Application-specific network-layer virtual private network connections

• US 8,095,786 B1
• Filed: 11/09/2006
• Issued: 01/10/2012
• Est. Priority Date: 11/09/2006
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Kshirsagar, Shekhar, Thomas, Christopher N.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US11/558,293
• Time in Patent Office: 1,888 Days
• Field of Search: 726/15, 713/151, 713/152
• US Class Current: 713/152
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Techniques are described for providing secure communication of network traffic from specific applications operating on a client device to a server device using a network-layer virtual private network (VPN). For example, a module on a client device may intercept network traffic from an application executing on the client device. The module may then determine whether to send the application-layer data through a network-layer VPN tunnel from the client device to a gateway device. This network-layer VPN tunnel may be defined by a network address of a physical adapter of the client device and a network address of the VPN gateway. In other words, there may be no need for the interposition of a VPN proxy on the client device. The module makes this determination on an application-by-application basis. The client device then forwards the application-layer data through the VPN tunnel based on the determination.

Claims

1. A method comprising:

establishing a network-layer (Layer

     3) virtual private network (VPN) tunnel from a client device to a gateway device, wherein the network-layer VPN tunnel is defined by a network address of an adapter of the client device and a network address of the gateway device;

receiving, with a module on a client device, application-layer data to be sent to a server device from an application executing on the client device;

before forming one or more network-layer packets including the received application-layer data, determining, with the module, on an application-by-application basis based on the application from which the application-layer data was received, whether to send the application-layer data through the network-layer VPN tunnel; and

sending, with the client device, the one or more network-layer packets including the application-layer data through the network-layer VPN tunnel based on the determination.

2. The method of claim 1, wherein the method further comprises receiving application security information that identifies the application and specifies that the client device should route network traffic from the application through the VPN tunnel.

3. The method of claim 2, wherein determining whether to route network traffic comprises:

intercepting, with the module, a request from the application to an operating system, wherein the request is a request to establish a transport-layer connection;

determining whether the application security information specifies that application-layer data from the particular application is to be routed through the VPN tunnel; and

updating a network layer (Layer

     3) data structure with the module to provide information for a transport layer connection for use by a Layer 3 VPN module when subsequently sending the application-layer data as network layer data.

4. The method of claim 3, wherein intercepting a request comprises receiving a request with a transport driver interface (TDI).

5. The method of claim 3, wherein intercepting a request comprises intercepting a request to create a network socket.

6. The method of claim 3,

wherein receiving application security information comprises receiving a set of hash values calculated from binary representations of applications;

and

wherein determining whether the application security information specifies that the client device should route network traffic comprises;

calculating a hash value from a binary representation of the application that originated the request; and

determining whether the hash values calculated from the binary representation of the application that originated the request matches one of the hash values in the application security information.

7. The method of claim 3, wherein determining whether to send application-layer data comprises:

receiving, with the VPN module, a request to send a transport-layer segment from the application using a network-layer protocol;

determining whether transport-layer information of the transport-layer segment corresponds to the transport-layer information provided to the VPN module; and

generating a network-layer packet for the transport-layer segment.

11. The method of claim 1, further comprising receiving, with the client device, network traffic through the VPN tunnel in a network connection initiated by the server device.

12. The method of claim 11, wherein receiving network traffic through the VPN tunnel in a network connection initiated by a server comprises receiving an invitation from the server to establish one of:

a File Transfer Protocol session, a Voice over Internet Protocol session, and a Session Initiation Protocol session.

13. The method of claim 1, wherein sending the application-layer data comprises sending the application-layer data originating from the application through an Internet Protocol Security (IPsec) tunnel.

26. The method of claim 1, further comprising forming the one or more network-layer packets including the received application-layer data upon determining that the application-layer data is to be sent through the network-layer VPN tunnel by encrypting the application-layer data and encapsulating the encrypted application-layer data to form the one or more network-layer packets.

8. A method comprising:

establishing a network-layer (Layer

     3) virtual private network (VPN) tunnel from a client device to a gateway device, wherein the network-layer VPN tunnel is defined by a network address of an adapter of the client device and a network address of the gateway device;

receiving application security information that identifies an application executing on the client device and specifies that the client device should route network traffic from the application through the VPN tunnel;

receiving, with a module on the client device, application-layer data to be sent to a server device from an application executing on the client device;

determining, on an application-by-application basis based on the application from which the application-layer data was received, whether to send the application-layer data through the network-layer VPN tunnel, comprising;

intercepting, with the module, a request from the application to an operating system, wherein the request is a request to establish a transport-layer connection;

determining whether the application security information specifies that application-layer data from the particular application is to be routed through the VPN tunnel; and

updating a network layer (Layer

     3) data structure with the module to provide information for a transport layer connection for use by a Layer 3 VPN module when subsequently sending the application-layer data as network layer data;

receiving, with the VPN module, a request to send a transport-layer segment from the application using a network-layer protocol;

determining whether transport-layer information of the transport-layer segment corresponds to the transport-layer information provided to the VPN module; and

generating a network-layer packet for the transport-layer segment, comprising;

encapsulating the transport-layer segment within a network-layer packet; and

encapsulating the network-layer packet within a secure network-layer packet having the address of the gateway device as a destination address; and

sending, with the client device, the application-layer data through the network-layer VPN tunnel based on the determination of whether to send the application-layer data through the network-layer VPN tunnel.

9. The method of claim 8, wherein the gateway device performs a network address translation on a destination network address of the network-layer packet.

10. The method of claim 8, wherein the client device performs a network address translation on a destination network address of the network-layer packet.

14. A network device comprising:

a VPN manager to establish a network-layer VPN tunnel from the network device to a gateway device, wherein the network-layer VPN tunnel is defined by a network address of an adapter of the network device and a network address of the gateway device;

an Application Traffic Identifier (ATI) subsystem to intercept application-layer data to be sent to a server device from an application executing on the network device, wherein the ATI subsystem determines, before forming one or more network-layer packets including the received application-layer data, on an application-by-application basis whether to send the application-layer data through the network-layer VPN tunnel; and

a Layer 3 VPN subsystem responsive to the ATI subsystem, wherein the Layer 3 VPN subsystem sends the one or more network-layer packets including the application-layer data through the network-layer VPN tunnel based on the determination.

15. The network device of claim 14,

wherein the VPN manager receives application security information from a VPN gateway, and

wherein the application security information identifies the application and specifies that the network device should route the application-layer data from the application through VPN tunnel.

16. The network device of claim 15,

further comprising a table accessible by both the ATI subsystem and the Layer 3 VPN subsystem, wherein the table includes entries for entry for network addresses and transport-layer protocol port numbers for transport connections that are to be securely directed through the VPN tunnel,

wherein the ATI subsystem intercepts a request from the application to establish a transport-layer connection, determines whether the application security information specifies that application-layer data from the application is to be directed through the VPN tunnel, and updates the table to provide the network address and the port number for a transport layer connection for use by a Layer 3 VPN module when subsequently sending the application-layer data as network layer data.

17. The network device of claim 16,

wherein the ATI subsystem comprises a hook installed within an operating system of the network device,

wherein the ATI subsystem provides a kernel-mode network interface that is exposed at an upper edge of transport protocol stacks provided by the operating system.

18. The network device of claim 16, wherein the ATI subsystem intercepts a request from the application by intercepting a request to create a network socket.

19. The network device of claim 16,

wherein the application security information comprises a set of hash values calculated from binary representations of applications;

and

wherein the ATI subsystem determines whether the application security information specifies that the client device should route network traffic from the application through the VPN tunnel by calculating a hash value from a binary representation of the application and determining whether the hash values calculated from the binary representation of the application that originated the request matches one of the hash values in the application security information.

20. The network device of claim 16, wherein the VPN module sends the application-layer data through the VPN tunnel based on the determination by receiving a request to send a transport-layer segment from the application from the application using a network-layer protocol, determining whether transport-layer information of the transport-layer segment corresponds to the transport-layer information provided to the VPN module by the ATI subsystem, and generating a network-layer packet for the transport-layer segment.

21. The network device of claim 20, wherein the VPN module generates a network-layer packet by encapsulating the transport-layer segment within a network-layer packet and encapsulating the network-layer packet within a secure network-layer packet having the address of the gateway device as a destination address.

22. The network device of claim 21, wherein the gateway device performs a network address translation on a destination network address of the network-layer packet.

23. The network device of claim 21, wherein the client device performs a network address translation on a destination network address of the network-layer packet.

24. The network device of claim 14, wherein the network device receives network traffic through the VPN tunnel in a network connection initiated by the server device.

25. A non-transitory computer-readable storage medium comprising instructions, the instructions causing a programmable processor of a client device to:

establish a network-layer virtual private network (VPN) tunnel from the client device to a gateway device, wherein the network-layer VPN tunnel is defined by a network address of an adapter of the client device and a network address of the gateway device;

receive, with a module on the client device, network traffic to a server device from an application executing on the client device;

before forming one or more network-layer packets including the received application-layer data, determine, with the module, whether to send the application-layer data through the network-layer VPN tunnel on an application-by-application basis; and

send the one or more network-layer packets including the application-layer data through the network-layer VPN tunnel based on the determination.