Granted Patent B2

US 10,742,595 · App. 16/388,719 · Granted Aug 11, 2020

Inventors: Shanavas Kottikal (Thrisssur, IN); Prabhath Thankappan (Kottayam, IN); John Alappattu Varudunny (Thrissur, IN); George Matthew Koikara (Bangalore, IN)

Assignee: Pulse Secure, LLC

H04L61/1552H04L12/4633H04L12/4641H04L12/66H04L61/1511H04L63/101H04L69/16

Abstract

Claims (67)

1. A system comprising:

a virtual private network (VPN) gateway configured to:

receive a domain name system response through a physical coding sublayer;

fetch a table entry corresponding to the domain name system response, wherein the table entry comprises a fully qualified domain name;

fetch one or more access control list rules from an access control list table for a specific user account corresponding to the table entry;

install an Internet protocol (IP) address in the access control list table for each of the one or more access control list rules for the specific user account; and

handle requested data traffic to the IP address based on the one or more access control list rules; and

a client device configured to:

create a virtual tunnel interface route between the client device and a port of a transmission control protocol (TCP) listener device;

parse a domain name system response packet, received from the VPN gateway, for the fully qualified domain name and an Internet protocol (IP) address;

update a domain name system cache with the fully qualified domain name and the IP address; and

send unencrypted network traffic to the TCP listener device over the virtual tunnel interface route.

2. The system of claim 1 , wherein the one or more access control list rules comprises an allow rule or a deny rule.

3. The system of claim 1 , wherein the fully qualified domain name of the table entry comprises one or more of an IP address and a domain name with one or more wildcard characters.

4. The system of claim 1 , wherein the client device is further configured to:

receive an outbound TCP packet from the virtual tunnel interface route, wherein the outbound TCP packet comprises a destination IP address equal to the IP address in the domain name system response packet;

retrieve, from the domain name system cache, the fully qualified domain name corresponding to the destination IP address;

determine whether the fully qualified domain name matches one of one or more fully qualified domain names received in an initial VPN configuration;

in response to determining one of the one or more fully qualified domain names matches the fully qualified domain name, utilize the virtual tunnel interface route to transfer the outbound TCP packet; and

in response to determining none of the one or more fully qualified domain names match the fully qualified domain name, forward the outbound TCP packet to the TCP listener device by changing the destination IP address and expected port.

5. The system of claim 1 , wherein the client device is further configured to:

receive an outbound TCP synchronization packet; and

store a 4-tuple of a source port, a source IP address, a destination IP address, and a destination port in a map.

6. The system of claim 1 , wherein the client device is further configured to:

determine whether exit data network traffic corresponding with one or more user applications should be routed to a VPN gateway over a secure communication channel or whether the exit data network traffic should be directly routed to a destination IP address thereof over an unsecure communication channel; and

divide the exit data traffic according to a fully qualified domain name of the network traffic destination based on an Access Control List (ACL) listing the fully qualified domain name and the determination of the exit data network traffic route.

7. A method comprising:

receiving, by a virtual private network (VPN) gateway, a domain name system response through a physical coding sublayer;

fetching, by the VPN gateway, a table entry corresponding to the domain name system response, wherein the table entry comprises a fully qualified domain name;

fetching, by the VPN gateway, one or more access control list rules from an access control list table for a specific user account corresponding to the table entry;

installing, by the VPN gateway, an Internet protocol (IP) address in the access control list table for each of the one or more access control list rules for the specific user account; and

handling, by the VPN gateway, requested data traffic to the IP address based on the one or more access control list rules.

8. The method of claim 7 , further comprising:

removing, by the VPN gateway, the IP address from the access control list based on a time to live (TTL) value in the domain name system response.

9. The method of claim 7 , wherein the one or more access control list rules comprises an allow rule or a deny rule.

10. The method of claim 7 , wherein the fully qualified domain name of the table entry comprises one or more of an IP address and a domain name with one or more wildcard characters.

11. The method of claim 7 , further comprising:

resolving, by the VPN gateway, each request for access to fully qualified domain names received from a mobile end user device by initiating a domain name service query; and

storing, by the VPN gateway, the fully qualified domain name and an internet protocol (IP) address provided by the domain name service query in the access control list with access control list rules corresponding with each fully qualified domain name.

12. A method comprising:

creating, by a client device in a virtual private network (VPN), a virtual tunnel interface route between the client device and a port of a transmission control protocol (TCP) listener device;

parsing, by the client device, a domain name system response packet, received from a VPN gateway, for a fully qualified domain name and an Internet protocol (IP) address;

updating, by the client device, a domain name system cache with the fully qualified domain name and the IP address; and

sending, by the client device, unencrypted network traffic to the TCP listener device over the virtual tunnel interface route.

13. The method of claim 12 , further comprising:

receiving, by the client device, an outbound TCP packet from the virtual tunnel interface route, wherein the outbound TCP packet comprises a destination IP address equal to the IP address in the domain name system response packet;

retrieving, by the client device and from the domain name system cache, the fully qualified domain name corresponding to the destination IP address;

determining, by the client device, whether the fully qualified domain name matches one of one or more fully qualified domain names received in an initial VPN configuration;

in response to determining one of the one or more fully qualified domain names matches the fully qualified domain name, utilizing, by the client device, the virtual tunnel interface route to transfer the outbound TCP packet; and

in response to determining none of the one or more fully qualified domain names match the fully qualified domain name, forwarding, by the client device, the outbound TCP packet to the TCP listener device by changing the destination IP address and expected port.

14. The method of claim 12 , further comprising:

receiving, by the client device, an outbound TCP synchronization packet; and

storing, by the client device, a 4-tuple of a source port, a source IP address, a destination IP address, and a destination port in a map.

15. The method of claim 12 , further comprising:

redirecting, by the client device, an inbound TCP packet with a source port originating from the TCP listener device to a user application.

16. The method of claim 12 , further comprising:

sending, by the client device, an accepted socket file descriptor to the TCP listener device;

determining, by the TCP listener device, a real destination IP address and an expected port; and

creating, by the TCP listener device, a TCP connection to the real destination IP and the expected port.

17. The method of claim 12 , wherein the client device does not include a kernel mode component configured to intercept packets.

18. The method of claim 12 , further comprising:

determining, by the client device, whether exit data network traffic corresponding with one or more user applications should be routed to a VPN gateway over a secure communication channel or whether the exit data network traffic should be directly routed to a destination IP address thereof over the virtual interface tunnel route.

19. The method of claim 18 , further comprising:

dividing, by the client device, the exit data traffic according to a fully qualified domain name of the network traffic destination based on an Access Control List (ACL) listing the fully qualified domain name and the determination of the exit data network traffic route.

20. The method of claim 18 , further comprising:

establishing, by the client device, a secure communication session with a VPN gateway; and

forwarding, by the client device, all exit data traffic to the VPN gateway based on the determination of the exit data network traffic route, wherein the client device divides the exit data traffic according to a fully qualified domain name of the network traffic destination.

Assignments (9)

Priority Claims (1)

Continuity (1)

Cited By (2)

US 12,294,567 US 12,549,508