Secure virtual private network utilizing a diagnostics policy and diagnostics engine to establish a secure network connection

• US 7,840,514 B2
• Filed: 09/22/2006
• Issued: 11/23/2010
• Est. Priority Date: 09/22/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Maxsp Corporation
• Inventors: Keith, Jr., Robert O.
• Primary Examiner(s): Sparks, Donald
• Assistant Examiner(s): CHANG, LI WU
• Application Number:
  US11/525,728
• Publication Number:
  US 20080127294A1
• Time in Patent Office: 1,523 Days
• Field of Search: 709/47
• US Class Current: 706/47
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure virtual private network (VPN) is described herein. The secure VPN implements standard VPN software with diagnostics to ensure a client device coupling to the VPN is secure. The diagnostics include a policy, a library and an engine where the policy determines what the requirements are for permitting the client device to couple to the VPN. The library stores programs for checking if the client device has any problems. The engine gathers information related to the client device and executes the programs stored within the library. When a user attempts to couple to the VPN with a client device, the server initiates the policy, library and engine to check for issues, and then the user is informed of the issues and/or a mechanism automatically fixes the issues. After the client device is verified as secure, it is able to couple to the VPN for data transfers.

Claims

1. A system for providing a secure communications link between a server and a client device over a virtual private network comprising:

a. a diagnostics policy stored on the server, wherein the diagnostics policy comprises one or more device configurations and/or components that the client device must have in order to securely couple to the server, and further wherein an initial coupling of the client device with the server is established for downloading the diagnostics policy to the client device;

b. a library stored on the client device for storing information;

c. a diagnostics engine stored on the client device for using the diagnostics policy and the library to detect and resolve one or more issues on the client device wherein detecting and resolving the one or more issues increases security on a communications link between the server and the client device; and

d. a network communication module for establishing a network connection between the client device and the server over the virtual private network, wherein the network communication module with the diagnostics engine prevents communications between the client device and the server unrelated to the diagnostics policy until the one or more issues are resolved by ensuring the network connection is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers.

2. The system as claimed in claim 1 wherein the library is an expert system library.

3. The system as claimed in claim 1 wherein the policy is for designating one or more objects to inspect.

4. The system as claimed in claim 1 wherein the diagnostics policy is for determining the requirements needed to be met for a connection to be established.

5. The system as claimed in claim 1 wherein information related to the diagnostics policy is downloaded from the server to the client device.

6. The system as claimed in claim 1 wherein the diagnostics policy contains groupings of sub-policies.

7. The system as claimed in claim 6 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

8. The system as claimed in claim 1 wherein the client device is a selected one of a mobile device and a home user device.

9. The system as claimed in claim 1 wherein the information stored within the library includes one or more programs.

10. The system as claimed in claim 9 wherein the one or more programs stored within the library are wrapped in XML.

11. The system as claimed in claim 1 wherein the diagnostics engine informs a user of the problems if the client device does not pass.

12. The system as claimed in claim 1 wherein the one or more issues discovered by the diagnostics engine are automatically fixed.

13. The system as claimed in claim 1 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

14. A system for providing a secure communications link between a server and a client device over a virtual private network comprising:

a. a diagnostics policy stored on the server wherein the diagnostics policy comprises a set of requirements that the client device must have in order to be permitted to couple to the server and is for designating one or more objects to inspect and for determining the requirements needed to be met for a secure connection to be established between the server and the client device, further wherein the diagnostics policy is downloaded from the server to the client device, wherein an initial coupling of the client device with the server is established for the downloading of the diagnostics policy;

b. an expert system library stored on the client device for storing one or more programs;

c. a diagnostics engine stored on the client device for using the diagnostics policy and the library to detect and resolve one or more issues on the client device wherein detecting and resolving the one or more issues increases security on a communications link between the server and the client device; and

d. a network communication module for establishing a network connection between the client device and the server over the virtual private network, wherein the network communication module with the diagnostics engine prevents communications unrelated to the diagnostics policy between the client device and the server until the one or more issues are resolved by ensuring the network connection is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers.

15. The system as claimed in claim 14 wherein the client device is a selected one of a mobile device and a home user device.

16. The system as claimed in claim 14 wherein the one or more programs stored within the library are wrapped in XML.

17. The system as claimed in claim 14 wherein the diagnostics policy contains groupings of sub-policies.

18. The system as claimed in claim 17 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

19. The system as claimed in claim 14 wherein the diagnostics engine informs a user of the problems if the client device does not pass.

20. The system as claimed in claim 14 wherein the one or more issues discovered by the diagnostics engine are automatically fixed.

21. The system as claimed in claim 14 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

22. A method of securing a communications link between a server and a client device over a virtual private network comprising:

a. coupling the client device with the server over the virtual private network;

b. establishing a limited network connection between the client device and the server, wherein the limited network connection is established for downloading a diagnostics policy to the client device, and further wherein the diagnostics policy comprises one or more device configurations and/or components that the client device must have in order to securely couple to the server;

c. preventing communications between the client device and the server unrelated to the diagnostics policy until a secure network connection is established by ensuring the secure network connection is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers;

d. downloading the diagnostics policy from the server to the client device;

e. running a diagnostics engine utilizing a library on the client device; and

f. establishing a secure network connection if the diagnostics engine completes without any issues or when any issues are resolved.

23. The method as claimed in claim 22 wherein the library is an expert system library.

24. The method as claimed in claim 22 further comprising posting a list of issues when the diagnostics engine fails.

25. The method as claimed in claim 22 further comprising automatically fixing the one or more issues when the diagnostics engine fails.

26. The method as claimed in claim 22 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

27. The method as claimed in claim 25 wherein automatically fixing the one or more issues is selected from the group consisting of downloading applications, downloading application updates, downloading patches, running applications and modifying a registry.

28. The method as claimed in claim 22 further comprising adding custom tools within the library.

29. The method as claimed in claim 22 wherein running the diagnostics engine includes checking for network issues and system issues.

30. A network of devices for establishing a secure virtual private network comprising:

a. a private network containing one or more secure devices, wherein at least one of the one or more secure devices is a server for storing a diagnostics policy, wherein the diagnostics policy comprises one or more device configurations and/or components that the client device must have in order to securely couple to the server;

b. one or more client devices coupled to the private network through a public network over a virtual private network, wherein the one or more client devices contain a diagnostics engine and a diagnostics library, wherein an initial coupling of the one or more client devices with the server is established for downloading the diagnostics policy to the one or more client devices; and

c. a network communication module for establishing a network connection between the one or more client devices and the server over the virtual private network, wherein the network communication module with the diagnostics engine prevents communications between the client device and the server unrelated to the diagnostics policy until any issues detected by the diagnostics engine are resolved by ensuring the network connection is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers.

31. The network of devices as claimed in claim 30 wherein information related to the diagnostics policy is downloaded to the one or more client devices.

32. The network of devices as claimed in claim 30 wherein the one or more client devices are not able to access the private network without being verified using the diagnostics policy, the diagnostics engine and the diagnostics library.

33. The network of devices as claimed in claim 30 wherein the client devices are selected from the group consisting of personal computers, PDAs, cell phones, laptop computers, thin clients and Apple personal computers, mp3 players and gaming consoles.

34. The network of devices as claimed in claim 30 wherein the diagnostics library is an expert system library.

35. The network of devices as claimed in claim 30 wherein the diagnostics policy is for designating one or more objects to inspect.

36. The network of devices as claimed in claim 30 wherein the diagnostics policy is for determining the requirements needed to be met for a connection to be established.

37. The network of devices as claimed in claim 30 wherein the diagnostics policy contains groupings of sub-policies.

38. The network of devices as claimed in claim 37 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

39. The network of devices as claimed in claim 30 wherein the diagnostics library includes one or more programs.

40. The network of devices as claimed in claim 39 wherein the one or more programs stored within the diagnostics library are wrapped in XML.

41. The network of devices as claimed in claim 30 wherein the diagnostics engine informs a user of issues if the client device does not pass.

42. The network of devices as claimed in claim 30 wherein issues discovered by the diagnostics engine are automatically fixed.

43. The network of devices as claimed in claim 30 wherein the diagnostics engine optionally assists in manually fixing issues discovered by the diagnostics engine.

44. A communications apparatus for providing a secure communications link between a server and a client device over a virtual private network comprising:

a. a diagnostics policy stored on the server, wherein an initial coupling of the client device with the server prevents communications between the client device and the server unrelated to the diagnostics policy by ensuring the initial coupling is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers, and further wherein the diagnostics policy comprises one or more device configurations and/or components that the client device must have in order to securely couple to the server;

b. a library stored on the client device for storing information; and

c. a diagnostics engine stored on the client device for using the diagnostics policy and the library to detect and resolve one or more issues on the client device wherein detecting and resolving the one or more issues increases security on a communications link between the server and the client device, wherein if the diagnostics engine determines that the client device is secure then a secure coupling between the client device and the server sufficient for full data transfers is established over the virtual private network.

45. A communications apparatus for providing a secure communications link between a server and a client device over a virtual private network comprising:

a. a diagnostics policy stored on the server comprising a set of requirements that the client device must have in order to be permitted to couple to the server, wherein an initial coupling of the client device with the server prevents communications between the client device and the server unrelated to the diagnostics policy by ensuring the initial coupling is sufficient for downloading the diagnostics policy to the client device, but insufficient for full data transfers;

b. a library stored on the client device for storing information; and

c. a diagnostics engine stored on the client device for using the diagnostics policy and the library to detect and resolve one or more issues related to the requirements on the client device, wherein the detecting and resolving of the one or more issues occurs after installation of the diagnostics engine and increases security on a communications link between the server and the client device, wherein if the diagnostics engine determines that the client device is secure then a secure coupling between the client device and the server sufficient for full data transfers is established over the virtual private network.