Selective desktop control of virtual private networks (vpn's) in a multiuser environment
AssigneeNovell, Inc.
InventorsGirish KS, Gautham Chambrakana Ananda, Vishnu Govind Attur, Allu Babula
Life of this patent
Estimating the term…
Abstract
Techniques for selective desktop control of virtual private networks (VPN's) in a multiuser environment are provided. A multiuser desktop/workstation includes a first user that establishes a VPN session on the desktop for accessing protected resources. Other users are permitted to simultaneously access non-protected resources of the desktop during the VPN session. Other users are also permitted to log into the desktop during the VPN session. However, if the other users attempt to access the protected resources, the access attempts are denied.
Claims24
A machine-implemented method, comprising:
- establishing a virtual private network (VPN) session on a client workstation for a first principal;
- permitting multiple second principals to log into the client workstation during the VPN session with the first principal;
- routing connection requests from the first principal and the second principals through a VPN client interface, wherein the connection requests are directed to a protected resource associated with the VPN session;
- and
- enforcing a policy in response to identities associated with the first principal and the second principal that permits the first principal to connect to the protected resource via the VPN session and that denies the second principals in their attempts to connect to the protected resource.
A machine-implemented method, comprising:
- establishing a virtual private network (VPN) session for a first principal on a workstation that supports multiple concurrent principals;
- intercepting connection requests made by applications processing on the workstation;
- passing the intercepted connection requests to a VPN client associated with the VPN session;
- resolving identities of each of the connection requests;
- and
- blocking any particular connection request associated with a particular identity that is not a first principal identity associated with the first principal when that particular connection request is attempting to access a protected resource associated with the VPN session.
A machine-implemented method, comprising:
- a workstation processing machine;
- a virtual interface implemented in a machine-accessible and computer-readable medium that processes on the workstation;
- and
- a virtual private network (VPN) client implemented in a machine-accessible and computer-readable medium that processes on the workstation;
- wherein connection requests made on the workstation to a protected resource of an existing VPN session passes through the virtual interface, and wherein the virtual interface forwards the connection requests to the VPN client, the VPN client uses identity-based policy to block any particular connection request that is not associated with a first principal that established the existing VPN session on the workstation.
A machine-implemented system, comprising:
- a desktop client processing machine;
- a socket monitoring service implemented in a machine-accessible and computer-readable medium and to process on the desktop client;
- and
- a secure socket layer (SSL) virtual private network (VPN) client implemented in a machine-accessible and computer-readable medium and to process on the desktop client;
- wherein the desktop client support multiple concurrent users that process applications on the desktop client, and wherein when a first user establishes a VPN session the SSL VPN client is initiated and processed on the desktop client, and wherein when the VPN session is established the socket monitoring service monitors socket calls made by the applications and passes the socket calls to the VPN client, the VPN client establishes user identities for each of the socket calls and just permits particular socket calls that are associated with the first user to access protected resources associated with the VPN session, remaining ones of the socket calls associated with users that are not the first user are blocked by the SSL VPN client.
Dependencies are inferred from the claim text.