Remote access to resources
The invention provides systems and for securely transmitting data between a roaming computer and a managed network service over a shared public network. A secure connection is created between the roaming computer and a server computer that hosts or acts as a secure gateway to the managed network service. The connection is set up and established by a client agent installed on the roaming computer and a connection component of the managed service on the server computer. The client agent and the connection component of the managed service operate, on an initial request from the roaming computer to the managed service to negotiate the secure connection using certificate-based client authentication. The client certificate preferably includes user-specific attributes that can be extracted by the connection component and made available to the managed service to apply processing rules specific to the user.
1. A system comprising:
a roaming computer configured to securely transmit requests to a server computer over a shared public network;
a client agent installed on the roaming computer for creating a secure connection with the server computer and transmitting requests from the roaming computer to the server computer via the secure connection;
the client agent operating, on initiation of the secure connection, to open a communication channel through the secure connection and designate it as a control channel, the control channel being used by the client agent to open a further one or more communication channels for transmission of requests through the secure connection;
the client agent comprising a multiplexer component for combining data from the control channel and said one or more further communication channels into a single data stream for transmission through the secure connection;
a server computer connected to the roaming computer via the public network;
a server component installed on the server computer for receiving requests from the client agent sent via the secure connection, wherein the server component comprises a de-multiplexer component for receiving a multiplexed data stream from the roaming computer sent via the secure connection and separating the de multiplexing the signal to recreate the distinct control channel and one or more further communications channels carrying the requests from the roaming computer.
2. The system of claim 1 , wherein the multiplexed communication through the secure connection is bi-directional, and both the client agent and server component comprise multiplexer and de-multiplexer components.
3. The system of claim 1 , wherein the control channel remains open throughout a session.
4. The system of claim 1 , wherein the control channel is used by both the client agent or the server component to open and close communication channels and to manage the data transfer.
5. The system of claim 1 , wherein the control channel is used for controlling the transfer speed of data through a communication channel.
6. The system of claim 1 , wherein in the case where the client agent of server component request that a communication channel is closed before data transmission is complete, the channel is kept open until transmission is complete and then closed.
7. A method for securely communicating requests between a roaming computer and a server computer over a shared public network, the roaming computer having a client agent installed thereon and the server computer having a server component installed thereon that comprises a de-multiplexer component, the method comprising:
the client agent creating a secure connection with the server computer;
the client agent, on initiation of the secure connection, opening a communication channel through the secure connection and designating it as a control channel;
the client agent, using the control channel, opening a further one or more communication channels for transmission of requests through the secure connection;
the client agent multiplexing data from the control channel and said one or more further communication channels into a single data stream for transmission through the secure connection;
the client agent transmitting the single data stream to the server computer via the secure connection;
the server component receiving the single data channel sent from the roaming computer sent via the secure connection; and
the server component de-multiplexing the single data stream to recreate the distinct control channel and the one or more further communications channels carrying the requests from the roaming computer.
8. The method of claim 7 , wherein opening a further one or more communication channels for transmission of requests through the secure connection comprises:
opening a bi-directional channel, wherein both the client agent and server component comprising multiplexer and de-multiplexer components.
9. The method of claim 7 , further comprising:
maintaining the control channel in an open state throughout a session.
10. The method of claim 7 , further comprising:
opening communication channels, by the client agent or the server component, with the control channel; and
closing communication channels, by the client agent or the server component, with the control channel.
11. The method of claim 7 , further comprising:
controlling, with the control channel, the transfer speed of data through a communication channel.
12. The method of claim 7 , wherein in the case where the client agent of server component requests that a communication channel is closed before data transmission is complete, further comprising:
maintaining the channel in an open state until transmission is complete.
13. One or more non-transitory computer readable storage devices encoded with software comprising computer executable instructions and when the software is executed operable to:
create a secure connection between a roaming computer and a server computer;
transmit requests from the roaming computer to the server computer via the secure connection;
following initiation of the secure connection, open a communication channel through the secure connection and designate the communication channel as a control channel for use in opening a further one or more communication channels for transmission of requests through the secure connection;
cause a multiplexer component to combine data from the control channel and said one or more further communication channels into a single data stream for transmission through the secure connection;
receive the single data channel sent from the roaming computer sent via the secure connection; and
de-multiplex the single data stream to recreate the distinct control channel and the one or more further communications channels carrying the requests from the roaming computer.
14. The non-transitory computer readable storage media of claim 13 , wherein the instructions operable to open a further one or more communication channels for transmission of requests through the secure connection comprise instructions operable to:
open a bi-directional channel, wherein both a client agent on the roaming computer and a server component on the server computer comprise multiplexer and de-multiplexer components.
15. The non-transitory computer readable storage media of claim 13 , further comprising instructions operable to:
maintain the control channel in an open state throughout a session.
16. The non-transitory computer readable storage media of claim 13 , further comprising instructions operable to:
open communication channels with the control channel; and
close communication channels with the control channel.
17. The non-transitory computer readable storage media of claim 13 , further comprising instructions operable to:
control, via the control channel, the transfer speed of data through a communication channel.
18. The non-transitory computer readable storage media of claim 13 , further comprising instructions operable to:
when a server component on the server computer requests that a communication channel is closed before data transmission is complete, maintain the channel in an open state until transmission is complete.