Systems and Methods of Providing An Intranet Internet Protocol Address to a Client on a Virtual Private Network

• US 20080046994A1
• Filed: 08/21/2006
• Published: 02/21/2008
• Est. Priority Date: 08/21/2006
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Soni, Ajay, Venkatraman, Charu, He, Junxiao
• Granted Patent: US 8,418,243 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

The intranet IP address management solution of the appliance and/or client described herein provides an environment for efficiently assigning, managing and querying virtual private network addresses, referred to as intranet IP (IIP) addresses of virtual private network users, such as a multitude of SSL VPN users on an enterprise network. The appliance provides techniques and policies for assigning previously assigned virtual private network addresses of a user to subsequent sessions of the user as the user logs in multiple times or roams between access points. This technique is referred to IIP stickiness as the appliance attempts to provide the same IIP address to a roaming VPN user. The appliance also provides a configurable user domain naming policy so that one can ping or query the virtual private network address of a user by an easily referenceable host name identifying the user. The appliance and/or client agent also provide techniques to allow applications to seamlessly and transparently communicate on the virtual private network using the virtual private network address of the user or client on the private network.

Claims

1. A method for responding to a request of an application for a client'"'"'s network identifier with an intranet network identifier of the client on a secure socket layer virtual private network (SSL VPN) connection to a network, the method comprising the steps of:

(a) requesting, by an application on a client, a network identifier of the client, the client connected from a first network to a second network by a SSL VPN connection established via an appliance, the appliance assigning to the client an intranet network identifier on the second network;

(b) intercepting, by a hooking mechanism of an agent on the client, the request; and

(c) providing, by the hooking mechanism, to the application the intranet network identifier of the client on the second network in response to the request.

2. The method of claim 1, comprising transmitting, by the agent, a request to the appliance for the intranet network identifier of the client on the second network, and in response to the request, transmitting, by the appliance, to the agent the intranet network identifier of the client on the second network.

3. The method of claim 2, comprising querying, by the appliance, the intranet network identifier of the client in a routing table.

4. The method of claim 1, comprising establishing, by the agent, the SSL VPN to the second network.

5. The method of claim 1, wherein the network identifier comprises one of an internet protocol address or a host name.

6. The method of claim 1, comprising requesting, by the application, an internet protocol address of the client corresponding to a host name of the client.

7. The method of claim 1, comprising requesting, by the application, a socket address data structure corresponding to a host name of the client.

8. The method of claim 1, comprising requesting, by the application, the network identifier of the client via one of the following application programming interface calls:

gethostbyname, getaddrinfo, WSAIoctl, getsockname, WSALookupServiceBegin, WSALookupServiceNext, and WSALookupServiceEnd.

9. The method of claim 1, wherein the application comprises an online collaboration tool.

10. The method of claim 8, comprising establishing, by the online collaboration tool, a connection to an online collaboration environment on the second network using the intranet network identifier of the client on the second network.

11. The method of claim 1, comprising designating, by the appliance, a plurality of intranet internet protocol addresses for a user of the client.

12. The method of claim 11, comprising assigning, by the appliance, to the client a first intranet internet protocol address from the plurality of intranet internet protocol addresses based on identification of the user of the client.

13. The method of claim 1, comprising hosting, by the appliance, on the second network the intranet network identifier of the client.

14. A system for responding to a request of an application for a client'"'"'s network identifier with an intranet network identifier of the client on a secure socket layer virtual private network (SSL VPN) connection to a network, the system comprising:

means for requesting, by an application on a client, a network identifier of the client, the client connected from a first network to a second network by a SSL VPN connection established via an appliance, the appliance assigning to the client an intranet network identifier on the second network;

mean for intercepting, by a hooking mechanism of an agent on the client, the request; and

means for providing, by the hooking mechanism, to the application the intranet network identifier of the client on the second network in response to the request.

15. The system of claim 14, wherein the agent transmits a request to the appliance for the intranet network identifier of the client on the second network, and in response to the request, the appliance transmits to the agent the intranet network identifier of the client on the second network.

16. The system of claim 14, wherein the appliance queries the intranet network identifier of the client in a routing table.

17. The system of claim 14, wherein the agent establishes the SSL VPN to the second network.

18. The system of claim 14, wherein the network identifier comprises one of an internet protocol address or a host name.

19. The system of claim 14, wherein the application requests an internet protocol address of the client corresponding to a host name of the client.

20. The system of claim 14, wherein the application requests a socket address data structure corresponding to a host name of the client.

21. The system of claim 14, wherein the application requests the network identifier of the client via one of the following application programming interface calls:

gethostbyname, getaddrinfo, WSAIoctl, getsockname, WSALookupServiceBegin, WSALookupServiceNext, and WSALookupServiceEnd.

22. The system of claim 14, wherein the application comprises an online collaboration tool.

23. The system of claim 14, wherein the online collaboration tool establishes a connection to an online collaboration environment on the second network using the intranet network identifier of the client on the second network.

24. The system of claim 14, wherein the appliance designates a plurality of intranet internet protocol addresses for a user of the client.

25. The system of claim 24, wherein the appliance assigns to the client a first intranet internet protocol address from the plurality of intranet internet protocol addresses based on identification of the user of the client.

26. The system of claim 14, wherein the appliance hosts on the second network the intranet network identifier of the client.