Granted Patent B2

US 9,735,943 · App. 14/708,464 · Granted Aug 15, 2017

Inventor: Vagish Kalligudd (Fort Lauderdale, FL)

Assignee: Citrix Systems, Inc.

H04L5/0053H04L12/4641H04L47/825H04L61/1511H04L63/029H04L63/0272H04W12/02H04W76/02H04W76/022G06F9/545

Abstract

Claims (78)

1. A method comprising:

determining, by a processor of a mobile device, that a mobile application executing on the mobile device requests to communicate with a private network;

intercepting, by the processor, one or more system calls to communicate with the private network issued by the mobile application executing on the mobile device;

allocating, by the processor, a dynamic port of the mobile device to be used for routing communications from the mobile application by assigning different dynamic ports to each of a plurality of mobile applications that requests to communicate with the private network;

generating, by the processor and on the dynamic port of the mobile device, a communication link to a virtual private network (VPN) server through which to transmit communications from the mobile application to the private network; and

instructing, by the processor, the VPN server to transmit one or more messages from the mobile application to an access gateway for forwarding to the private network.

2. The method of claim 1 , wherein the allocating the dynamic port comprises:

identifying, by the processor, a destination network address of at least one message associated with the one or more system calls; and

identifying, by the processor, the dynamic port to be used for routing communications from the mobile application to the private network using a mapping of destination network addresses to dynamic ports of the mobile device, wherein the dynamic port corresponds to the destination network address of the at least one message in the mapping of destination network addresses.

3. The method of claim 1 , wherein the VPN server is a transmission control protocol (TCP) server, and wherein generating the communication link to the VPN server further comprises:

generating, by the processor, the TCP server on the dynamic port; and

generating, by the processor, a TCP connection between the dynamic port and the TCP server.

4. The method of claim 1 , further comprising:

determining, by the processor, that the one or more messages are destined to a plurality of different network addresses;

generating, by the processor, a plurality of TCP servers, wherein each TCP server of the plurality of TCP servers is generated on a different dynamic port of the mobile device, and wherein each dynamic port of a plurality of dynamic ports is generated to transmit communications from the mobile application to the private network for each of the plurality of different network addresses; and

generating, by the processor, a plurality of TCP connections, wherein each TCP connection corresponds to a communication link through which to transmit communications from the mobile application from each of the plurality of dynamic ports to the private network.

5. The method of claim 1 , further comprising:

allocating, by the processor, a fixed port of the mobile device to be used for routing communications from a second mobile application to the private network; and

generating, by the processor and on the fixed port of the mobile device, a communication link to a user datagram protocol (UDP) server through which to transmit communications from the second mobile application to the private network, and wherein generating the communication link to the UDP server further comprises:

generating, by the processor, a UDP connection between the fixed port and the UDP server.

6. The method of claim 1 , further comprising:

determining, by the processor, the one or more messages from the mobile application destined for the private network; and

transmitting, by the processor, a payload of the one or more messages to the VPN server at the dynamic port of the mobile device.

7. The method of claim 1 , wherein instructing the VPN server to transmit the one or more messages from the mobile application to the access gateway further comprises:

instructing, by the processor, the VPN server at the dynamic port to generate one or more packets from the one or more messages according to a tunneling protocol of the communication link used to transmit the one or more messages to the private network; and

instructing, by the processor, the VPN server to transmit the one or more packets processed according to the tunneling protocol to the private network over the communication link.

8. The method of claim 1 , wherein the instructing the VPN server to transmit the one or more messages from the mobile application to the access gateway for forwarding to the private network further comprises:

replacing a private network destination address in the one or more messages with an address for the access gateway; and

instructing the access gateway to forward the one or messages to the private network destination address.

9. An apparatus comprising:

at least one processor;

at least one dynamic communication port; and

at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause the apparatus to:

determine that a mobile application executing on the apparatus requests to communicate with a private network;

intercept one or more system calls to communicate with the private network issued by the mobile application executing on the apparatus;

allocate, by the processor, a dynamic port, of the at least one dynamic communication port, to be used for routing communications from the mobile application by assigning different dynamic ports to each of a plurality of mobile applications that requests to communicate with the private network;

generate, at the allocated dynamic port, a communication link to a virtual private network (VPN) server through which to transmit communications from the mobile application to the private network; and

instruct the VPN server to transmit one or more messages from the mobile application to an access gateway for forwarding to the private network.

10. The apparatus of claim 9 , wherein the allocating the dynamic port comprises:

identifying a destination network address of at least one message associated with the one or more system calls; and

identifying the dynamic port using a mapping of destination network addresses to dynamic communication ports of the apparatus, wherein the dynamic port corresponds to the destination network address of the at least one message in the mapping of destination network addresses.

11. The apparatus of claim 9 , wherein the at least one memory further stores computer-readable instructions that, when executed by the at least one processor, further cause the apparatus to:

determine that the one or more messages are destined to a plurality of different network addresses;

generate a plurality of TCP servers, wherein each TCP server of the plurality of TCP servers is generated on a different dynamic communication port of the apparatus, and wherein each dynamic communication port of the at least one dynamic communication port is generated to transmit communications from the mobile application to the private network for each of the plurality of different network addresses; and

generate a plurality of TCP connections, wherein each TCP connection corresponds to a communication link through which to transmit communications from the mobile application from each of the at least one dynamic communication port to the private network.

12. The apparatus of claim 9 , further comprising a fixed communication port, and wherein the at least one memory further stores computer-readable instructions that, when executed by the at least one processor, further cause the apparatus to:

allocate the fixed communication port to be used for routing communications from a second mobile application to the private network; and

generating, by the processor and on the fixed communication port, a communication link to a user datagram protocol (UDP) server through which to transmit communications from the second mobile application to the private network, and wherein the computer-readable instructions to generate the communication link to the UDP server, when executed by the at least one processor, cause the apparatus to:

generate a UDP connection between the fixed communication port and the UDP server.

13. The apparatus of claim 9 , wherein the computer-readable instructions to instruct the VPN server to transmit the one or more messages from the mobile application to the access gateway, when executed by the at least one processor, cause the apparatus to:

instruct the VPN server at the at least one dynamic communication port to generate one or more packets from the one or more messages according to a tunneling protocol of the communication link used to transmit the one or more messages to the private network; and

instruct the VPN server to transmit the one or more packets processed according to the tunneling protocol to the private network over the communication link.

14. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by one or more processors of a data processing system, cause the data processing system to perform:

determining that an application executing on the data processing system requests to communicate with a private network;

intercepting one or more system calls to communicate with the private network issued by the application executing on the data processing system;

allocating a dynamic port to be used for routing communications from the application by assigning different dynamic ports to each of a plurality of applications that requests to communicate with the private network;

generating, on the allocated dynamic port, a communication link to a virtual private network (VPN) server through which to transmit communications from the application to the private network; and

instructing the VPN server to transmit one or more messages from the application to an access gateway for forwarding to the private network.

15. The one or more non-transitory computer-readable storage media of claim 14 , wherein the allocating the dynamic port comprises:

identifying a destination network address of at least one message associated with the one or more system calls; and

identifying the dynamic port to be used for routing communications from the application to the private network using a mapping of destination network addresses to dynamic ports of the data processing system, wherein the dynamic port corresponds to the destination network address of the at least one message in the mapping of destination network addresses.

16. The one or more non-transitory computer-readable storage media of claim 14 , wherein the VPN server is a transmission control protocol (TCP) server, and wherein generating the communication link to the VPN server further comprises:

generating the TCP server on the dynamic port; and

generating a TCP connection between the dynamic port and the TCP server.

17. The one or more non-transitory computer-readable storage media of claim 14 , comprising further instructions that, when executed by the one or more processors, further cause the data processing system to perform:

determining that the one or more messages are destined to a plurality of different network addresses;

generating a plurality of TCP servers, wherein each TCP server of the plurality of TCP servers is generated on a different dynamic port of the data processing system, and wherein each dynamic port of a plurality of dynamic ports is generated to transmit communications from the application to the private network for each of the plurality of different network addresses; and

generating a plurality of TCP connections, wherein each TCP connection corresponds to a communication link through which to transmit communications from the application from each of the plurality of dynamic ports to the private network.

18. The one or more non-transitory computer-readable storage media of claim 14 , comprising further instructions that, when executed by the one or more processors, further cause the data processing system to perform:

allocating a fixed port of the data processing system to be used for routing communications from a second mobile application to the private network; and

generating, on the fixed port of the data processing system, a user datagram protocol (UDP) server through which to transmit communications from the second mobile application to the private network, and wherein generating the communication link to the VPN UDP server further comprises:

generating a UDP connection between the fixed port and the UDP server.

19. The one or more non-transitory computer-readable storage media of claim 14 , comprising instructions that, when executed by the one or more processors, further cause the data processing system to perform:

determining the one or more messages from the application destined for the private network; and

transmitting a payload of the one or more messages to the VPN server at the dynamic port of the data processing system.

20. The one or more non-transitory computer-readable storage media of claim 14 , wherein instructing the VPN server to transmit the one or more messages from the application to the access gateway further comprises:

instructing the VPN server at the dynamic port to generate one or more packets from the one or more messages according to a tunneling protocol of the communication link used to transmit the one or more messages to the private network; and

instructing the VPN server to transmit the one or more packets processed according to the tunneling protocol to the private network over the communication link.

Assignments (9)

Continuity (1)