Granted Patent B2

US 10,187,356 · App. 15/358,806 · Granted Jan 22, 2019

Inventor: Modesto Tabares (Weston, FL)

Assignee: Citrix Systems, Inc.

H04L63/0272H04L61/1511H04L61/2514H04L61/2592H04L63/166

Abstract

Claims (43)

1. A method for providing a customer network with connectivity required for cloud computing services, comprising:

instantiating an SSL/TLS-based VPN tunnel between an SSL/TLS-based VPN client computer system operatively connected to a customer network of a cloud service customer, and an SSL/TLS-based VPN server operatively connected to a provider network of a cloud services provider;

facilitating digital data communications between the SSL/TLS-based VPN server and one or more computing resources comprising the customer network of the cloud services customer by using a reverse network address translation (RNAT) at the SSL/TLS-based VPN client computer system since the customer network is unable to recognize network addresses within an address space of the provider network;

avoiding any reconfiguration of routing tables in the customer network by using the RNAT to selectively modify

one or more first data packets received from the provider network to change the source address in a protocol header from a network address of a first computing entity in a private address space of the provider network, to a predetermined network address in a private address space of the customer network, and

one or more second data packets received from a second computing entity in the private address space of the customer network to change the destination address contained the protocol header from the predetermined network address in the private address space of the customer network, to the network address of the first computing entity in the private address space of the provider network.

2. The method according to claim 1 , wherein the predetermined network address in the private address space of the customer network is the network address of the VPN client computer system.

3. The method according to claim 1 , further comprising automatically communicating from the SSL/TLS-based VPN client computer system to the SSL/TLS-based VPN server a range of network address values corresponding to the private address space of the customer network which are to be excluded from use in the provider network.

4. The method according to claim 3 , further comprising automatically selectively modifying a configuration of the provider network so that the private address space of the provider network is exclusive of the private address space of the customer network.

5. The method according to claim 1 , wherein there exist a plurality of computing entities in each of said customer network and the provider network, and the RNAT selectively modifies a source port number in each data message received from the plurality of computing entities in the provider network before forwarding said data message to one of the plurality of computing entities in the customer network.

6. The method according to claim 5 , further comprising using a destination port number in a plurality of data messages received at the RNAT from the plurality of computing entities in the customer network to facilitate identification of each communication connection between one of the plurality of computing entities in the provider network and one of the plurality of computing entities in the customer network.

7. A method for providing a customer network with connectivity required for cloud computing services, comprising:

instantiating an SSL/TLS-based VPN tunnel between an SSL/TLS-based VPN client computer system operatively connected to a customer network of a cloud service customer, and an SSL/TLS-based VPN server operatively connected to a provider network of a cloud services provider;

facilitating digital data communications between the SSL/TLS-based VPN server and one or more computing resources comprising the customer network of the cloud services customer by using a reverse network address translation (RNAT) at the SSL/TLS-based VPN client computer system;

using the RNAT to selectively modify

one or more first data packets received from the provider network to change the source address from a network address of a first computing entity in a private address space of the provider network, to a predetermined network address in a private address space of the customer network, and

one or more second data packets received from a second computing entity in the private address space of the customer network to change the destination address contained therein from the predetermined network address in the private address space of the customer network, to the network address of the first computing entity in the private address space of the provider network; and

receiving in the VPN client computer system at least one DNS request from the first computing entity in the private address space of the provider network, and addressed to a local DNS server in the private address space of the customer network, to retrieve a network address of a computing resource in the private address space of the customer network.

8. The method according to claim 7 , further comprising automatically modifying the DNS request to change a source address contained therein from the network address of the first computing entity in the private address space of the provider network, to the network address of the VPN client computer system.

9. The method according to claim 8 , further comprising operating the VPN client computer system to route the DNS request to the local DNS server in the private address space of the customer computer network.

10. The method according to claim 9 , further comprising receiving at the VPN client computer system a response message to the DNS request from the local DNS server, and changing a destination address of the response message to a destination address of the first computing entity in the private address space of the provider network.

11. The method according to claim 10 , further comprising routing the response message from the VPN client compute system to the provider network using the SSL/TLS-based VPN tunnel.

12. A system for providing a customer network with connectivity required for cloud computing services, comprising:

an SSL/TLS-based VPN client computer system operatively connected to a customer network of a cloud service customer, and configured for

instantiating an SSL/TLS-based VPN tunnel with an SSL/TLS-based VPN server operatively connected to a provider network of a cloud services provider,

facilitating digital data communications with one or more computing resources comprising the customer network by using a reverse network address translation (RNAT) at the SSL/TLS-based VPN client computer system since the customer network is unable to recognize network addresses within an address space of the provider network, and

avoiding any reconfiguration of routing tables in the customer network by selectively modifying

one or more first data packets received from the provider network to change the source address in a protocol header from a network address of a first computing entity in a private address space of the provider network, to a predetermined network address in a private address space of the customer network, and

one or more second data packets received from a second computing entity in the private address space of the customer network to change the destination address contained a protocol header from the predetermined network address in the private address space of the customer network, to the network address of the first computing entity in the private address space of the provider network.

13. The system according to claim 12 , wherein the predetermined network address in the private address space of the customer network is the network address of the VPN client computer system.

14. The system according to claim 12 , wherein the SSL/TLS-based VPN client computer system is further configured to automatically communicate to the SSL/TLS-based VPN server a range of network address values corresponding to the private address space of the customer network which are to be excluded from use in the provider network.

15. The system according to claim 12 , wherein there exist a plurality of computing entities in each of said customer network and the provider network, and the SSL/TLS-based VPN client computer system is configured to selectively modify a source port number in each data message received from the plurality of computing entities in the provider network before forwarding said data message to one of the plurality of computing entities in the customer network.

16. The system according to claim 15 , wherein the SSL/TLS-based VPN client computer system is configured to use a destination port number in a plurality of data messages received from the plurality of computing entities in the customer network to facilitate identification of each communication connection between one of the plurality of computing entities in the provider network and one of the plurality of computing entities in the customer network.

17. A system for providing a customer network with connectivity required for cloud computing services, comprising:

an SSL/TLS-based VPN client computer system operatively connected to a customer network of a cloud service customer, and configured for

instantiating an SSL/TLS-based VPN tunnel with an SSL/TLS-based VPN server operatively connected to a provider network of a cloud services provider, and

facilitating digital data communications with one or more computing resources comprising the customer network by using a reverse network address translation (RNAT) at the SSL/TLS-based VPN client computer system to selectively modify

one or more first data packets received from the provider network to change the source address from a network address of a first computing entity in a private address space of the provider network, to a predetermined network address in a private address space of the customer network, and

one or more second data packets received from a second computing entity in the private address space of the customer network to change the destination address contained therein from the predetermined network address in the private address space of the customer network, to the network address of the first computing entity in the private address space of the provider network;

wherein the SSL/TLS-based VPN client computer system is configured to receive at least one DNS request from the first computing entity in the private address space of the provider network, and addressed to a local DNS server in the private address space of the customer network, to retrieve a network address of a computing resource in the private address space of the customer network.

18. The system according to claim 17 , wherein the SSL/TLS-based VPN client computer system is configured to automatically modify the DNS request to change a source address contained therein from the network address of the first computing entity in the private address space of the provider network, to the network address of the VPN client computer system.

19. The system according to claim 18 , wherein the SSL/TLS-based VPN client computer system is configured to route the DNS request to the local DNS server in the private address space of the customer computer network.

20. The system according to claim 19 , wherein the SSL/TLS-based VPN client computer system is configured to receive a response message to the DNS request from the local DNS server, and change a destination address of the response message to a destination address of the first computing entity in the private address space of the provider network before routing the response message to the provider network using the SSL/TLS-based VPN tunnel.

Assignments (9)

Continuity (1)