Method and systems for securing remote access to private networks

• US 8,892,778 B2
• Filed: 09/14/2012
• Issued: 11/18/2014
• Est. Priority Date: 07/23/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Rao, Goutham P., Rodriguez, Robert A., Brueggemann, Eric R.
• Primary Examiner(s): Serrao, Ranodhi
• Application Number:
  US13/618,180
• Publication Number:
  US 20130014206A1
• Time in Patent Office: 795 Days
• Field of Search: None
• US Class Current: 709/249
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for securing remote access to private networks includes a receiver intercepting from a data link layer a packet in a first plurality of packets destined for a first system on a private network. A filter intercepts from the data link layer a packet in a second plurality of packets transmitted from a second system on the private network, destined for an system on a second network. A transmitter in communication with the receiver and the filter performing a network address translation on at least one intercepted packet and transmitting the at least one intercepted packet to a destination.

Claims

1. A method of accessing a server via an intermediary device between a client in a first network and the server in a second network, the method comprising:

(a) establishing a secure application layer tunnel over a first transport layer connection between a client application executing on a client on a first network and a device intermediary between a server of a second network and the client, the device having a second transport layer connection between the device and the server;

(b) receiving, by the device from the client application via the secure application layer tunnel, a request of an application of the client to access the server, the client application receiving the request intercepted from a third transport layer connection of the application by a driver of the client,

(c) forwarding, by the device via the second transport layer connection, the request to the server; and

(d) intercepting, by the device at a data link layer of the device, a response to the request transmitted from the server to the client.

2. The method of claim 1, wherein step (a) further comprises establishing the secure application layer tunnel comprising one of a secure socket layer (SSL) session or a Secure HypterText Transfer Protocol (HTTPS) session.

3. The method of claim 1, wherein step (b) further comprises terminating, by the driver, the third transport layer connection of the application, the application transmitting requests to the server via the third transport layer connection.

4. The method of claim 1, wherein step (a) further comprising transmitting, by the device to the client responsive to a communication of the client to the device, a remote process comprising the client application and the driver, the client automatically installing the client application and the driver of the remote process upon receipt.

5. The method of claim 1, wherein step (b) further comprising receiving, by the client application, the request from the driver via a port of the client monitored by the client application.

6. The method of claim 1, wherein step (b) further comprises intercepting, by the driver at a data link layer of the client, network traffic of the application destined for the server and forwards the intercepted network traffic to the client application.

7. The method of claim 1, wherein step (c) further comprises performing, by the device, network address translation of a public internet protocol address of the request to a private internet protocol address of the client established by the device.

8. The method of claim 1, wherein step (d) further comprises performing, by the device, network address translation of a private internet protocol address of the response to a public internet protocol address of the client.

9. The method of claim 1, wherein step (d) further comprises intercepting, by a second driver of the device, the response and providing the response to a policy engine executing at an application layer of the device for applying one or more policies to the response before transmitting the response to the client.

10. The method of claim 9, further comprising transmitting, by the device, responsive to the policy engine, the response to the client application via the secure application layer tunnel.

11. A system of accessing a server via an intermediary device between a client in a first network and the server in a second network, the system comprising:

a client application executing on a client on a first network;

a device intermediary between a server of a second network and the client

a secure application layer tunnel established over a first transport layer connection between the client and the device, the device having a second transport layer connection between the device and the server;

wherein the device receives from the client application via the secure application layer tunnel a request of an application of the client to access the server, the client application receiving the request intercepted from a third transport layer connection of the application by a driver of the client, and forwards the request to the server via the second transport layer connection; and

wherein the device intercepts, at a data link layer of the device, a response to the request transmitted from the server to the client.

12. The system of claim 11, wherein the secure application layer tunnel comprises one of a secure socket layer (SSL) session or a Secure HypterText Transfer Protocol (HTTPS) session.

13. The system of claim 11, wherein the driver of the client terminates the third transport layer connection of the application, the application transmitting requests to the server via the third transport layer connection.

14. The system of claim 11, wherein the device transmits to the client, responsive to a communication of the client to the device, a remote process comprising the client application and the driver, the client automatically installing the client application and the driver of the remote process upon receipt.

15. The system of claim 11, wherein the client application receives the request from the driver via a port of the client monitored by the client application.

16. The system of claim 11, wherein the driver intercepts at a data link layer of the client network traffic of the application destined for the server and forwards the intercepted network traffic to the client application.

17. The system of claim 11, wherein the device performs network address translation of a public internet protocol address of the request to a private internet protocol address of the client established by the device.

18. The system of claim 11, wherein the device performs network address translation of a private internet protocol address of the response to a public internet protocol address of the client.

19. The system of claim 11, wherein a second driver of the device intercepts the response and provides the response to a policy engine executing at an application layer of the device for applying one or more policies to the response before transmitting the response to the client.

20. The system of claim 19, wherein the device, responsive to the policy engine, transmits the response to the client application via the secure application layer tunnel.