Secure access to remote resources over a network
A client computer hosts a virtual private network tool to establish a virtual private network connection with a remote network. Upon startup, the virtual private network tool collects critical network information for the client computer, and sends this critical network information to an address assignment server in the remote network. The address assignment server compares the critical network information with a pool of available addresses in the remote network, and assigns addresses for use by the client computer that do not conflict with the addresses for local resources. The address assignment server also provides routing information for resources in the remote network to the virtual private network tool. The virtual private network tool will postpone loading this routing information into the routing tables of the client computer until the client computer requests access to a specific resource in the remote network. When the client computer requests access to a specific resource in the remote network, the virtual private network tool will only provide the routing table with the routing information for that specific remote resource.
1. A method for securely accessing a remote resource on a remote network, the method comprising:
receiving a communication from a server of the remote resource at a client device over a previously established virtual private network connection, the communication identifying network access information corresponding to the remote resource, wherein the network access information identifies at least one of a network address or a name associated with the remote resource;
intercepting the communication at the client device;
examining the network access information included in the communication from a remote resource server;
comparing the network access information included in the communication received from the remote resource server with information stored in a routing table at the client device, the routing table including a set of initial routing rules for accessing a name server in the remote network, wherein the set is limited to one or more routing rules necessary for accessing the remote resource server;
identifying that the network access information included in the communication is not currently included in the routing table;
adding the network access information to the routing table at the client;
requesting access to the remote resource by a client application stored in a memory of the client computing device using the name or the network address of the remote resource;
transmitting to the name server an address resolution query for the name of the remote resource based on the one or more initial routing rules;
intercepting a reply from the remote resource server intended for the client application, the reply including a network address corresponding to the name or the network address of the remote resource;
obtaining from the memory a routing rule corresponding to the name of the requested resource;
identifying that the client computing device is permitted to access the requested resource based on the routing rule;
generating a routing rule for the network address identified in the reply;
providing to the client application the routing rule for the network address generated from the intercepted reply; and
opening by the client application a secure connection with the remote network based on the generated routing rule.
2. The method of claim 1 , wherein a virtual private network tool residing at the client device collects information identifying an internet protocol address for one or more network adapters at the client device.
3. The method of claim 2 , wherein the virtual private network tool also collects information regarding a subnet for the one or more network adapters at the client device.
4. The method of claim 1 , wherein the remote resource server is at least one of is at least one of a Domain Name Server or a Windows Internet Naming Service server.
5. The method of claim 1 , wherein the network access information is collected by querying an application program interface (API) at the client device.
6. The method of claim 1 , wherein a virtual address is assigned by the remote resource server that the client device may use when accessing the remote resource.
7. The method of claim 6 , wherein the assigned virtual address does not conflict with network addresses local to the client device.
8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for securely accessing a remote resource on a remote network, the method comprising:
receiving a communication from a server of the remote resource at a client device over a previously established virtual private network connection, the communication identifying network access information corresponding to the remote resource, wherein the network access information identifies at least one of a network address or a name associated with the remote resource;
intercepting the communication at the client device;
examining the network access information included in the communication from a remote resource server;
comparing the network access information included in the communication received from the remote resource server with information stored in a routing table at the client device, the routing table including a set of initial routing rules for accessing a name server in the network, wherein the set is limited to one or more routing rules necessary for accessing the remote resource server;
identifying that the network access information included in the communication is not currently included in the routing table;
adding the network access information to the routing table at the client;
requesting access to the remote resource by a client application stored in a memory of the client computing device using the name or the network address of the remote resource;
transmitting to the name server an address resolution query for the name of the remote resource based on the one or more initial routing rules;
intercepting a reply from the remote resource server intended for the client application, the reply including a network address corresponding to the name or the network address of the remote resource;
obtaining from the memory a routing rule corresponding to the name of the requested resource;
identifying that the client computing device is permitted to access the requested resource based on the routing rule;
generating a routing rule for the network address identified in the reply;
providing to the client application the routing rule for the network address generated from the intercepted reply; and
opening by the client application a secure connection with the remote network based on the generated routing rule.
9. The non-transitory computer-readable storage medium of claim 8 , wherein a virtual private network tool residing at the client device collects information identifying an internet protocol address for one or more network adapters at the client device.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the virtual private network tool also collects information regarding a subnet for the one or more network adapters at the client device.
11. The non-transitory computer-readable storage medium of claim 8 , wherein the remote resource server is at least one of is at least one of a Domain Name Server or a Windows Internet Naming Service server.
12. The non-transitory computer-readable storage medium of claim 8 , wherein the network access information is collected by querying an application program interface (API) at the client device.
13. The non-transitory computer-readable storage medium of claim 8 , wherein a virtual address is assigned by the remote resource server that the client device may use when accessing the remote resource.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the assigned virtual address does not conflict with network addresses local to the client device.
15. An apparatus for securely accessing a remote resource on a remote network, the apparatus comprising:
a network interface that receives communication from a server of the remote resource at a client device over a previously established virtual private network connection, the communication identifying network access information corresponding to the remote resource, wherein the network access information identifies at least one of a network address or a name associated with the remote resource;
a memory; and
a processor, wherein the processor executing instructions out of the memory:
intercepts the communication;
examines the network access information included in the communication from a remote resource server;
compares the network access information included in the communication received from the remote resource server with information stored in a routing table stored in the memory, the routing table including a set of initial routing rules for accessing a name server in the network, wherein the set is limited to one or more routing rules necessary for accessing the remote resource server;
identifies that the network access information included in the communication is not currently included in the routing table;
adds the network access information to the routing table at the client, wherein:
access to the remote resource is requested by a client application using the name or the network address of the remote resource, and
the network interface transmits to the name server an address resolution query for the name of the remote resource based on the one or more initial routing rules;
intercepts a reply from the remote resource server intended for the client application, the reply including a network address corresponding to the name or the network address of the remote resource,
obtains from the memory a routing rule corresponding to the name of the requested resource,
identifies that the client computing device is permitted to access the requested resource based on the routing rule, and
generates a routing rule for the network address identified in the reply, and provides to the client application the routing rule for the network address generated from the intercepted reply; wherein the client application opens a secure connection with the remote network based on the generated routing rule.
16. The apparatus of claim 15 , wherein a virtual private network tool residing at the client device collects information identifying an internet protocol address for one or more network.
17. The apparatus of claim 16 , wherein the virtual private network tool also collects information regarding a subnet for the one or more network adapters.
18. The apparatus of claim 16 , wherein the remote resource server is at least one of is at least one of a Domain Name Server or a Windows Internet Naming Service server.