POLICY-BASED TRUSTED PEER-TO-PEER CONNECTIONS

• US 20170053136A1
• Filed: 10/19/2015
• Published: 02/23/2017
• Est. Priority Date: 08/20/2015
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: KADAVAN, SEEMA, KAMICHETTY, SHANTI, HALLAD, SACHIN, MANU, APARNA, NAZARETH, MANU, BHAT, MANJUNATH
• Granted Patent: US 10,936,674 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1063 Discovery through centralising entities

Abstract

Disclosed are various examples for implementations of policy-based trusted peer-to-peer connections. A computing device can receive a message from a first client device, the message specifying a public address of the first client device and an identifier of the second client, device. The computing device can then send a query to a computing device, wherein the query specifies an identifier of the first client device and the identifier of the second client device. The computing device can also determine that the first client device is authorized to communicate with the second client device based on a response to the query received from the second computing device. In some instances, the computing device can then send the public address of the first client device to the second client device.

Claims

1. A system, comprising:

a first computing device comprising a processor and a memory, and

an application comprising a set of machine-readable instructions stored in the memory and executable by the processor, wherein the machine-readable instructions, when executed, cause the first computing device to at least;

determine a public address of a first client device and an identifier of a second client device, wherein the public address of the first client device and the identifier of the second client device are specified in a message received from the first client device;

send a query to a second computing device, wherein the query specifies an identifier of the first client device and the identifier of the second client device;

determine that the first client device is authorized to communicate with the second client device based on a response to the query received from the second computing device; and

send the public address of the first client device to the second client device.

2. The system of claim 1, wherein the public address is a first public address, and the machine-readable instructions, when executed, further cause the first computing device to:

identify a second public address corresponding to the second client device and an identifier of the first client device, wherein the second public address corresponding to the second client device and the identifier of the first client device are specified in a message received from the second client device;

determine that the second client device is authorized to communicate with the first client device based on the response to the query received from the second computing device; and

send the public address of the second client device to the first client device.

3. The system of claim 1, wherein the application comprises a first application and the system further comprises a second application executable by the second computing device, wherein the second application, when executed, causes the second computing device to:

identify a first policy assigned to the first client device;

determine that the first policy grants permission for the first client device to communicate with the second client device;

identify a second policy assigned to the second client device;

determine that the second policy grants permission for the second client device to communicate with the first client device; and

send to the first computing device the response to the query, the response comprising an indication that the first client device and the second client device are authorized to communicate with each other.

4. The system of claim 3, wherein the first policy grants permission for the first client device to communicate with the second client device based on a status of the second client device.

5. The system of claim 4, wherein the status of the second client device comprises at least one of:

a registered owner of a the second client device;

a current user of the second client device;

a current version of an operating system of the second client device;

an identity of an application installed on the second client device;

an identity of a current network connection of the second client device;

an indication that the second client device has been jailbroken;

or

a current location of the second client device.

6. The system of claim 1, wherein the machine-readable instructions, when executed, further cause the first computing device to at least:

send a first public key associated with the first client device to the second client device; and

send a second public key associated with the second client device to the first client device.

7. The system of claim 1, wherein the public address of the first client device comprises a port number and a fully qualified domain name.

8. A method, comprising:

receiving a message from a first client device, the message specifying a public address of the first client device and an identifier of a second diem device;

sending a query to a computing device, wherein the query specifies an identifier of the first client device and the identifier of the second client device;

determining that the first client device is authorized to communicate with the second client device based on a response to the query received from the computing device; and

sending the public address of the first client device to the second client device.

9. The method of claim 8, wherein the public address is a first public address, the message from the first client device is a first message, and the method further comprises:

receiving a second message from the second client device, the second message specifying a second public address corresponding to the second client device and the identifier of the first client device;

determine that the second client device is authorized to communicate with the first client device based on the response to the query received from the computing device; and

send the public address of the second client device to the first client device.

10. The method of claim 8, wherein the response to the query is based on at least one of:

a determination that a first policy assigned to the first client device grants permission for the first client device to communicate with the second client device;

or

a determination that a second policy assigned to the second client device grants permission for the second cheat device to communicate with the first client device.

11. The method of claim 10, wherein the first policy grants permission for the first client device to communicate with the second client device based on the status of the client device.

12. The method of claim 11, wherein the status of the second client device comprises at least one of:

a registered owner of a the second client device;

a current user of the second client device;

a current version of an operating system of the second client device;

an identity of an application installed on the second client device;

an identity of a current network connection of the second client device;

an indication that the second client device has been jailbroken;

or

a current location of the second client device.

13. The method of claim 8, further comprising:

sending a first public key associated with the first client device to the second client device; and

sending a second public key associated with the second client device to the first client device.

14. The method of claim 8, wherein the public address of the first client device comprises a port number and an address formatted according to a version of the Internet Protocol (IP).

15. A non-transitory computer-readable medium comprising a set of instructions that, when executed by a processor of a computing device, cause the computing device to at least:

receive a message from a first client device, the message specifying a public address of the first client device and an identifier of a second client device;

send a query to a computing device, wherein the query specifies an identifier of the first client device and the identifier of the second client device;

determine that the first client device is authorized to communicate with the second client device based on a response to the query received from the computing device; and

send the public address of the first client device to the second client device.

16. The non-transitor computer-readable medium of claim 15, wherein the public address is a first public address, the message from the first client device is a first message, and the set of instructions further cause the computing device to at least:

receive a second message from the second client device, the second message specifying a second public address corresponding to the second client device and the identifier of the first client device;

determine that the second client device is authorized to communicate with the first client device based on the response to the query received from the computing device; and

send the public address of the second client device to the first client device.

17. The non-transitory computer-readable medium of claim 15, wherein the response to the query is based on at least one of:

a determination that a first policy assigned to the first client device grants permission for the first client device to communicate with the second client device;

or

a determination that a second policy assigned to the second client device grants permission for the second client device to communicate with the first client device.

18. The non-transitor computer-readable medium of claim 17, wherein the first policy grants permission for the first client device to communicate with the second client device based on the status of the second client device.

19. The non-transitory computer-readable medium of claim 18, wherein the status of the second client device comprises at least one of:

a registered owner of a the second client device;

a current user of the second client device;

a current version of an operating system of the second client device;

an identity of an application installed on the second client device;

an identity of a current network connection of the second client device;

an indication that the second client device has been jailbroken;

or

a current location of the second client device.

20. The non-transitory computer-readable medium of claim 15, wherein the set of instructions further cause the computing device to at least:

sending a first public key associated with the first client device to the second client device; and

sending a second public key associated with the second client device to the first client device.