Granted Patent B2

US 8,296,437 · App. 11/642,272 · Granted Oct 23, 2012

Assignee: LogMeIn, Inc.

Abstract

Claims (48)

1. A method carried out at a server to facilitate a connection between a first client and a second client, the server being distinct from the first client and the second client, comprising:

receiving, from each client, a local IP address and port number associated with a UDP socket that the client has opened and to which it has bound;

instructing each client to use its respective UDP socket to execute a packet exchange protocol, the packet exchange protocol comprising the following sub-steps:

sending first messages to each of the first client and the second client, the first messages instructing the first client and the second client to each send second messages to target IP addresses and ports specified by the server, wherein a second message is a packet, wherein, for a respective one of the clients, the target IP addresses and ports specified by the server are associated with at least a first target location and a second target location, wherein each of the first and second target locations has a communication channel to the server over which information about a second message received at the respective target location is forwarded back to the server as a reflection packet, the information including a source address and port of the client as seen by a machine at the target location;

receiving the information;

based on the information received and the respective client's local IP address and port number associated with the UDP socket, determining an associated Internet access type for each respective client;

executing a tunnel setup protocol, the tunnel setup protocol comprising the following sub-steps;

for each of the first and second clients, and based on the Internet access type for the respective client as determined by the packet exchange protocol, predicting a port range that the respective client will use to send subsequent messages; and

instructing each respective client about the predicted port range of the other client so that the first client and the second client can start exchanging data directly through the tunnel and without passing through the server.

2. The method as described in claim 1 further including:

if the tunnel setup protocol does not succeed, instructing the first and second clients to communicate with one another via a relay node.

3. The method as described in claim 2 wherein the first and second clients communicate with the relay node using communications that are one of: TCP-based, UDP-based, SSL-based, and HTTP-based.

4. The method as described in claim 1 further including:

determining whether a given one of the first and second clients remains actively connected to the tunnel; and

if, based on the determination, the given client is not then actively connected to the tunnel, providing to the other client a status indication.

5. The method as described in claim 4 wherein the status indication indicates whether a session between the first and second clients as mediated by the server was terminated intentionally or unexpectedly.

6. The method as described in claim 1 wherein the packet exchange protocol is UDP-based.

7. The method as described in claim 1 wherein the tunnel setup protocol comprises, for a given client:

instructing the given client to send a packet to the other client; and

receiving a reflection packet from the other client to enable the server to confirm that the tunnel is operational in a given direction.

8. The method as described in claim 1 wherein the tunnel setup protocol comprises, for each client:

instructing each client to send a packet to the other client; and

receiving reflection packets to enable the server to confirm that the tunnel is operational in both directions.

9. The method as described in claim 1 wherein the tunnel setup protocol comprises:

generating at least one script that includes a set of steps, the steps comprising at least one of: a first step that updates a given client IP address/port information, a second step that predicts an external IP address and port that a given client will use for the tunnel, a third step that prepares the tunnel for communication, and a fourth step that confirms the operation of the tunnel.

10. The method as described in claim 1 wherein the tunnel setup protocol comprises:

generating a set of one more scripts, each script including a set of steps that are carried out by the server to attempt to establish the tunnel between the first and second clients; and

beginning with the first script and continuing until the tunnel is established or there are no more scripts:

executing each step in the set of steps; and

if a given step fails, advancing to a next script.

11. The method as described in claim 10 wherein the set of steps comprises at least one of: a first step that updates a given client IP address/port information, a second step that predicts an external IP address and port that a given client will use for the tunnel, a third step that prepares the tunnel for communication, and a fourth step that confirms the operation of the tunnel.

12. Server apparatus to facilitate communications between a first client computer protected by an associated traffic policing device, and a second client computer, the server apparatus being distinct from the first client computer and the second client computer, comprising:

a processor;

a computer memory holding computer program instructions which when executed by the processor perform a method comprising:

receiving, from each client, a local IP address and port number associated with a UDP socket that the client has opened and to which it has bound;

instructing each client to use its respective UDP socket to execute a packet exchange protocol by which the server apparatus determines an associated Internet access type for each client, the packet exchange protocol comprising the following sub-steps:

sending first messages to each of the first client and the second client, the first messages instructing the first client and the second client to send second messages to target IP addresses and ports specified by the server apparatus, wherein a second message is a packet, wherein, for a respective one of the clients, the target IP addresses and ports specified by the server apparatus are associated with at least a first target location and a second target location, wherein each of the first and second target locations has a communication channel to the server apparatus over which information about a second message received at the respective target location is forwarded back to the server apparatus as a reflection packet, the information including a source address and port of the client as seen by a machine at the target location;

receiving the information;

based on the information received and the respective client's local IP address and port number associated with the UDP socket, determining an associated Internet access type for each respective client;

instructing each of the first and second clients to execute a tunnel setup protocol, the tunnel setup protocol comprising the following sub-steps;

for each of the first and second clients, and based on the Internet access type for the respective client as determined by the packet exchange protocol, predicting a port range that the respective client will use to send subsequent messages; and

instructing each respective client about the predicted port range of the other client so that the first client and the second client can start exchanging data directly through the tunnel and without passing through the server.

13. The server apparatus of claim 12 wherein the tunnel between the client computer and the second client computer is a VPN.

14. The server apparatus of claim 12 wherein the at least one characteristic of the associated traffic policing device is a mapping algorithm that is one of: static, port_n, port_burst, port_random and addr_random, wherein static means that an external port used depends only on an internal address and port number, port_n means that the external port used changes in fixed increments, port_burst means that the external port used changes in random increments, port_random means that the external port used is selected randomly, and addr_random means that both the external port and IP address for the client are change for new destination.

15. The server apparatus of claim 12 wherein the at least one characteristic of the associated traffic policing device is a state of a firewall.

16. The server apparatus of claim 15 wherein the state of the firewall is open or stateful.

17. The method as described in claim 1 wherein the packet exchange protocol includes predicting an IP address range that the respective client will use to send subsequent messages.

18. The server apparatus as described in claim 12 wherein the packet exchange protocol includes predicting an IP address range that the respective client will use to send subsequent messages.

Assignments (15)

Continuity (2)