data from the remote data terminal to the enterprise network across the public network.

6. The remote access client of claim 5, further comprising a daemon for actively monitoring the operating state of the predetermined application.

7. The remote access client of claim 5, wherein a client policy identifies the predetermined application.

8. The remote access client of claim 5, wherein the selected carrier of the public network is one of a plurality of available roaming carriers.

9. The remote access client of claim 7, wherein the client policy is resident in a memory of the remote data terminal and identifies a firewall program as the predetermined application.

10. A method of enabling communication between a remote data terminal configured to access a public network, and an enterprise network by way of a VPN tunnel through the public network, the method comprising:

launching a remote access client of the remote data terminal having at least one application program interface (API), the remote access client employing the API to receive verification of the presence of a predetermined application of the remote data terminal; and

enabling a connection agent upon the verification to establish connection to a point of presence, wherein, the point of presence enables the VPN tunnel in accordance with a VPN client for transporting data from the remote data terminal to the enterprise network across the public network.

11. The method of claim 10, further comprising:

providing a client policy to the remote data terminal for identifying the predetermined application prior to launching the remote access client.

12. The method of claim 10, further comprising:

updating the client policy upon connection to the point of presence.

13. A method of enabling communication between a remote data terminal configured to access a public network, and an enterprise network by way of a VPN tunnel through the public network, the method comprising:

launching a remote access client of the remote data terminal having at least one application program interface (API), the remote access client employing the API to receive a first verification of an operating state of a predetermined application of the remote data terminal and for exchanging data with the predetermined application of the remote data terminal;

enabling a connection agent upon reception of the first verification to establish the point of presence;

receiving a second periodic verification of the operating state of the predetermined application via the API; and

terminating the connection to the point of presence upon the absence of the second verification, wherein, the point of presence enables as the VPN tunnel for transporting data from the remote data terminal to the enterprise network across the public network.

14. A computer readable carrier including computer program instructions that cause a computer to implement a method to access a public network, and an enterprise network by way of a VPN tunnel through the public network, the method comprising steps of:

launching a remote access client of the remote data terminal having at least one application program interface (API), the remote access client employing the API to receive a first verification of the presence of a predetermined application of the remote data terminal and for exchanging data with the predetermined application of the remote data terminal;

enabling a connection agent upon reception of the first verification to establish the point of presence;

receiving a second periodic verification of the operating state of the predetermined application via the API; and

terminating the connection to the point of presence upon the absence of the second verification, wherein, the point of presence enables the VPN tunnel for transporting data from the remote data terminal to the enterprise network across the public network.

15. A virtual private network system for accessing a public network, and an enterprise network by way of a VPN tunnel through the public network, the system, comprising:

a remote data terminal including,

i. a remote access client for transporting data over a VPN link in accordance with a VPN protocol, the remote access client having a connection agent for establishing, in accordance with a selected carrier of the public network, a connection to a point of presence on the public network for transporting data between the remote data terminal and the enterprise network, and at least one application program interface (API), the remote access client employing the API to receive verification of the presence of a predetermined application of the remote data terminal, the remote access client enabling the connection agent upon the verification to establish the connection to the point of presence,

ii. a policy profile for identifying the predetermined application, and

iii. a user experience log for storing connection parameters detailing a connection history between the remote data terminal and the point of presence; and

a POP of an access provider responsive to the connection agent for providing a PPP connection to the remote data terminal upon verification, the access provider receiving the contents of the user experience log from the remote data terminal upon connection, wherein, the point of presence enables the VPN tunnel for transporting data from the remote data terminal to the enterprise network across the public network.

16. The system of claim 15 wherein, upon verification, the remote data terminal receives updates from the access provider for altering the contents of the policy profile.

17. The system of claim 15 further comprising:

a phone book for providing contact indicia to the connection agent of the remote access client.

18. The system of claim 17, wherein, upon verification, the remote data terminal receives updates from the access provider for altering the contents of the phone book.

19. The system of claim 18, wherein the phonebook updates are responsive to the connection parameters uploaded in the user experience logs.

20. A method of providing access to an enterprise network by way of a public network, for enabling a virtual private network connection between the private network and a remote data terminal via the public network, comprising:

providing an application suite to a remote user of the remote data terminal, the application suite including

i. a remote access client configuring a VPN link between the enterprise network and the remote data terminal,

ii. at least one policy compliant application, and

iii. a phone book including contact indicia for establishing

connection to the public network via the remote access client, wherein a policy profile of the remote data terminal is employed for detailing the cooperative execution of the at least one policy compliant application relative to the Remote access client.

21. The method of claim 20, wherein the application suite includes a utility for uploading user experience data to the public network.

22. The method of claim 20, wherein the application includes a utility for receiving updates to the policy profile from the public network.

23. The method of claim 20, wherein the method further comprises:

providing the policy profile to the remote data terminal upon connection to the public network.