Application-aware connection rules for network access client
Virtual private network (VPN)-related techniques are described. The techniques provide intuitive mechanisms by which a client device more efficiently establishes a VPN connection. In one example, a client device includes a memory, processor(s), and a VPN handler. The VPN handler is configured to monitor actions initiated by one or more applications executable by the programmable processor(s), and determine whether each of the initiated actions requires a VPN connection via which to transmit outbound data traffic corresponding to a respective application of the one or more applications. The VPN handler is further configured to, in response to a detection that at least one initiated action requires the VPN connection via which to transmit the outbound data traffic, automatically establish the VPN connection to couple the client device to an enterprise network, and transmit the outbound data traffic corresponding to the respective application, via the VPN connection.
1. A client device comprising:
a memory configured to store a list of one or more uniform resource locators (URLs), each respective URL included in the list being predetermined to correspond with a protected resource of an enterprise network;
one or more programmable processors coupled to the memory;
a network interface device, coupled to the one or more programable processors, the network interface device being configured to couple the client device with a network;
a virtual private network (VPN) handler coupled to the memory, to the one or more programmable processors, and to the network interface device, the VPN handler being configured to:
monitor one or more application-layer communications output by a plurality of applications executable by the one or more processors;
based on the monitored one or more application-layer communications, identify each attempt of one or more attempts, by the one or more application-layer communications, to access a first URL of the one or more URLs included in the list stored to the memory;
prior to generating outbound data traffic associated with any of the one or more attempts to access the first URL of the one or more URLs included in the list stored to the memory, one of:
establish a new secure VPN connection between the network interface device and a VPN concentrator associated with the enterprise network, or
select an existing secure VPN connection between the network interface device and the VPN concentrator associated with the enterprise network;
transmit, via the network interface device, first outbound data traffic associated with a first attempt of the one or more attempts to access the first URL included in the list over the one of the new secure VPN connection or the selected existing secure VPN connection;
based on the monitored one or more application-layer communications, identify each attempt of one or more attempts, by the one or more application-layer communications, to access a second URL that is not included in the list stored to the memory;
prior to generating second outbound data traffic associated with any of the one or more attempts to access the second URL that is not included in the list stored to the memory, one of:
establish a new unsecure connection between the network interface device and a public network, or
select an existing unsecure connection between the network interface device and the public network; and
transmitting, while the secure VPN connection is active, the second outbound data traffic associated with the second URL that is not included in the list over the one of the new unsecure connection or the selected existing unsecure connection.
2. The client device of claim 1 , wherein, to monitor the application-level communications output by the one or more applications, the VPN handler is configured to monitor system calls issued by the plurality of applications.
3. The client device of claim 1 , wherein the one or more processors are configured to execute one or more operating systems configured to:
receive the application-level communications from the plurality of applications;
filter the received application-level parameters to obtain a subset of the received application-level parameters; and
send each respective application-level parameter of the obtained subset to the VPN handler.
4. The client device of claim 1 , wherein the protected resource is an enterprise intraweb of the enterprise network, and wherein the first URL identifies the enterprise intraweb.
5. The client device of claim 1 , wherein the protected resource is a remote webmail address of the enterprise network, and wherein the first URL identifies the remote webmail address.
6. The client device of claim 1 , wherein the protected resource is a web interface for an internal instant messaging (IM) application of the enterprise network, and wherein the first URL identifies the web interface for the IM application.
7. The client device of claim 1 , wherein the VPN handler is configured to encapsulate packets of the first outgoing traffic according to an Internet Protocol Security (IPSec) protocol suite.
8. The client device of claim 1 , wherein to transmit the first outgoing data traffic via the VPN connection, the VPN handler is configured to tunnel the first outgoing traffic according to a Layer 2 Tunneling Protocol.
9. The client device of claim 1 , wherein the VPN handler is configured to encrypt the first outgoing traffic.
10. The client device of claim 1 , wherein the VPN handler is further configured to:
determine that an active browser of the one or more applications has navigated away from the first URL; and
based on the active browser having navigated away from the first URL, deactivate the one of the new secure VPN connection or the selected existing secure VPN connection via which the first outbound data traffic was transmitted.
11. The client device of claim 1 , wherein the network comprises a public network.
12. The client device of claim 11 , wherein the network interface device is coupled to a router over the public network.
13. The client device of claim 1 , wherein the network comprises the enterprise network.
14. The client device of claim 1 , wherein the network comprises a public network, wherein the network interface device is coupled to a router over the public network, and wherein the router couples the client device to a VPN concentrator.
15. A method comprising:
storing, to a memory of a client device, a list of one or more uniform resource locators (URLs), each respective URL included in the list being predetermined to correspond with a protected resource of an enterprise network;
coupling, by a network interface of the client device, the client device with a network;
monitoring, by a virtual private network (VPN) handler of the client device, one or more application-layer communications output by a plurality of applications executable by the one or more processors;
based on the monitored one or more application-layer communications, identifying, by the VPN handler of the client device, each attempt of one or more attempts, by the one or more application-layer communications, to access a first URL of the one or more URLs included in the list stored to the memory;
prior to generating outbound data traffic associated with any of the one or more attempts to access the first URL of the one or more URLs included in the list stored to the memory, performing, by the VPN handler of the client device, one of:
establishing a new secure VPN connection between the network interface of the client device and a VPN concentrator associated with the enterprise network, or
selecting an existing secure VPN connection between the network interface of the client device and the VPN concentrator associated with the enterprise network;
transmitting, by the VPN handler of the client device, via the network interface of the client device, first outbound data traffic associated with a first attempt of the one or more attempts to access the first URL included in the list over one of the new secure VPN connection or the selected existing secure VPN connection;
based on the monitored one or more application-layer communications, identifying, by the VPN handler of the client device, each attempt of one or more attempts, by the one or more application-layer communications, to access a second URL that is not included in the list stored to the memory;
prior to generating second outbound data traffic associated with any of the one or more attempts to access the second URL that is not included in the list stored to the memory, performing, by the VPN handler of the client device, one of:
establishing a new unsecure connection between the network interface of the client device and a public network, or
selecting an existing unsecure connection between the network interface of the client device and the public network; and
transmitting, by the VPN handler of the client device, via the network interface of the client device, while the secure VPN connection is active, the second outbound data traffic associated with the second URL that is not included in the list over one of the new unsecure connection or the selected existing unsecure connection.
16. The method of claim 15 , wherein monitoring the application-level communications output by the one or more applications comprises monitoring, by the VPN handler of the client device, system calls issued by the plurality of applications.
17. The method of claim 15 , further comprising:
receiving, by the VPN hander, the application-level communications from the plurality of applications;
filtering the received application-level parameters to obtain a subset of the received application-level parameters; and
sending each respective application-level parameter of the obtained subset to the VPN handler.
18. The method of claim 15 , wherein the protected resource is an enterprise intraweb of the enterprise network, and wherein the first URL identifies the enterprise intraweb.
19. The method of claim 15 , wherein the protected resource is a remote webmail address of the enterprise network, and wherein the first URL identifies the remote webmail address.
20. The method of claim 15 , wherein the protected resource is a web interface for an internal instant messaging (IM) application of the enterprise network, and wherein the first URL identifies the web interface for the IM application.
21. A non-transitory computer-readable storage medium encoded with instructions that, when executed, cause one or more processors of a client device to:
store, to a memory of a client device, a list of one or more uniform resource locators (URLs), each respective URL included in the list being predetermined to correspond with a protected resource of an enterprise network;
couple, using a network interface of the client device, the client device with a network;
monitor one or more application-layer communications output by a plurality of applications executable by the one or more processors;
based on the monitored one or more application-layer communications, identify each attempt of one or more attempts, by the one or more application-layer communications, to access a first URL of the one or more URLs included in the list stored to the memory;
prior to generating outbound data traffic associated with any of the one or more attempts to access the first URL of the one or more URLs included in the list stored to the memory, perform one of:
establishing a new secure virtual private network (VPN) connection between the network interface of the client device and a VPN concentrator associated with the enterprise network, or
selecting an existing secure VPN connection between the network interface of the client device and the VPN concentrator associated with the enterprise network;
transmit, via the network interface of the client device, first outbound data traffic associated with a first attempt of the one or more attempts to access the first URL included in the list over one of the new secure VPN connection or the selected existing secure VPN connection;
based on the monitored one or more application-layer communications, identify each attempt of one or more attempts, by the one or more application-layer communications, to access a second URL that is not included in the list stored to the memory;
prior to generating second outbound data traffic associated with any of the one or more attempts to access the second URL that is not included in the list stored to the memory, perform one of:
establishing a new unsecure connection between the network interface of the client device and a public network, or
selecting an existing unsecure connection between the network interface of the client device and the public network; and
transmit, via the network interface of the client device, while the secure VPN connection is active, the second outbound data traffic associated with the second URL that is not included in the list over one of the new unsecure connection or the selected existing unsecure connection.