Secure networking engine for a secure networking system
Methods, systems, and computer storage media for providing a local protocol server associated with a secure networking engine that provides client-side forwarding in a secure networking system. The local protocol server (e.g., local TCP/UDP server)—on a client device—operates based on client-side forwarding operations that include: IP assignment, operating system (OS) routing, destination network address translation, and original destination retrieval to support accessing a network resource (e.g., socket connection) on the client device and support communications between client applications on the client device and the local protocol server on the same client device. In this way, the local protocol server supports communications of a diverse set of data traffic or network traffic (e.g., different types of cross-platform communications), where the diverse set of network traffic is initially communicated from a client application and processed for network security operations at the local protocol sever of within the same client device.
1. A computerized system comprising:
one or more computer processors; and
computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
access, at a destination network address translator on a client device, an Internet Protocol (IP) packet from a packet interceptor device, the IP packet is associated with both a client application on the client device and an assigned IP address of the packet interceptor device;
using a Destination Network Address Translation (DNAT) operation associated with client-side protocol server communication and port translation, translate a destination network address of the IP packet to a client-side forwarding IP address and port of a local protocol server on the client device; and
communicate the translated IP packet comprising the client-side forwarding IP address and port to an operating system routing mechanism, the client-side forwarding IP address and port cause the operating system routing mechanism to forward data associated with the translated IP packet to the local protocol server.
2. The system of claim 1 , wherein the local protocol server comprises a socket associated with the client-side forwarding IP address and port, the local protocol server is configured to:
listen via the socket;
access the data associated with the translated IP packet;
based on accessing the data associated with the translated IP packet, establish a network connection with the client application, the network connection comprising a route from the client application to the local protocol server via the packet interceptor device and a destination network address translator, wherein establishing the network connection comprises the local protocol server and the client application performing a Transmission Control Protocol (TCP) three-way handshake.
3. The system of claim 2 , wherein a synchronize/acknowledgement communication from the local protocol server and an acknowledgement communication from the client application are communicated via the packet interceptor device and the destination network address translator during the TCP three-way handshake to establish a network connection between the client application and the local protocol server.
4. The system of claim 1 , wherein the local protocol server is further configured to retrieve a source port of the translated IP packet, wherein the source port is mapped to original destination data of the IP packet.
5. The system of claim 1 , wherein the packet interceptor device is configured to receive IP packets that are intercepted based on a plurality of assigned IP addresses that cause intercepting the IP packets and routing the IP packets to the packet interceptor device.
6. The system of claim 1 , the operations further comprising
routing the IP packet to the packet interceptor device based on the assigned IP address; and
communicating data associated with the translated IP packet to the local protocol sever based on the client-side forwarding IP address and port.
7. The system of claim 1 , further comprising a plurality of proxy IP address assignment rules associated with host name resolution, hardcoded IP addresses, allocated IP addresses that instruct on assigning assigned IP addresses to client applications attempting to connect to a network resource.
8. One or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to:
access, at a destination network address translator on a client device, an Internet Protocol (IP) packet from a packet interceptor device, the IP packet is associated with both a client application on the client device and an assigned IP address of the packet interceptor device;
using a Destination Network Address Translation (DNAT) operation associated with client-side protocol server communication and port translation, translate a destination network address of the IP packet to a client-side forwarding IP address and port of a local protocol server on the client device; and
communicate the translated IP packet comprising the client-side forwarding IP address and port to an operating system routing mechanism, the client-side forwarding IP address and port cause the operating system routing mechanism to forward data associated with the translated IP packet to the local protocol server.
9. The media of claim 8 , wherein the local protocol server comprises a socket associated with the client-side forwarding IP address and port, the local protocol server is configured to:
listen via the socket;
access the data associated with the translated IP packet;
based on accessing the data associated with the translated IP packet, establish a network connection with the client application, the network connection comprising a route from the client application to the local protocol server via the packet interceptor device and a destination network address translator, wherein establishing the network connection comprises the local protocol server and the client application performing a Transmission Control Protocol (TCP) three-way handshake.
10. The media of claim 9 , wherein a synchronize/acknowledgement communication from the local protocol server and an acknowledgement communication from the client application are communicated via the packet interceptor device and the destination network address translator during the TCP three-way handshake to establish a network connection between the client application and the local protocol server.
11. The media of claim 8 , wherein the local protocol server is further configured to retrieve a source port of the translated IP packet, wherein the source port is mapped to original destination data of the IP packet.
12. The media of claim 8 , wherein the packet interceptor device is configured to receive IP packets that are intercepted based on a plurality of assigned IP addresses that cause intercepting the IP packets and routing the IP packets to the packet interceptor device.
13. The media of claim 8 , the operations further comprising
routing the IP packet to the packet interceptor device based on the assigned IP address; and
communicating data associated with the translated IP packet to the local protocol sever based on the client-side forwarding IP address and port.
14. The media of claim 8 , further comprising a plurality of proxy IP address assignment rules associated with host name resolution, hardcoded IP addresses, allocated IP addresses that instruct on assigning assigned IP addresses to client applications attempting to connect to a network resource.
15. A computer-implemented method, the method comprising:
accessing, at a destination network address translator on a client device, an Internet Protocol (IP) packet from a packet interceptor device, the IP packet is associated with both a client application on the client device and an assigned IP address of the packet interceptor device;
using a Destination Network Address Translation (DNAT) operation associated with client-side protocol server communication and port translation, translating a destination network address of the IP packet to a client-side forwarding IP address and port of a local protocol server on the client device; and
communicating the translated IP packet comprising the client-side forwarding IP address and port to an operating system routing mechanism, the client-side forwarding IP address and port cause the operating system routing mechanism to forward data associated with the translated IP packet to the local protocol server.
16. The method of claim 15 , wherein the IP packet is received at the packet interceptor device based on the assigned IP address associated with the client application that causes the IP packet to be intercepted and communicated to the packet interceptor device.
17. The method of claim 15 , the method further comprising a plurality of proxy IP address assignment rules associated with host name resolution, hardcoded IP addresses, allocated IP addresses that instruct on assigning assigned IP addresses to client applications attempting to connect to a network resource.
18. The method of claim 15 , the method further comprising authenticating the client application via an identity provider based on retrieving original destination data associated with the IP packet from a domain name system server.
19. The method of claim 15 , wherein the local protocol server retrieves a source port of the IP packet corresponding to the translated IP packet, wherein the source port is mapped to original destination data of the translated IP packet.
20. The method of claim 15 , wherein the local protocol server supports performing a plurality of network security operations on the data associated with the translated IP packets, wherein the network security operations comprise authorizing, auditing, or securing access to a network resource.