Techniques for establishment and use of a point-to-point tunnel between source and target devices
View Patent ↗Described are techniques to establish an on-demand, secure, point-to-point tunnel between a source device of a source network to a target device of a target network. The target network may not be visible to the source network. The target network includes a tunnel client and a tunnel server may be a perimeter device of the source network. The tunnel client may send a first message to the tunnel server. Data may be transmitted from the source to target device by including the data in a return message in response to the first message. The first message and the return message may be sent over one or more “heartbeat” connections which are continually established and torn down to transmit data between the two networks, and the source and target devices therein.
1. A method for establishing a secure connection between a source device and a target device comprising:
providing a first connection between a tunnel client and a tunnel server, a second connection between said tunnel server and said source device, and a third connection between said tunnel client and said target device;
receiving a request over said second connection at said tunnel server from the source device to send data to the target device;
sending a first message from the tunnel client to the tunnel server over said first connection;
sending said request in a return message over said first connection to said tunnel client; and
sending said request to said target device from said tunnel client over said third connection, wherein said first connection is continually re-established at each of a plurality of occurrences of a predetermined time interval, said tunnel client sending a message to said tunnel server over said first connection at said each occurrence, said first message being one of a plurality of messages sent at one of said plurality of occurrences, wherein said tunnel server sends a response to said tunnel client for each of said plurality of messages upon an earlier occurrence of a predefined expiration time interval elapsing or said tunnel server receiving a message to transmit to said tunnel client over said first connection as part of said response.
2. The method of claim 1 , wherein the source device has visibility to the tunnel server, the tunnel client has visibility to the target device, and the tunnel client has visibility to the tunnel server.
3. The method of claim 2 , wherein the source device does not have visibility to the target device.
4. The method of claim 1 , wherein the tunnel server is included in a perimeter device of a source network which communicates with said source device.
5. The method of claim 1 , further comprising:
receiving, at said tunnel server over said second connection, a request from said source device to establish a tunnel; and
transmitting said request over a fourth connection between said tunnel server and said tunnel client.
6. The method of claim 1 , wherein said first connection and a fourth connection are used to transmit messages between said tunnel server and said tunnel client, said first connection being used to transmit messages and responses to initiate and terminate a tunnel between said source device and said target device, said fourth connection being used to transmit other messages.
7. The method of claim 6 , wherein said fourth connection is characterized as having a higher priority link than said first connection, and wherein said fourth connection is established by said tunnel client in an event-driven manner in response to data being added to an outgoing message queue, wherein said data is to be sent to said tunnel server by said tunnel client.
8. The method of claim 5 , wherein said first connection and said fourth connection are each continually re-established in accordance with different establishment time intervals.
9. The method of claim 1 , wherein said predefined expiration time interval indicates that, at said each occurrence of said predetermined time interval establishing said first connection, said first connection remains established no longer than said predefined expiration time interval.
10. The method of claim 5 , wherein each of said first connection and said fourth connection have different message queues.
11. The method of claim 1 , wherein said tunnel server services a plurality of tunnel clients.
12. The method of claim 1 , wherein said tunnel client connects to a plurality of tunnel servers.
13. The method of claim 1 , wherein said tunnel server is included on an interior device of a source network.
14. The method of claim 1 , wherein at least one of said tunnel client and said tunnel server permit access from a source network including said source device to a target network including said target device in accordance with access control privileges.
15. The method of claim 14 , wherein said access control privileges of said tunnel client indicate what devices in the target network are accessible to a particular user of said source network, and wherein said access control privileges of said tunnel server specify privileges of users of the source network to access devices in the target network.
16. The method of claim 1 , wherein said source device is included in a source network and said target device is included in a target network, said source network being a service provider network to perform monitoring of one or more objects in said target network, at least one of said objects being at a location of said tunnel client.
17. The method of claim 16 , wherein said service provider network establishes communications with said target network by sending said request over said second connection.
18. A method for communicating between a source device and a target device comprising:
receiving, at a tunnel server, a request from a source device to initiate a tunnel to said target device;
transmitting said request from said tunnel server to a tunnel client over a first connection, said request being included in a return message to said tunnel client in response to another request from said tunnel client previously received at said tunnel server; and
wherein said tunnel server receives incoming messages from said tunnel client and said tunnel server transmits an outgoing request from said source device to said target device by including said outgoing request in a return message to said tunnel client in response to one of said incoming messages, and wherein said tunnel client communicates said outgoing request to said target device over a second connection, and said source device and said tunnel server communicate over a third connection, wherein said first connection is continually re-established at each of a plurality of occurrences of a predetermined time interval, said tunnel client sending one of said incoming messages to said tunnel server over said first connection at said each occurrence, wherein said tunnel server sends a response to said tunnel client for each of said incoming messages upon an earlier occurrence of a predefined expiration time interval elapsing or said tunnel server receiving a message to transmit to said tunnel client over said first connection as part of said response.
19. A computer-readable medium including code thereon for establishing a secure connection between a source device and a target device, the computer-readable medium comprising code that:
provides a first connection between a tunnel client and a tunnel server, a second connection between said tunnel server and said source device, and a third connection between said tunnel client and said target device;
receives a request over said second connection at said tunnel server from the source device to send data to the target device;
sends a first message from the tunnel client to the tunnel server over said first connection;
sends said request in a return message over said first connection to said tunnel client; and sends said request to said target device from said tunnel client over said third connection, wherein said first connection is continually re-established at each of a plurality of occurrences of a predetermined time interval, said tunnel client sending a message to said tunnel server over said first connection at said each occurrence, said first message being one of a plurality of messages sent at one of said plurality of occurrences, wherein said tunnel server sends a response to said tunnel client for each of said plurality of messages upon an earlier occurrence of a predefined expiration time interval elapsing or said tunnel server receiving a message to transmit to said tunnel client over said first connection as part of said response.
20. The computer readable medium of claim 19 , wherein said tunnel server is located between a first firewall of a source network and a second firewall of a target network including said tunnel client.