# US 10,454,931 B2 · Secure remote access for secured enterprise communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,931 B2 - Document ID: US10454931B2 - Status: Granted - Kind: B2 - Application number: 15/001,354 - Filed: 2016-01-20 - Published: 2017-07-20 - Granted: 2019-10-22 - Earliest claimed: 2016-01-20 - Assignees: Unisys Corporation - Applicants: Ted Hinaman; Steven J Rajcan; Matthew Mohr; William Gunn; Sarah K Inforzato; Robert A Johnson; Gregory J Small; David S Dodgson - Inventors: Ted Hinaman; Steven J Rajcan; Matthew Mohr; William Gunn; Sarah K Inforzato; Robert A Johnson; Gregory J Small; David S Dodgson - Web page: https://patentgrep.com/patent/US10454931B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/104: {Grouping of entities} - H04W 12/06: Authentication - H04W 72/04: Wireless resource allocation - H04W 88/16: Gateway arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and systems for securing communications with an enterprise from a remote computing system are disclosed. One method includes initiating a secured connection with a VPN appliance associated with an enterprise using service credentials maintained in a secure applet installed on a remote computing device, and initiating communication with an authentication server within an enterprise via the secured connection. The method also includes receiving specific credentials from the authentication server, terminating the secured connection with the VPN appliance, and initiating a second secured connection with the VPN appliance using the specific credentials, the specific credentials providing access to one or more computing devices within the enterprise being within a same community of interest as the remote computing device and obfuscating one or more other computing systems within the enterprise excluded from the community of interest. The method also includes initiating communications with at least one of the one or more computing devices included in the community of interest. ## Claims ### Claim 1 A computer-implemented method of securing communications with an enterprise, the method comprising: initiating a first secured connection between a remote computing device and a VPN appliance associated with an enterprise using service credentials maintained in a secure applet installed on the remote computing device; initiating communication with the authentication server within an enterprise via the first secured connection; providing user credentials from the secure applet to the authentication server; receiving specific credentials from the authentication server based on the user credentials, the specific credentials providing access to one or more computing devices within the enterprise that are within a community of interest accessible by the user, the community of interest including the one or more computing devices and the remote computing device, and obfuscating to the user and the remote computing device one or more other computing systems within the enterprise excluded from the community of interest; terminating the first secured connection with the VPN appliance; after terminating the first secured connection, initiating a second secured connection between the remote computing device and the VPN appliance using the specific credentials from the authentication server, the specific credentials including a one-time password used for establishing the second secured connection; wherein the second secured connection enables communication between the remote computing device and the one or more computing devices within the community of interest via a virtual data relay (vDR) that manages access to the community of interest on behalf of the remote computing device. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising transmitting a session termination message to the authentication server. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising, after transmitting the session termination message, terminating the second secured connection. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the community of interest is associated with user credentials received at a secured application installed on the remote computing device. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the specific credentials include a username and password of a user of the remote computing device. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the specific credentials are different from the service credentials. ### Claim 7 A computer-implemented method of securing communications between a remote computing device and an enterprise, the method comprising: receiving a request for a secured connection from a remote device at a secure remote access gateway device using a set of service credentials maintained at the remote device; starting a service virtual data relay useable by the remote device to communicate with an authentication server within the enterprise; accepting the request for the secured connection at the secure remote access gateway device, thereby establishing a VPN connection between a VPN appliance associated with the secure remote access gateway device and the remote device; receiving user credentials from the remote device; providing user credentials to the authentication server within the enterprise; receiving specific credentials from the authentication server based on the user credentials, the specific credentials providing access to one or more computing devices within the enterprise that are within a community of interest accessible by the user, the community of interest including the one or more computing devices and the remote computing device, and obfuscating to the user and the remote computing device one or more other computing systems within the enterprise excluded from the community of interest; providing the specific credentials to the remote device; receiving a request from the remote device to terminate the secured connection; terminating the service virtual data relay; after terminating the service virtual data relay, receiving a request from the remote device to initiate a second secured connection from the remote device at the secure remote access gateway device using the specific credentials; starting a device-specific virtual data relay useable by the remote computing device to communicate with the one or more computing systems within the enterprise, the device-specific virtual data relay being provided with a community of interest key associated with the community of interest by the authentication server; and accepting the request for the second secured connection, thereby allowing the remote computing device to initiate communications with at least one of the one or more computing devices included in the community of interest without requiring communication of the community of interest key to the remote device. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising receiving a request to terminate the second secured connection from the remote computing device. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising, in response to the request to terminate the second secured connection, terminating the device-specific virtual data relay. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, further comprising maintaining service credentials associated with a service community of interest. ### Claim 11 A system enabling secured communications with an enterprise, the system comprising: a secure remote access gateway device operable as an intermediary between a remote device and one or more computing devices within an enterprise, the secure remote access gateway device configured to execute program instructions to: receive a request for a secured connection from a remote device using a set of service credentials maintained at the remote device; start a service virtual data relay useable by the remote device to communicate with an authentication server within the enterprise; accept the request for the secured connection at the secure remote access gateway device, thereby establishing a VPN connection between a VPN appliance associated with the secure remote access gateway device and the remote device; receive user credentials from the remote device; provide user credentials to the authentication server within the enterprise; receive specific credentials from the authentication server based on the user credentials, the specific credentials providing access to one or more computing devices within the enterprise that are within a community of interest accessible by the user, the community of interest including the one or more computing devices and the remote computing device, and obfuscating to the user and the remote computing device one or more other computing systems within the enterprise excluded from the community of interest; provide the specific credentials to the remote device; receive a request from the remote device to terminate the secured connection; terminate the service virtual data relay; after terminating the service virtual data relay, receive a request from the remote device to initiate a second secured connection from the remote device at the secure remote access gateway device using the specific credentials; start a device-specific virtual data relay useable by the remote computing device to communicate with the one or more computing systems within the enterprise, the device-specific virtual data relay being provided with a community of interest key associated with the community of interest by the authentication server; and accept the request for the second secured connection, thereby allowing the remote computing device to initiate communications with at least one of the one or more computing devices included in the community of interest without requiring communication of the community of interest key to the remote device. ### Claim 12 (depends on 11) The system of claim 11, wherein the secure remote access gateway device is communicatively connected to the remote device. ### Claim 13 (depends on 12) The system of claim 12, further comprising a remote device communicatively connected to the secure remote access gateway device. ### Claim 14 (depends on 13) The system of claim 13, further comprising an authorization server maintained within the enterprise. ### Claim 15 (depends on 14) The system of claim 14, further comprising one or more servers maintained within the enterprise, the one or more servers included within a common community of interest with the remote device and communicatively accessible by the remote device via the secure remote access gateway device. ### Claim 16 (depends on 11) The system of claim 11, wherein the remote computing device includes at least partially non-trusted content received from external to the enterprise. ### Claim 17 (depends on 11) The system of claim 11, wherein the remote computing device includes an applet configured to manage secure communications with the secure remote access gateway device. ### Claim 18 (depends on 11) The system of claim 11, wherein the remote computing device is a member of a second community of interest different from the community of interest, the second community of interest including devices external to the enterprise. ### Claim 19 (depends on 12) The system of claim 12, wherein the remote computing device is assigned an endpoint mode selected from among a collection of endpoint modes consisting of: an enterprise workstation mode; an enterprise server mode; a roaming workstation mode; a remote office workstation mode; a remote office server mode; and an isolated endpoint mode. ### Claim 20 (depends on 12) The system of claim 12, wherein the remote computing device is assigned one or more filters, each filter of the one or more filters defining a list of computing devices with which the remote computing device is authorized to communicate. ### Claim 21 (depends on 12) The system of claim 12, wherein communication between the remote computing device and the one or more computing devices within the enterprise is routed through the device-specific virtual data relay. ### Claim 22 (depends on 1) The computer-implemented method of claim 1, wherein the one or more computing devices within the enterprise being within a same community of interest as the remote computing device are accessible using the second secured connection between the remote computing device and the VPN appliance, and the one or more computing devices within the enterprise are inaccessible using the first secured connection between the remote computing device and the VPN.