Secure virtual private network utilizing a diagnostics policy and diagnostics engine to establish a secure network connection

• US 8,099,378 B2
• Filed: 10/29/2010
• Issued: 01/17/2012
• Est. Priority Date: 09/22/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Maxsp Corporation
• Inventors: Keith, Jr., Robert O.
• Primary Examiner(s): Gaffin, Jeffrey A
• Assistant Examiner(s): CHANG, LI WU
• Application Number:
  US12/916,438
• Publication Number:
  US 20110047118A1
• Time in Patent Office: 445 Days
• Field of Search: 706/47
• US Class Current: 706/47
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure virtual private network (VPN) is described herein. The secure VPN implements standard VPN software with diagnostics to ensure a client device coupling to the VPN is secure. The diagnostics include a policy, a library and an engine where the policy determines what the requirements are for permitting the client device to couple to the VPN. The library stores programs for checking if the client device has any problems. The engine gathers information related to the client device and executes the programs stored within the library. When a user attempts to couple to the VPN with a client device, the server initiates the policy, library and engine to check for issues, and then the user is informed of the issues and/or a mechanism automatically fixes the issues. After the client device is verified as secure, it is able to couple to the VPN for data transfers.

Claims

1. A system for providing a secure communications link between a server and a client device over a network comprising:

a. a diagnostics policy stored on the server, wherein the diagnostics policy comprises data indicating one or more device configurations or components that the client device must have in order to securely couple to the server, and further wherein an initial coupling of the client device with the server is established for downloading the diagnostics policy to the client device;

b. a library stored on the client device for storing information;

c. a diagnostics engine stored on the client device for detecting and resolving one or more issues on the client device; and

d. a network communication module for establishing a network connection between the client device and the server over the network, wherein the network communication module with the diagnostics engine prevents communications between the client device and the server unrelated to the diagnostics policy until the one or more issues are resolved by using cryptographic tunneling such that only the diagnostics policy is able to be transferred from the server to the client device.

2. The system as claimed in claim 1 wherein the library is an expert system library.

3. The system as claimed in claim 1 wherein the diagnostics policy is for designating one or more objects to inspect.

4. The system as claimed in claim 1 wherein the diagnostics policy is for determining the requirements needed to be met for a connection to be established.

5. The system as claimed in claim 1 wherein information related to the diagnostics policy is downloaded from the server to the client device.

6. The system as claimed in claim 1 wherein the diagnostics policy contains groupings of sub-policies.

7. The system as claimed in claim 6 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

8. The system as claimed in claim 1 wherein the client device is a selected one of a mobile device and a home user device.

9. The system as claimed in claim 1 wherein the information stored within the library includes one or more programs.

10. The system as claimed in claim 9 wherein the one or more programs stored within the library are wrapped in XML.

11. The system as claimed in claim 1 wherein the diagnostics engine informs a user of the problems if the client device does not pass.

12. The system as claimed in claim 1 wherein the one or more issues discovered by the diagnostics engine are automatically fixed.

13. The system as claimed in claim 1 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

14. The system as claimed in claim 1 wherein the network is a virtual private network.

15. A system for providing a secure communications link between a server and a client over a network comprising:

a. a diagnostics policy stored on the server wherein the diagnostics policy comprises data indicating a set of requirements that the client device must have in order to be permitted to couple to the server, and further wherein an initial coupling of the client device with the server is established in order to download the diagnostics policy from the server to the client device;

b. an expert system library stored on the client device for storing one or more programs; and

c. an diagnostics engine stored on the client device for detecting and resolving one or more issues on the client device;

d. a network communication module for establishing a network connection between the client device and the server over the network, wherein the network communication module with the diagnostics engine prevents communications unrelated to the diagnostics policy between the client device and the server until the one or more issues are resolved by using cryptographic tunneling such that only the diagnostics policy is able to be transferred from the server to the client device.

16. The system as claimed in claim 15 wherein the client device is a selected one of a mobile device and a home user device.

17. The system as claimed in claim 15 wherein the one or more programs stored within the library are wrapped in XML.

18. The system as claimed in claim 15 wherein the diagnostics policy contains groupings of sub-policies.

19. The system as claimed in claim 18 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

20. The system as claimed in claim 15 wherein the diagnostics engine informs a user of the problems if the client device does not pass.

21. The system as claimed in claim 15 wherein the one or more issues discovered by the diagnostics engine are automatically fixed.

22. The system as claimed in claim 15 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

23. The system as claimed in claim 15 wherein the network is a virtual private network.

24. A method of securing a communications link between a server and a client device over a network comprising:

a. coupling the client device with the server over the network;

b. establishing a limited network connection between the client device and the server, wherein the limited network connection is established for downloading a diagnostics policy to the client device, and further wherein the diagnostics policy comprises data indicating one or more device configurations or components that the client device must have in order to securely couple to the server;

c. preventing communications between the client device and the server unrelated to the diagnostics policy until a secure network connection is established by using cryptographic tunneling such that only the diagnostics policy is able to be transferred from the server to the client device;

d. downloading a diagnostics policy from the server to the client device;

e. running a diagnostics engine utilizing a library on the client device; and

f. establishing a secure network connection if the diagnostics engine completes without any issues.

25. The method as claimed in claim 24 wherein the library is an expert system library.

26. The method as claimed in claim 24 further comprising posting a list of issues when the diagnostics engine fails.

27. The method as claimed in claim 24 further comprising automatically fixing the one or more issues when the diagnostics engine fails.

28. The method as claimed in claim 24 wherein the diagnostics engine optionally assists in manually fixing the one or more issues discovered by the diagnostics engine.

29. The method as claimed in claim 27 wherein automatically fixing the one or more issues is selected from the group consisting of downloading applications, downloading application updates, downloading patches, running applications and modifying a registry.

30. The method as claimed in claim 24 further comprising adding custom tools within the library.

31. The method as claimed in claim 24 wherein running the diagnostics engine includes checking for network issues and system issues.

32. The method as claimed in claim 24 wherein the communications link between the server and the client device forms a virtual private network.

33. A network of devices for establishing a secure virtual private network comprising:

a. a private network containing one or more secure devices, wherein at least one of the one or more secure devices is a server for storing a diagnostics policy, wherein the diagnostics policy comprises data indicating one or more device configurations or components that the client device must have in order to securely couple to the server; and

b. one or more client devices coupled to the private network through a public network, wherein the one or more client devices contain a diagnostics engine and a diagnostics library, wherein an initial coupling of the one or more client devices with the server is established for downloading the diagnostics policy to the one or more client devices; and

c. a network communication module for establishing a network connection between the one or more client devices and the server, wherein the network communication module with the diagnostics engine prevents communications between the client device and the server unrelated to the diagnostics policy until any issues detected by the diagnostics engine are resolved by using cryptographic tunneling such that only the diagnostics policy is able to be transferred from the server to the client device.

34. The network of devices as claimed in claim 33 wherein information related to the diagnostics policy is downloaded to the one or more client devices.

35. The network of devices as claimed in claim 33 wherein the one or more client devices are not able to access the private network without being verified using the diagnostics policy, the diagnostics engine and the diagnostics library.

36. The network of devices as claimed in claim 33 wherein the client devices are selected from the group consisting of personal computers, PDAs, cell phones, laptop computers, thin clients and Apple personal computers, mp3 players and gaming consoles.

37. The network of devices as claimed in claim 33 wherein the diagnostics library is an expert system library.

38. The network of devices as claimed in claim 33 wherein the diagnostics policy is for designating one or more objects to inspect.

39. The network of devices as claimed in claim 33 wherein the diagnostics policy is for determining the requirements needed to be met for a connection to be established.

40. The network of devices as claimed in claim 33 wherein the diagnostics policy contains groupings of sub-policies.

41. The network of devices as claimed in claim 40 wherein the grouping of sub-policies include virtual private network checks, network checks, hotfix checks and system checks.

42. The network of devices as claimed in claim 33 wherein the diagnostics library includes one or more programs.

43. The network of devices as claimed in claim 42 wherein the one or more programs stored within the diagnostics library are wrapped in XML.

44. The network of devices as claimed in claim 33 wherein the diagnostics engine informs a user of issues if the client device does not pass.

45. The network of devices as claimed in claim 33 wherein issues discovered by the diagnostics engine are automatically fixed.

46. The network of devices as claimed in claim 33 wherein the diagnostics engine optionally assists in manually fixing issues discovered by the diagnostics engine.

47. A communications apparatus for providing a secure communications link between a server and a client device over a network comprising:

a. a diagnostics policy stored on the server, wherein the diagnostics policy comprises data indicating one or more device configurations or components that the client device must have in order to securely couple to the server;

b. a network communication module for establishing an initial coupling of the client device with the server that prevents communications between the client device and the server unrelated to the diagnostics policy by using cryptographic tunneling such that only the diagnostics policy is able to be transferred from the server to the client device.

48. A communications apparatus for providing a secure communications link between a server and a client device over a network comprising:

a. a diagnostics policy stored on the server comprising data indicating a set of requirements that the client device must have in order to be permitted to couple to the server, wherein an initial coupling of the client device with the server utilizing cryptographic tunneling to only enable the download of the diagnostics policy to the client device;

b. a library stored on the client device for storing information; and

c. a diagnostics engine stored on the client device for using the diagnostics policy and the library to detect and resolve one or more issues related to the requirements on the client device, wherein the detecting and resolving of the one or more issues occurs after installation of the diagnostics engine, wherein if the diagnostics engine resolves one or more of the issues, then a secure coupling between the client device and the server sufficient for full data transfers is established over the network.