Secure remote access public communication environment
View Patent ↗A method and system provide a user device with secure access to an enterprise application in an enterprise network through VPN. The enterprise application is accessed from a user device such that it sends and receives data packets through the VPN client. For this, a request to send packets, originating from the user application, is intercepted by a VPN agent associated with the user application. In turn, the VPN agent associates an address of a loop-back interface with the user application. Thereafter, packets sent by the user application, are re-directed to the VPN client through the loop-back interface. Similarly, packets received by the VPN client from the enterprise network are routed through the loop-back interface to the user application.
1. A method, in a user device, for establishing a connection between a user application on the user device and an enterprise application on an enterprise network, the method comprising the steps of:
intercepting, by a virtual private network (VPN) agent instantiated on the user device and individually associated with the user application on the user device, a request to an operating system service of the user device for establishing the connection, the request originating from the user application on the user device; and
establishing, based on the intercepted request, a communication channel within the user device, the communication channel being configured to only handle traffic associated with the user application and extending between the VPN agent associated with the user application and a VPN client configured to implement a VPN tunnel to securely transmit traffic from the user device to the enterprise network, both the VPN agent and VPN client residing on the user device.
2. The method of claim 1 , wherein the request comprises a socket application program interface (API) call.
3. The method of claim 1 , wherein the step of establishing a communication channel between the VPN client and the VPN agent comprises creating a loop-back interface between the VPN client and the VPN agent.
4. The method of claim 3 , wherein the creation of the loop-back interface comprises changing a destination address in the request to a loop-back interface address.
5. The method of claim 4 , further comprising the step of requesting, by the VPN agent to the VPN client, to listen in the loop-back interface.
6. The method of claim 1 , wherein the VPN agent is associated with the user application by the VPN client and is not associated with any other user application running on the user device.
7. The method of claim 1 , wherein the step of intercepting by the VPN agent comprises hooking an application program interface (API) call from the user application requesting creation of a socket for the user application.
8. The method of claim 4 , further comprising the steps of:
changing a destination address of a data packet from the user application to the loop-back interface address; and
forwarding the data packet from the VPN agent to the VPN client.
9. The method of claim 8 , further comprising the step of mapping, by the VPN client, the loop-back interface address to an address associated with a VPN tunnel.
10. The method of claim 9 , further comprising the step of using a Transport Control Protocol/ Internet Protocol (TCP/IP) stack to prepare the data packet for transmission by a tunnel in accordance with the mapping.
11. A method in a user device for establishing a connection between an enterprise application on an enterprise network and a user application on a user device through a virtual private network (VPN) client on the user device, the method comprising the steps of:
intercepting, by a VPN agent instantiated on the user device and individually associated with the user application on the user device, a request to an operating system service of the user device to enable listening for requests by other applications to connect with the user application on the user device, the request originating from the user application;
requesting, by the VPN agent to the VPN client to forward connection requests from the enterprise application;
receiving, by the VPN client, a connection request from the enterprise application through a VPN tunnel; and
establishing, based on the received connection request, a communication channel within the user device between the VPN client and the VPN agent, the communication channel being configured to only handle traffic associated with the user application and extending between the VPN agent associated with the user application and the VPN client associated with the VPN tunnel, both the VPN agent and VPN client residing on the user device.
12. The method of claim 11 , wherein the request to an operating system service comprises a socket application program interface (API) call.
13. The method of claim 11 , wherein the step of establishing a communication channel between the VPN client and the VPN agent comprises creating a loop-back interface between the VPN client application and the VPN agent.
14. The method of claim 11 , wherein the VPN agent is associated with the user application by the VPN client and is not associated with any other user application running on the user device.
15. The method of claim 11 , wherein the step of intercepting by the VPN agent comprises hooking an application program interface (API) call for creation of a socket.
16. A system for remote virtual private network (VPN) access to an enterprise application, comprising:
an enterprise network including an enterprise application; and
a user device, wherein the user device includes a VPN agent individually associated with a user application on the user device and adapted to intercept a request to an operating system service of the user device for establishing a connection from the user application executing on the user device to the enterprise application and to establish, based on the intercepted request, a communication channel within the user device, the communication channel being configured to only handle traffic associated with the user application and extending between the VPN agent associated with the user application and a VPN client configured to implement a VPN tunnel to securely transmit traffic from the user device to the enterprise network, both the VPN agent and VPN client residing on the user device.
17. The system of claim 16 , wherein the request comprises a socket application program interface (API) call.
18. The system of claim 16 , wherein the VPN agent is further adapted to create a loopback interface between the VPN client application and the VPN agent.
19. The system of claim 18 , wherein the VPN agent is further adapted to request the VPN client to listen in the loop-back interface.
20. The system of claim 16 , wherein the VPN agent is associated with the user application by the VPN client and is not associated with any other user application running on the user device.
21. The method of claim 1 , wherein the request comprises a socket application program interface (API) call; and
wherein the step of establishing a communication channel between the VPN client and the VPN agent comprises creating a loop-back interface between the VPN client and the VPN agent, the loop-back interface being implemented as a virtual interface that enables the user application to send or receive data packets from the VPN client through an IP address of the virtual interface, rather than through an IP address of a physical interface.