Communicating data between client devices using a hybrid connection having a regular communications pathway and a highly confidential communications pathway
A technique communicates data between a first client device and a second client device. The technique involves establishing a regular communications pathway from the first client device to the second client device through a communications server, and establishing a highly confidential communications pathway from the first client device to the second client device. The highly confidential communications pathway circumvents the communications server. The technique further involves, after the regular communications pathway and the highly confidential communications pathway are established, conveying highly sensitive information from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway.
1. A method of communicating data between a first client device and a second client device, the method comprising:
establishing a regular communications pathway from the first client device to the second client device through a communications server;
establishing a highly confidential communications pathway from the first client device to the second client device, the highly confidential communications pathway circumventing the communications server;
after the regular communications pathway and the highly confidential communications pathway are established, conveying highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway; and
performing a load balancing operation which load balances traffic which is exchanged between the first client device and the second client device, the traffic being load balanced among the regular communications pathway and the highly confidential communications pathway.
2. The method as in claim 1 wherein conveying the highly sensitive data from the first client device to the second client device includes:
receiving, by control circuitry of the first client device, data items for transmission to the second client device;
assigning, by the control circuitry of the first client device, a classification to each data item of the data items; and
sending, by the control circuitry of the first client device, the data items to the second client device through one of (i) the regular communications pathway and (ii) the highly confidential communications pathway based on the classification assigned to each data item of the data items.
3. The method as in claim 2 wherein assigning the classification to each data item of the data items includes:
applying a set of classification rules to the data items to assign a “regular” classification value to regular security data items and a “highly confidential” classification value to highly confidential data items, the “regular” classification value being different than the “highly confidential” classification value, and each data item being assigned at most one of the “regular” classification value and the “highly confidential” classification value.
4. The method as in claim 3 wherein sending the data items includes:
applying a set of pathway policies to each data item of the data items to send all data items which were assigned the “highly confidential” classification value exclusively through the highly confidential communications pathway.
5. The method as in claim 4 , further comprising:
transmitting all data items which were assigned the “regular” classification value exclusively through the regular communications pathway.
6. The method as in claim 4 , further comprising:
transmitting at least one of the data items which were assigned the “regular” classification value through the highly confidential communications pathway.
7. The method as in claim 1 wherein the first client device and the second client device form a portion of a private enterprise network;
wherein the communications server does not form any portion of the private enterprise network; and
wherein establishing the regular communications pathway from the first client device to the second client device through the communications server includes creating (i) a first datapath between the first client device and the communications server and (ii) a second datapath between the second client device and the communications server to form the regular communications pathway from a set of server-based datapaths.
8. The method as in claim 7 wherein establishing the highly confidential communications pathway from the first client device to the second client device includes:
creating an endpoint-to-endpoint datapath between the first client device and the second client device to form the highly confidential communications pathway.
9. The method as in claim 8 wherein the communications server resides in a third-party datacenter;
wherein the first client device and the second client device exchange the highly sensitive data only through the endpoint-to-endpoint datapath to avoid sharing the highly sensitive data with the third-party datacenter; and
wherein creating the endpoint-to-endpoint datapath between the first client device and the second client device includes providing the highly confidential communications pathway in response to initial communications exchanged between the first client device and the second client device through the set of server-based datapaths, the regular communications pathway formed from the set of server-based datapaths carrying regular data which is different than the highly sensitive data.
10. The method as in claim 1 , further comprising:
while monitoring availability of the highly confidential communications pathway, detecting existence of a break in the highly confidential communications pathway; and
in response to detecting the existence of the break in the highly confidential communications pathway, preventing conveyance of additional highly sensitive data from the first client device to the second client device.
11. The method as in claim 10 , further comprising:
while monitoring availability of the highly confidential communications pathway, detecting re-establishment of the highly confidential communications pathway; and
after the highly confidential communications pathway has been re-established, conveying the additional highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway.
12. The method as in claim 10 , further comprising:
in response to detecting existence of the break in the highly confidential communications pathway, outputting an alert to a user of the first client device to indicate that the first client device is unable to send further highly sensitive data to the second client device.
13. The method as in claim 1 , further comprising
after the regular data is exchanged between the first client device to the second client device through the regular communications pathway, conveying further regular data between the first client device and the second client device through the highly confidential communications pathway.
14. The method as in claim 13 wherein conveying further regular data includes:
while monitoring availability of the regular communications pathway, detecting existence of a break in the regular communications pathway; and
in response to detecting existence of the break in the regular communications pathway, conveying the further regular data between the first client device and the second client device through the highly confidential communications pathway.
15. A computer program product having a non-transitory computer readable medium which stores a set of instructions to communicate data between a first client device and a second client device, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:
establishing a regular communications pathway from the first client device to the second client device through a communications server;
establishing a highly confidential communications pathway from the first client device to the second client device, the highly confidential communications pathway circumventing the communications server;
after the regular communications pathway and the highly confidential communications pathway are established, conveying highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway; and
performing a load balancing operation which load balances traffic which is exchanged between the first client device and the second client device, the traffic being load balanced among the regular communications pathway and the highly confidential communications pathway.
16. The computer program product as in claim 15 wherein conveying the highly sensitive data from the first client device to the second client device includes:
receiving, by the first client device, data items for transmission to the second client device;
assigning, by the first client device, a classification to each data item of the data items; and
sending, by the first client device, the data items to the second client device through either the regular communications pathway or the highly confidential communications pathway depending on the classification assigned to each data item of the data items.
17. The computer program product as in claim 15 wherein the first client device and the second client device form a portion of a private enterprise network;
wherein the communications server does not form any portion of the private enterprise network; and
wherein establishing the regular communications pathway from the first client device to the second client device through the communications server includes creating (i) a first datapath between the first client device and the communications server and (ii) a second datapath between the second client device and the communications server to form the regular communications pathway from a set of server-based datapaths.
18. The computer program product as in claim 15 wherein the method further comprises:
while monitoring availability of the highly confidential communications pathway, detecting existence of a break in the highly confidential communications pathway; and
in response to detecting the existence of the break in the highly confidential communications pathway, preventing conveyance of additional highly sensitive data from the first client device to the second client device.
19. The computer program product as in claim 15 wherein the method further comprises:
after the regular data is exchanged between the first client device to the second client device through the regular communications pathway, conveying further regular data between the first client device and the second client device through the highly confidential communications pathway.
20. An electronic apparatus, comprising:
memory; and
control circuitry coupled to the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to:
establish a regular communications pathway from a first client device to a second client device through a communications server,
establish a highly confidential communications pathway from the first client device to the second client device, the highly confidential communications pathway circumventing the communications server, and
after the regular communications pathway and the highly confidential communications pathway are established, convey highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway; and
perform a load balancing operation which load balances traffic which is exchanged between the first client device and the second client device, the traffic being load balanced among the regular communications pathway and the highly confidential communications pathway.