Identity driven peer-to-peer (P2P) virtual private network (VPN)
View Patent ↗Techniques for identity-based Peer-to-Peer (P2P) Virtual Private Networks (VPN's) are provided. First and second principals authenticate to a trusted third party. The first principal subsequently requests a P2P VPN with the second principal. The second principal is contacted on behalf of the first principal and permission is acquired. The first and second principals are then sent commands to directly establish a P2P VPN communication session with one another.
1. A method implemented in a non-transitory computer-readable storage medium that executes on a processor to perform the method of:
receiving, by the processor, an indication from an identity service that a first principal and second principal have successfully authenticated to an identity service;
detecting, by the processor, that the first principal has logged in with a request for access to a Peer-To-Peer (P2P) Virtual Private Network (VPN) communication session with the second principal;
notifying, by the processor, the second principal with the request when the first principal is logged in and makes the request;
sending, by the processor, an approval received from the second principal to the first principal indicating the second principal authorized the first principal to connect with the second principal, the second principal communicates the approval back to the method in real time based on the notification of the request made by the first principal; and
communicating, by the processor, commands to the first and second principals to initiate the P2P VPN communication session with one another and creating a duplex tunnel between workstations associated with the first and second principals that is identity based.
2. The method of claim 1 further comprising, managing, by the processor, the P2P VPN communication session via a first client application on a first client of the first principal and a second client application on a second client of the second principal.
3. The method of claim 2 , wherein managing further includes acquiring policies to manage the P2P VPN communication session from the identity service and enforcing the policies for the P2P VPN communication session via the first client application against the first principal and via the second client application against the second principal.
4. The method of claim 1 . wherein detecting further includes establishing communications with a first client application for a first client of the first principal and a second client application for a second client of the second principal, wherein the first client application and the second client application are pushed and instantiated on the first client and the second client by the identity service once the first principal and second principal have successfully authenticated.
5. The method of claim 1 , wherein detecting further includes receiving the login via a Universal Resource Locator (URL) link activated by the first principal via World-Wide Web (WWW) browser,
6. The method of claim 1 , wherein detecting further includes receiving the login via a World-Wide Web (WWW) application activated by the first principal.
7. The method of claim 1 , wherein detecting further includes making the second principal visible to the first principal before the first principal makes the request.
8. A method implemented in a non-transitory computer-readable storage medium that executes on a processor performing the method, comprising:
identifying, by the processor, a first principal authenticated for a Peer-To-Peer (P2P) Virtual Private Network (VPN) communication session under a first identity that masks a true identity of the first principal;
contacting, by the processor, a second principal on behalf of the first principal with a request for establishing the P2P VPN communication session, wherein the second principal is also authenticated and is presented to the first principal as a second identity that masks a true identity of the second principal, the second principal is contacted in real time for permission for the first identity to connect with the second principal when the first principal makes the request; and
providing, by the processor, commands to the first and second principals to establish the P2P VPN communication session where the first principal sees the second principal as the second identity and the second principal sees the first principal as the first identity and creating a duplex tunnel between workstations associated with the first and second principals that is identity based.
9. The method of claim 8 , wherein identifying further includes acquiring policies from an identity service to manage the P2P VPN communication session.
10. The method of claim 9 , wherein acquiring further includes presenting the second identity and other identities to the first principal for selection with the P2P communication session and receiving a particular selection from the first principal to contact the second identity on behalf of the first principal under the first identity.
11. The method of claim 8 , wherein contacting further includes receiving permission from the second principal for the first identity to establish the P2P VPN communication session with the second principal via the second identity.
12. The method of claim 8 , wherein providing further includes acquiring keys or tokens from an identity service for use in the P2P VPN communication session by the first and second principals, wherein the keys or the tokens are included with the commands.
13. The method of claim 8 , wherein providing further includes including with the commands instructions for the first and the second principal to establish the P2P VPN communication session with one another as a Secure Socket Layer (SSL) P2P VPN communication session.
14. The method of claim 8 , wherein providing further includes monitoring the P2P VPN communication session via interaction with a first application that executes on a first client of the first principal and via a second application that executes on a second client of the second principal.
15. A processor-implemented system, comprising:
a processor having an identity service implemented in a non-transitory computer-readable storage medium and that is executed by the processor and operational over a network; and
a different processor having an Virtual Private Network (VPN) service implemented in a non-transitory computer-readable storage medium that is executed by the different processor and operational over the network;
wherein the identity service authenticates a first principal and a second principal for a trusted relationship with one another over the network and the identity service securely communicates with the VPN service, and wherein when the first principal logs into the VPN service, the VPN service presents the second principal to the first principal and the first principal makes a request to the VPN service for the VPN service to establish a Peer-To-Peer (P2P) VPN communication session between the first principal and the second principal, and wherein the VPN service requests and acquires acceptance from the second principal in real time when the second principal is presented with the request and provides commands to the first and second principals for establishing the P2P VPN communication session with one another and creating a duplex tunnel between workstations associated fir the first and second principals that is identity based.
16. The system of claim 15 , wherein the identity service pushes and initiates a first application on a first client of the first principal and a second application on a second client of the second principal for communication to and from the VPN service.
17. The system of claim 16 , wherein the first application and the second application regularly send heartbeat messages to the VPN service, and wherein some of the heartbeat messages include descriptive information regarding the P2P VPN communication session that is communicated back to the VPN service for purposes of managing the P2P VPN communication session.
18. The system of claim 16 , wherein the VPN service communicates policies acquired from the identity service to the first application and the second application for the first and second applications to enforce during the P2P VPN communication session with one another.
19. The system of claim 16 , wherein the VPN service logs transaction details associated with the P2P VPN communication session based on information provided to the VPN service via the first and second applications.
20. The system of claim 15 , wherein the identity service provides a first alias identity for the first principal and a second alias identity for the second principal, and wherein the VPN service ensures that the first and second principals just see the first and second alias identities before establishing and while communication over the P2P VPN communication session.
21. A processor-implemented system, comprising:
a server having Secure Socket Layer (SSL) Peer-To-Peer (P2P) Virtual Private Network (VPN) manager implemented in a non-transitory computer-readable storage medium and to execute on the server over a network;
a first client having a first application implemented in anon-transitory computer-readable storage medium and to execute on the first client over the network; and
a second client having a second application implemented in a non-transitory computer-readable storage medium and to execute on the second client over the network;
wherein the SSL P2P VPN manager facilitates establishment of an anonymous P2P VPN communication session between a first principal and a second principal over the network and manages the subsequent SSL P2P VPN communication session between the first and second principal via the first application associated with the first principal and the second application associated with the second principal, when a connection is requested between the first and second principals by one of the principals, the other non-requesting principal provides acceptance for the connection to continue in real time and based on the connection requested and when a connection is established a duplex tunnel between the first and second clients is established that is identity based.
22. The system of claim 21 , wherein the SSL P2P VPN manager pushes policies to the first and second applications for the first and second applications to enforce during the SSL P2P VPN communication session between the first and second principals,
23. The system of claim 21 , wherein t e policies are identified for use based on identities assigned to the first and second principals.
24. The system of claim 21 , wherein the SSL P2P VPN manager tracks and monitors the SSL P2P VPN communication session via information received from the first and second applications regarding transactions occurring between the first and second principals during the SSL P2P VPN manager.