Method and system for providing secure access to private networks with client redirection

• US 7,958,245 B2
• Filed: 10/20/2009
• Issued: 06/07/2011
• Est. Priority Date: 11/02/2001
• Status: Expired due to Fees

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Thomas, Christopher, Ramachandran, Sriram, Tock, Theron
• Primary Examiner(s): SALAD, ABDULLAHI ELMI
• Application Number:
  US12/582,151
• Publication Number:
  US 20100057845A1
• Time in Patent Office: 595 Days
• Field of Search: 709227-228, 709/245, 709/238, 709/250, 713/168, 713/155, 726/12
• US Class Current: 709/227
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Improved approaches for providing secure access to resources maintained on private networks are disclosed. The secure access can be provided through a public network using client software of client-server software and/or with file system software. Multiple remote users are able to gain restricted and controlled access to at least portions of a private network through a common access point, such as an intermediate server of the remote network.

Claims

1. A method of network communication via a client-server application including a client application associated with a first network and a server application associated with a second network, the method comprising:

generating a network connection request at a computer on the first network, the network connection request initiated by the client application on the computer, the network connection request including a destination of the server application on a destination server on the second network;

redirecting the network connection request within a namespace provider and a layered service provider of a socket layer on the computer, the network connection request redirected away from a transport service provider of the computer to an intermediate server in the second network; and

sending data of the client application from the computer towards the intermediate server, where the data of the client application is to be sent from the intermediate server towards the server application.

2. The method of claim 1, where the socket layer includes at least one of:

a Winsock dynamic link library, a Winsock 2 dynamic link library, an application programming interface, a transport service provider interface, or a transport service provider.

3. The method of claim 2, where redirecting the network connection request within the socket layer includes redirecting the network connection request by hooking at least one of:

the Winsock dynamic link library, or the Winsock 2 dynamic link library.

4. The method of claim 2, further comprising:

passing, prior to the redirecting, the network request through at least one of;

the Winsock dynamic link library or the Winsock 2 dynamic link library.

5. The method of claim 1, where the namespace provider is utilized for domain name service lookups on the second network and the layered service provider is utilized for redirecting the data of the client application from the first network to the second network.

6. The method of claim 1, where the redirecting is based on at least one of a name of the client application, a checksum of the client application, a version of the client application, a destination server, or a port of the destination.

7. The method of claim 1, further comprising:

sending the data of the client application through at least a local address and a local port of the computer prior to sending the data of the client application towards the intermediate server.

8. The method of claim 1, further comprising:

automatically installing the namespace provider and the layered service provider on the computer; and

automatically uninstalling the namespace provider and the layered service provider from the computer.

9. A system, comprising:

a processor to;

receive a network connection request on a computer on a local network, the network connection request initiated to a file system on a remote network, the network connection request including a name of the file system;

redirect the network connection request using a namespace provider and a transport driver interface on the computer, the network connection request redirected away from a transport driver on the computer, the network connection request redirected to an intermediate server in the remote network; and

receive, at the computer, data of the file system from the intermediate server, where the data of the file system is transferred between the intermediate server and the file system on the remote network.

10. The system of claim 9, where the processor is further configured to:

pass the network connection request through at least a transport driver interface filter prior to the redirecting.

11. The system of claim 9, where the processor is further configured to:

transfer the data of the file system between the intermediate server and the file system.

12. The system of claim 9, where the processor is configured to redirect the network connection request based on at least one of a server associated with a destination or a port associated with the destination.

13. The system of claim 9, where when redirecting the network connection request, the processor is configured to capture network file system traffic.

14. The system of claim 9, where the processor is further configured to:

automatically install the transport driver interface on the computer.

15. The system of claim 9, where the processor is further configured to:

automatically uninstall the transport driver interface from the computer.

16. A computer-readable memory device including instructions for performing a method of network communication, the method comprising:

generating a network connection request at a computer on a first network, the network connection request initiated by a client application on the computer, the network connection request including a destination of a server application on a destination server on a second network, where the second network is different than the first network;

redirecting the network connection request within a namespace provider and a layered service provider of a socket layer on the computer, the network connection request redirected away from a transport service provider of the computer to an intermediate server in the second network; and

sending data of the client application from the computer towards the intermediate server, where the data of the client application is to be sent from the intermediate server towards the server application.

17. The computer-readable memory device of claim 16, where the socket layer includes at least one of:

a Winsock dynamic link library, a Winsock 2 dynamic link library, an application programming interface, a transport service provider interface, or the transport service provider.

18. The computer-readable memory device of claim 17, where redirecting the network connection request within the socket layer includes redirecting the network connection request by hooking at least one of:

the Winsock dynamic link library, or the Winsock 2 dynamic link library.

19. The computer-readable memory device of claim 16, where the namespace provider is utilized for domain name service lookups on the second network and the layered service provider is utilized for redirecting the data of the client application from the first network to the second network.

20. The computer-readable memory device of claim 16, where the redirecting is based on at least one of a name of the client application, a checksum of the client application, a version of the client application, a destination server, or a port of the destination.