Secure tunnel over HTTPS connection
View Patent ↗Many secure tunnels require protocols that require special handling, authorization or security certificates, such as L2TP and PPTP. This often eliminates them for use between a corporate or agency network and outside, public networks. A secure socket tunnel protocol (SSTP) adds drivers in both the kernel and user mode to route standard protocol traffic, such as PPP, over a common HTTPS port. In the event of network interruptions, an exchange of a session cookie allows fast reconnection of the underlying HTTPS connection without affecting higher level applications.
1. A computer-implemented method of supporting secure communication between a client and a server, the method comprising:
connecting, by the client, to a network, wherein the connection is made through a client network interface including a hypertext transport protocol secure (HTTPS) module;
sending, by the client, a request to establish an HTTPS session with the server;
establishing the HTTPS session between the client and the server;
after establishment of the HTTPS session, establishing a secure socket tunneling protocol (“SSTP”) tunnel over the HTTPS session for tunneling application traffic via a point-to-point (“PPP”) protocol from the client to the server, wherein the establishing the SSTP tunnel comprises:
establishing an SSTP connection from the client network interface to a server network interface over the HTTPS session;
establishing, over the SSTP connection, a PPP session with the server; and
after establishment of the SSTP tunnel:
tunneling control data traffic over the SSTP tunnel; and
tunneling data traffic via the PPP protocol over the SSTP tunnel, wherein the data traffic is sent from one or more applications supported on the client using the client network interface.
2. The method of claim 1 , wherein the PPP protocol is managed in a remote access connection manager service.
3. The method of claim 1 , further comprising forwarding the data traffic to an HTTPS port.
4. The method of claim 1 , wherein an SSTP driver activates a state machine for managing the SSTP protocol.
5. The method of claim 1 , wherein the tunneling control data traffic comprises sharing a cookie representing HTTPS session connection data between the client and the server.
6. The method of claim 5 , further comprising sending the cookie between the client and the server when requesting re-establishment of the HTTPS session after the HTTPS session is broken.
7. The method of claim 1 , wherein a control packet for the control data traffic and a data packet for the data traffic comprise a header common to both the control packet and the data packet, wherein the payload of either packet is less than 4095 bytes.
8. The method of claim 7 , wherein a supporting control message comprises one or more from the group consisting of: a connect_request, a connect_ack including a link cookie, a connect_nack, a call_connected, a fast_reconnect_request, a fast_reconnect_ack, an echo_request, an echo_response, a disconnect, a disconnect_ack, and an abort_call.
9. A computer storage medium having stored thereon computer executable instructions that when executed by a processor perform a method for supporting secure communication between a client and a server, the method comprising:
connecting, by the client, to a network, wherein the connection is made through a client network interface including a hypertext transport protocol secure (HTTPS) module;
sending, by the client, a request to establish an HTTPS session with the server;
establishing the HTTPS session between the client and the server;
after establishment of the HTTPS session, establishing a secure socket tunneling protocol (“SSTP”) tunnel over the HTTPS session for tunneling application traffic using a point-to-point (“PPP”) protocol from the client to the server, wherein the establishing the SSTP tunnel comprises:
establishing an SSTP connection from the client network interface to a server network interface over the HTTPS session;
establishing, over the SSTP connection, a PPP session with the server; and
after establishment of the SSTP tunnel:
tunneling control data traffic over the SSTP tunnel; and
tunneling data traffic via the PPP protocol over the SSTP tunnel, wherein the data traffic is sent from one or more applications supported on the client using the client network interface.
10. The computer storage medium of claim 9 , wherein the PPP protocol is managed in a remote access connection manager service.
11. The computer storage medium of claim 9 , further comprising forwarding the data traffic to an HTTPS port.
12. The computer storage medium of claim 9 , wherein the tunneling control traffic data comprises sharing a cookie representing HTTPS session connection data between the client and the server.
13. The computer storage medium of claim 9 , wherein a control packet for the control data traffic and a data packet for the data traffic comprise a header common to both the control packet and the data packet, wherein the payload of either packet is less than 4095 bytes.
14. The computer storage medium of claim 13 , wherein a supporting control message comprises one or more from the group consisting of: a connect_request, a connect_ack including a link cookie, a connect_nack, a call_connected, a fast_reconnect_request, a fast_reconnect_ack, an echo_request, an echo_response, a disconnect, a disconnect_ack, and an abort_call.
15. A computer-implemented method of supporting secure communication between a server and a client, the method comprising:
connecting, by the server, to a network, wherein the connection is made through a server network interface including a hypertext transport protocol secure (HTTPS) module;
receiving, by the server, a request to establish an HTTPS session with the client;
establishing the HTTPS session between the client and the server;
after establishment of the HTTPS session, establishing a secure socket tunneling protocol (“SSTP”) tunnel over the HTTPS session for tunneling application traffic via a point-to-point (“PPP”) protocol from the server to the client, wherein the establishing the SSTP tunnel comprises:
establishing an SSTP connection from the server network interface to a client network interface over the HTTPS session;
establishing, over the SSTP connection, a PPP session with the client; and
after establishment of the SSTP tunnel:
tunneling control data traffic over the SSTP tunnel; and
tunneling data traffic via the PPP protocol over the SSTP tunnel, wherein the data traffic is sent from one or more application servers hosting one or more applications, wherein the one or more application servers are connected to the server.
16. The method of claim 15 , wherein the PPP protocol is managed in a remote access connection manager service.
17. The method of claim 15 , further comprising forwarding the data traffic to an HTTPS port.
18. The method of claim 15 , wherein the tunneling control data traffic comprises sharing a cookie representing HTTPS session connection data between the client and the server.
19. The method of claim 15 , wherein a control packet for the control data traffic and a data packet for the data traffic comprise a header common to both the control packet and the data packet, wherein the payload of either packet is less than 4095 bytes.
20. The method of claim 19 , wherein a supporting control message includes comprises one or more from the group consisting of: a connect_request, a connect_ack including a link cookie, a connect_nack, a call_connected, a fast_reconnect_request, a fast_reconnect_ack, an echo_request, an echo_response, a disconnect, a disconnect_ack, and an abort_call.