Method and system for dynamically establishing a virtual private network (VPN) session

• US 8,353,025 B2
• Filed: 05/27/2011
• Issued: 01/08/2013
• Est. Priority Date: 09/27/2007
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Ananda, Gautham Chambrakana, Mohanty, Surendranath, Ks, Girish, Attur, Vishnu Govind
• Primary Examiner(s): KOSOWSKI, CAROLYN M
• Application Number:
  US13/118,131
• Publication Number:
  US 20110231910A1
• Time in Patent Office: 592 Days
• Field of Search: 726/15
• US Class Current: 726/15
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Techniques for virtual private network (VPN) access are provided. A dynamic determination, in response to privileges, is made as to whether a principal and a device of a principal are to receive a thin client virtual private network (VPN) installation for a thin client VPN session between the principal and a remote site or whether a clientless VPN session is appropriate. Dynamic switching between the clientless VPN session and thin client VPN session is permissible when the principal supplies the appropriate credentials for such a switch.

Claims

1. A machine-implemented method residing in a non-transitory computer-readable medium for execution on a machine, comprising:

downloading a control module to process within a device associated with a principal for establishment of a virtual private network (VPN) session between the principal and resources of a remote site;

dynamically receiving an indication from the control module as to whether the principal is to be associated with a thin client installation for the VPN session or whether the principal is to be associated with a clientless access for the VPN session;

downloading VPN modules that act as a proxy for the principal on the device for purposes of accessing the remote site and the resources by establishing a thin client VPN session as the VPN session when the control module indicates the principal has privileges for the thin client installation;

detecting a termination in the thin client VPN session between the principal and the remote site;

receiving another subsequent authentication of the principal via the device;

acquiring a notification from the control module that the proxy is running on the device; and

establishing another thin client VPN session between the principal and the resources.

2. The method of claim 1, wherein the downloading of the control module further includes authenticating the principal for access to the remote site.

3. The method of claim 1, further comprising;

permitting limited access to the remote site by establishing a clientless VPN session as the VPN session between a browser, when the control module indicates the principal lacks privileges for the thin client installation and is to use the clientless VPN session.

4. The method of claim 1, further comprising:

receiving a request from the control module to perform additional authentication on the principal.

5. The method of claim 4, wherein the receiving further includes acquiring new credentials from the principal directly or indirectly via the control module for the additional authentication.

6. The method of claim 1, further comprising:

instructing the control module to dynamically configure the thin client installation on the device of the principal; and

dynamically providing VPN resources from the remote site to assist the control module in establishing the VPN session as the thin client VPN session with access to the resources of the remote site.

7. A machine-implemented method residing in a non-transitory computer-readable medium for execution on a machine, comprising:

dynamically downloading modules from a remote site to establish a thin client Virtual Private Network (VPN) session between a principal and a device when a thin client installation is present;

dynamically searching for credentials of the principal when the thin client installation is missing from the device and when successful downloading the thin client installation and the modules from the remote site to establish the thin client VPN session and checking the device for the credentials and dynamically requesting that the principal supply the credentials when the searching fails to discover the credentials, wherein dynamically searching further includes presenting a dialogue box on a display of the device for the principal to enter additional credentials, wherein presenting further includes including an option within the dialogue box that permits the principal to bypass supplying the additional credentials and select a clientless VPN session; and

permitting the clientless VPN session to be established between the principal and the remote site when the thin client VPN session fails to be established.

8. The method of claim 7, wherein dynamically downloading further dynamically checking the device associated with the principal for the thin client VPN installation.

9. The method of claim 7, wherein the including the option further includes limiting a total number of attempts that the principal is permitted to make to enter the additional credentials to three attempts and when after three failed attempts determining that the clientless VPN session is to be established.

10. The method of claim 7, wherein the dynamically searching further includes determining the thin client installation is present but in a locked state on the device or a no executing state on the device and in treating this as a condition in which the thin client installation is not to be considered present on the device until the additional credentials are successfully obtained and verified.

11. A machine-implemented method residing in a non-transitory computer-readable medium for execution on a machine, comprising:

dynamically downloading modules from a remote site, via a control module, to establish a thin client VPN session between a principal and a device when a thin client installation is present;

dynamically searching for additional credentials of the principal when the thin client installation is missing from the device and when successful credentials are found then downloading the thin client installation and the modules from the remote site to establish the thin client VPN session and checking the device for the additional credentials and dynamically requesting that the principal supply the additional credentials when the searching fails to discover the additional credentials and presenting a dialogue box on a display of the device for the principal to enter the additional credentials limiting a total number of attempts that the principal is permitted to make to enter the additional credentials to three attempts and when after three failed attempts determining that a clientless VPN session is to be established; and

permitting the clientless VPN session to be established between the principal and the remote site when the thin client VPN session fails to be established.

12. The method of claim 11, wherein the downloading of the thin client installation further includes dynamically checking the device associated with the principal for the thin client virtual private network (VPN) installation.

13. The method of claim 11, wherein the checking the device further includes determining the thin client installation is present but in a locked state on the device or a no executing state on the device and in treating this as a condition in which the thin client installation is not to be considered present on the device until the additional credentials are successfully obtained and verified.

14. The method of claim 11, further comprising:

executing the control module as an ActiveX module or an Applet within a World-Wide Web(WWW) browser.

15. The method of claim 14, further comprising:

using secure socket layer (SSL) communication capabilities of the WWW browser to establish the clientless VPN session.

16. The method of claim 11, further comprising:

permitting the principal to access the remote site via the clientless VPN session when the control module is unable to establish the thin client VPN session or when the principal specifically requests the clientless VPN session.