Granted Patent B2

US 9,954,664 · App. 15/646,141 · Granted Apr 24, 2018

Inventor: Vagish Kalligudd (Fort Lauderdale, FL)

Assignee: Citrix Systems, Inc.

H04L5/0053H04L12/4641H04L47/825H04L61/1511H04L63/029H04L63/0272H04W12/02H04W76/02H04W76/022G06F9/545

Abstract

Claims (83)

1. A method comprising:

determining, by a processor of a mobile device, that a mobile application executing on the mobile device requests to communicate with a private network;

intercepting, by a processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device;

responsive to determining that the one or more system calls are addressed to a domain socket path, replacing the domain socket path in the one or more system calls with a sandbox path that corresponds to the mobile application;

generating, by the processor, a communication link to a virtual private network (VPN) server at the sandbox path through which to transmit communications from the mobile application to the private network; and

instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway for forwarding to the private network.

2. The method of claim 1 , further comprising:

determining, by the processor, that the one or more system calls comprise at least one domain name system (DNS) query addressed to a system level DNS process; and

wherein replacing the domain socket path in the one or more system calls with the sandbox path further comprises:

generating, by the processor, the sandbox path at a local domain socket through which to transmit communications from the mobile application to the private network; and

generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket.

3. The method of claim 2 , further comprising:

generating, by the processor, an application specific DNS process at the VPN server that is communicatively coupled to the local domain socket.

4. The method of claim 2 , further comprising:

identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; and

transmitting, by the processor, the at least one message to the VPN server that is communicatively coupled to the local domain socket for DNS resolution; and

instructing, by the processor, an application specific DNS process at the VPN server to transmit the one or more messages to the access gateway for forwarding to the private network.

5. The method of claim 1 , wherein instructing the VPN server to transmit the one or more messages from the mobile application to the access gateway further comprises:

instructing, by the processor, the VPN server at the sandbox path to generate one or more packets from the one or more messages according to a DNS protocol of the communication link used to transmit the one or more messages to the private network; and

instructing, by the processor, the VPN server to transmit the one or more packets processed according to the DNS protocol to the private network over the communication link.

6. The method of claim 1 , further comprising:

determining, by the processor, that a plurality of different messages from a plurality of different mobile applications executing on the mobile device are destined for the private network;

generating, by the processor, a plurality of sandbox paths, wherein each sandbox path of the plurality of sandbox paths is generated at a different local domain socket of a plurality of local domain sockets to transmit communications from a corresponding mobile application of the plurality of different mobile applications to the private network;

generating, by the processor and for the mobile application, a plurality of VPN servers, wherein each of the plurality of VPN servers is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets; and

generating, by the processor, a plurality of application specific DNS processes, wherein each application specific DNS process executes at a corresponding VPN server of the plurality of VPN servers that is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets.

7. The method of claim 2 , further comprising:

responsive to determining that the at least one DNS query needs to be resolved by the system level DNS process, transmitting, by the processor, at least one message associated with the one or more system calls to the system level DNS process for DNS resolution.

8. One or more non-transitory computer readable storage media storing computer readable instructions that, when execute, cause a mobile device to perform a method comprising:

determining, by a processor of the mobile device, that a mobile application executing on the mobile device requests to communicate with a private network;

intercepting, by the processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device;

responsive to determining that the one or more system calls are addressed to a domain socket path, replacing the domain socket path in the one or more system calls with a sandbox path that corresponds to the mobile application;

generating, by the processor, a communication link to a virtual private network (VPN) server at the sandbox path through which to transmit communications from the mobile application to the private network; and

instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway for forwarding to the private network.

9. The computer readable storage media of claim 8 , said method further comprising:

determining, by the processor, that the one or more system calls comprise at least one domain name system (DNS) query addressed to a system level DNS process; and

wherein replacing the domain socket path in the one or more system calls with the sandbox path further comprises:

generating, by the processor, the sandbox path at a local domain socket through which to transmit communications from the mobile application to the private network; and

generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket.

10. The computer readable storage media of claim 9 , said method further comprising:

generating, by the processor, an application specific DNS process at the VPN server that is communicatively coupled to the local domain socket.

11. The computer readable storage media of claim 9 , said method further comprising:

identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; and

transmitting, by the processor, the at least one message to the VPN server that is communicatively coupled to the local domain socket for DNS resolution; and

instructing, by the processor, an application specific DNS process at the VPN server to transmit the one or more messages to the access gateway for forwarding to the private network.

12. The computer readable storage media of claim 8 , wherein instructing the VPN server to transmit the one or more messages from the mobile application to the access gateway further comprises:

instructing, by the processor, the VPN server at the sandbox path to generate one or more packets from the one or more messages according to a DNS protocol of the communication link used to transmit the one or more messages to the private network; and

instructing, by the processor, the VPN server to transmit the one or more packets processed according to the DNS protocol to the private network over the communication link.

13. The computer readable storage media of claim 8 , said method further comprising:

determining, by the processor, that a plurality of different messages from a plurality of different mobile applications executing on the mobile device are destined for the private network;

generating, by the processor, a plurality of sandbox paths, wherein each sandbox path of the plurality of sandbox paths is generated at a different local domain socket of a plurality of local domain sockets to transmit communications from a corresponding mobile application of the plurality of different mobile applications to the private network;

generating, by the processor and for the mobile application, a plurality of VPN servers, wherein each of the plurality of VPN servers is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets; and

generating, by the processor, a plurality of application specific DNS processes, wherein each application specific DNS process executes at a corresponding VPN server of the plurality of VPN servers that is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets.

14. The computer readable storage media of claim 9 , said method further comprising:

responsive to determining that the at least one DNS query needs to be resolved by the system level DNS process, transmitting, by the processor, at least one message associated with the one or more system calls to the system level DNS process for DNS resolution.

15. A mobile device comprising:

a processor; and

memory storing readable instructions that, when executed by the processor, cause the mobile device to perform:

determining, by the processor, that a mobile application executing on the mobile device requests to communicate with a private network;

intercepting, by the processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device;

responsive to determining that the one or more system calls are addressed to a domain socket path, replacing the domain socket path in the one or more system calls with a sandbox path that corresponds to the mobile application;

generating, by the processor, a communication link to a virtual private network (VPN) server at the sandbox path through which to transmit communications from the mobile application to the private network; and

instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway for forwarding to the private network.

16. The mobile device of claim 15 , wherein the computer readable instructions, when executed by the processor, further cause the mobile device to perform:

determining, by the processor, that the one or more system calls comprise at least one domain name system (DNS) query addressed to a system level DNS process; and

wherein replacing the domain socket path in the one or more system calls with the sandbox path further comprises:

generating, by the processor, the sandbox path at a local domain socket through which to transmit communications from the mobile application to the private network; and

generating, by the processor and for the mobile application, the VPN server that is communicatively coupled to the local domain socket.

17. The mobile device of claim 16 , wherein the computer readable instructions, when executed by the processor, further cause the mobile device to perform:

generating, by the processor, an application specific DNS process at the VPN server that is communicatively coupled to the local domain socket.

18. The mobile device of claim 16 , wherein the computer readable instructions, when executed by the processor, further cause the mobile device to perform:

identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; and

transmitting, by the processor, the at least one message to the VPN server that is communicatively coupled to the local domain socket for DNS resolution; and

instructing, by the processor, an application specific DNS process at the VPN server to transmit the one or more messages to the access gateway for forwarding to the private network.

19. The mobile device of claim 15 , wherein instructing the VPN server to transmit the one or more messages from the mobile application to the access gateway further comprises:

instructing, by the processor, the VPN server at the sandbox path to generate one or more packets from the one or more messages according to a DNS protocol of the communication link used to transmit the one or more messages to the private network; and

instructing, by the processor, the VPN server to transmit the one or more packets processed according to the DNS protocol to the private network over the communication link.

20. The mobile device of claim 15 , wherein the computer readable instructions, when executed by the processor, further cause the mobile device to perform:

determining, by the processor, that a plurality of different messages from a plurality of different mobile applications executing on the mobile device are destined for the private network;

generating, by the processor, a plurality of sandbox paths, wherein each sandbox path of the plurality of sandbox paths is generated at a different local domain socket of a plurality of local domain sockets to transmit communications from a corresponding mobile application of the plurality of different mobile applications to the private network;

generating, by the processor and for the mobile application, a plurality of VPN servers, wherein each of the plurality of VPN servers is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets; and

generating, by the processor, a plurality of application specific DNS processes, wherein each application specific DNS process executes at a corresponding VPN server of the plurality of VPN servers that is communicatively coupled to a corresponding local domain socket of the plurality of local domain sockets.

21. The mobile device of claim 16 , wherein the computer readable instructions, when executed by the processor, further cause the mobile device to perform:

responsive to determining that the at least one DNS query needs to be resolved by the system level DNS process, transmitting, by the processor, at least one message associated with the one or more system calls to the system level DNS process for DNS resolution.

Assignments (8)

Continuity (2)