# US 7,673,133 B2 · Virtual private network between computing network and remote device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,673,133 B2 - Document ID: US7673133B2 - Status: Granted - Kind: B2 - Application number: 10/794,243 - Filed: 2004-03-05 - Published: 2004-12-16 - Granted: 2010-03-02 - Earliest claimed: 2000-12-20 - Assignees: Intellisync Corporation - Inventors: Darren L. Wesemann - Web page: https://patentgrep.com/patent/US7673133B2 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0272: {Virtual private networks} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A secure connection between a computer network and a remote device is provided by a carrier network between the computer network and the remote device. The secure connection includes data tunnels that operate as virtual private networks between the corporate network and the carrier network and between the remote device and the carrier network. In addition, communication protocols can be used to enable data requests and data transmission over the secure connection, optionally through ports on the computer network that are opened for Web traffic. ## Claims ### Claim 1 A method comprising: establishing a first data tunnel leg between a tunneling client of a computing network and a tunneling server of a carrier network; establishing a second data tunnel leg between the tunneling server of the carrier network and the tunneling client of a remote device; and causing transmission of data between the remote device and the computing network via the first and second data tunnel legs and the carrier network using a first template associated with a first protocol, the first template being used by the tunneling client of the computing network, and a second template associated with the first protocol, the second template being used by the tunneling client of the remote device, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 2 (depends on 1) A method as defined in claim 1, wherein the data transmitted between the remote device and the computing network comprises an access request that includes a protocol identifier that allows a firewall and a proxy on the computing network to recognize the data as web traffic and allow passage thereof into the computing network. ### Claim 3 (depends on 2) A method as defined in claim 2, wherein the first protocol comprises a Post Office Protocol (POP) e-mail protocol used in transferring e-mail commands or data between the computing network and the remote device. ### Claim 4 (depends on 2) A method as defined in claim 2, wherein: the first protocol comprises an Instant Messenger protocol; and each of the first template and the second template comprises four inflection points that correspond to four Instant Messenger tasks, including the tasks of: send a message; receive a message; retrieve a buddy list; and login. ### Claim 5 (depends on 1) A method as defined in claim 1, wherein establishing a first data tunnel leg comprises: causing a first connection signal to be sent from the tunneling client of the computing network to a tunneling server of the carrier network; and causing a connection reply signal to be sent from the tunneling server to the tunneling client on the computing network. ### Claim 6 (depends on 5) A method as defined in claim 5, wherein the first connection signal comprises a uniform resource identifier that represents a request for the carrier network to provide access to network data on the computing network. ### Claim 7 (depends on 1) A method as defined in claim 1, further comprising causing a keep alive signal to be sent from the computing network to the carrier network to maintain the first data tunnel leg. ### Claim 8 (depends on 1) A method as defined in claim 1, wherein the first connection signal is to be transmitted via a port that is established through a firewall on the computing network, wherein the port is otherwise specified for being opened and reserved for Internet traffic. ### Claim 9 (depends on 5) A method as defined in claim 5, wherein the first connection signal further comprises a first identification code which authenticates the computing network. ### Claim 10 (depends on 9) A method as defined in claim 9, further comprising causing a session key to be transmitted from the tunneling client of the remote device, wherein the session key is used to set up an encryption protocol that is to be used for communication between the remote device and the computing network. ### Claim 11 (depends on 9) A method as defined in claim 9, further comprising causing a session key to be transmitted from the tunneling client of the computing network, wherein the session key is used to set up an encryption protocol that is to be used for communication between the remote device and the computing network. ### Claim 12 (depends on 9) A method as defined in claim 9, further comprising causing transmission of identification data, from the remote device to the computing network, that is used by the computing network to authenticate the identity of a user operating the remote device. ### Claim 13 (depends on 5) A method as defined in claim 5, wherein establishing the second data tunnel leg second connection signal further comprises causing a second connection signal to be sent from the tunneling client of the remote device to the tunneling server. ### Claim 14 A method comprising: receiving a first connection signal from a computing network; establishing a first data tunnel leg between a carrier network and the computing network in response to the first connection signal; receiving a second connection signal from a remote device; establishing a second data tunnel leg between the carrier network and the remote device in response to the second connection signal, the first data tunnel leg and the second tunnel leg together operating as a virtual private network; and causing transmission of data between the remote device and the computing network via the first and second data tunnel legs using a first template associated with a first protocol, the first template being used by a tunneling client of the computing network, and a second template associated with the first protocol, the second template being used by a tunneling client of the remote device, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 15 (depends on 14) A method as defined in claim 14, wherein the first protocol comprises a Post Office Protocol (POP) e-mail protocol used in transferring e-mail commands or data between the computing network and the remote device. ### Claim 16 (depends on 14) A method as defined in claim 14, wherein: the first protocol comprises an Instant Messenger protocol; and each of the first template and the second template comprises four inflection points that correspond to four Instant Messenger tasks including the tasks of: send a message; receive a message; retrieve a buddy list; and login. ### Claim 17 (depends on 14) A method as defined in claim 14, wherein the carrier network comprises a tunneling server that includes a user interface service that converts the data into a format that is configured to be visually displayed before sending the data to the remote device. ### Claim 18 (depends on 14) A method as defined in claim 14, wherein establishing the first data tunnel leg further comprises causing a connection reply signal to be sent to the computing network. ### Claim 19 (depends on 14) A method as defined in claim 14, wherein the first connection signal comprises a uniform resource identifier that represents a request for the carrier network to provide access to network data on the computing network. ### Claim 20 (depends on 14) A method as defined in claim 14, further comprising receiving a keep alive signal from the computing network to maintain the first data tunnel leg. ### Claim 21 (depends on 20) A method as defined in claim 20, wherein the first data tunnel leg is maintained substantially continuously and the second data tunnel leg is opened intermittently upon request from the remote device. ### Claim 22 (depends on 14) A method as defined in claim 14, wherein the first connection signal is to be transmitted via a port that is established through a firewall on the computing network, wherein the port is opened and reserved for Internet traffic. ### Claim 23 (depends on 14) A method as defined in claim 14, wherein, upon opening the second data tunnel leg, the first data tunnel leg and the second data tunnel leg comprise a single data tunnel leg wherein the remote device is configured to communicate with the computing network. ### Claim 24 (depends on 14) A method as defined in claim 14, wherein the first connection signal is received by a designated tunneling server on the carrier network, and wherein the designated server is one of multiple tunneling servers of the carrier network. ### Claim 25 (depends on 14) A method as defined in claim 14, further comprising receiving a session key from a device client on the remote device, wherein the session key is used to set up an encryption protocol that is to be used for communication between the remote device and the computing network. ### Claim 26 (depends on 25) A method as defined in claim 25, further comprising causing transmission of identification data, to the computing network from the remote device, that is used by the computing network to authenticate the identity of a user operating the remote device. ### Claim 27 A method comprising: causing transmission of a connection signal from a tunneling client of a device to a tunneling server of a carrier network, wherein a first data tunnel leg has already been established between the tunneling server and a remote computer network; and causing a data request to be transmitted via the second data tunnel leg to the carrier network using a first template that is associated with a first protocol and is used by the tunneling client of the device, upon the establishment of a second data tunnel leg between the device and the carrier network in response to the connection signal; causing receipt of the data request, at the remote computing network, from the carrier network via the first data tunnel leg; and processing the data request, at the remote computing network, using a second template associated with the first protocol, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 28 (depends on 27) A method as defined in claim 27, wherein the first protocol comprises a Post Office Protocol (POP) e-mail protocol used in transferring e-mail commands or data between the remote computing network and the device. ### Claim 29 (depends on 27) A method as defined in claim 27, wherein: the first protocol comprises an Instant Messenger protocol; and each of the first template and the second template comprises four inflection points that correspond to four Instant Messenger tasks, including the tasks of: send a message; receive a message; retrieve a buddy list; and login. ### Claim 30 (depends on 27) A method as defined in claim 27, wherein the connection signal comprises a uniform resource identifier which represents a request for the carrier network to provide to the device access to network data on the remote computing network. ### Claim 31 (depends on 27) A method as defined in claim 27, further comprising causing transmission of a session key from the tunneling client of the device, wherein the session key is used to set up an encryption protocol that is to be used for communication between the device and the remote computing network. ### Claim 32 (depends on 31) A method as defined in claim 31, further comprising causing transmission of identification data, to the remote computing network, that is used by the remote computing network to authenticate the identity of a user operating the device. ### Claim 33 A method comprising: causing transmission of a first connection signal from a tunneling client of a computing network to a carrier network; transmitting a keep alive signal from the computing network to the carrier network to maintain a first data tunnel leg upon the establishment of the first data tunnel leg between the computing network and the carrier network; and causing receipt of a data request from a remote device via the first data tunnel leg and a second data tunnel leg located between the carrier network and the remote device, wherein the data request is caused to be transmitted using a first template associated with a first protocol, the first template being used by the tunneling client of the computing network, and a second template associated with the first protocol, the second template being used by a tunneling client of the remote device, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 34 A computer program product comprising at least one computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising: program code instructions for establishing a first data tunnel leg between a carrier network and a computing network upon receiving a first connection signal from the computing network; program code instructions for establishing a second data tunnel leg between the carrier network and a remote device, the first data tunnel leg and the second data tunnel leg together operating as a virtual private network; and program code instructions for causing transmission of data between the remote device and the computing network via the first and second data tunnel legs using a first template associated with a first protocol, the first template being used by a tunneling client of the computing network, and a second template associated with the first protocol, the second template being used by a tunneling client of the remote device, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 35 (depends on 34) A computer program product as defined in claim 34, wherein the first protocol comprises a Post Office Protocol (POP) e-mail protocol used in transferring e-mail commands or data between the computing network and the remote device. ### Claim 36 (depends on 34) A computer program product as defined in claim 34, wherein: the first protocol comprises an Instant Messenger protocol; and each of the first template and the second template comprises four inflection points that correspond to four Instant Messenger tasks including the tasks of: send a message; receive a message; retrieve a buddy list; and login. ### Claim 37 (depends on 34) A computer program product as defined in claim 34, further comprising program code instructions for maintaining substantially continuously the first data tunnel leg and the second data tunnel leg is opened intermittently upon request from the remote device. ### Claim 38 (depends on 34) A computer program product as defined in claim 34, further comprising program code instructions for causing transmission of the first connection signal via a port that is established through a firewall on the computing network, wherein the port is opened and reserved for Internet traffic. ### Claim 39 A system for enabling a user of a remote device to access network data and software applications stored on a computer network, the system comprising: a first tunneling client on the computer network; a tunneling server on a carrier network, wherein: the first tunneling client and the tunneling server are configured to communicate with each other and maintain a first data tunnel leg therebetween; the tunneling server is configured to, upon receiving a connection signal from the remote device, establish a second data tunnel leg between the carrier network and the remote device which comprises a second tunneling client, the first data tunnel leg and the second data tunnel leg together operating as a virtual private network; and wherein the second tunneling client is configured to cause transmission of data between the remote device and the computing network via the first and second data tunnel legs using a second template associated with a first protocol, the second template being used by the second tunneling client, and a first template associated with the first protocol, the first template being used by the first tunneling client, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 40 (depends on 39) A system as defined in claim 39, wherein the second tunneling client is configured to generate the connection signal. ### Claim 41 (depends on 1) A method as defined in claim 1, wherein the tunneling client of the computing network comprises the first template and the tunneling client of the remote device comprises the second template. ### Claim 42 (depends on 41) A method as defined in claim 41, wherein the first template comprises a protocol code corresponding to the first protocol and the second template comprises a protocol format corresponding to the first protocol but not the protocol code. ### Claim 43 (depends on 33) A method as defined in claim 33, wherein the tunneling client of the computing network comprises the first template and the tunneling client of the remote device comprises the second template. ### Claim 44 (depends on 43) A method as defined in claim 43, wherein the first template comprises a protocol code corresponding to the first protocol and the second template comprises a protocol format corresponding to the first protocol but not the protocol code. ### Claim 45 An apparatus comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to with the at least one processor, cause the apparatus at least to perform at least the following; communicate with a first tunneling client on a computer network and maintain a first data tunnel leg therebetween; establish a second data tunnel leg between the carrier network and the remote device upon receiving a connection signal from a remote device which comprises a second tunneling client, the first data tunnel leg and the second data tunnel leg together operating as a virtual private network; and cause data to be transmitted between the remote device and the computing device via the first and second data tunnel legs using a second template associated with a first protocol, the second template being used by the second tunneling client of the remote device, and a first template associated with the first protocol, the first template being used by the first tunneling client of the computing network, wherein each of the first template and the second template comprises one or more inflection points that correspond to commands or other data aspects that are unique to the first protocol. ### Claim 46 (depends on 45) The apparatus of claim 45, wherein the first tunneling client of the computing network comprises the first template and the second tunneling client of the remote device comprises the second template.