VPN session migration across clients

A method comprising:

• establishing, by a first client computing device, a first secure session with a secure access appliance using first secure session data;
• receiving, by the first client computing device directly via a communication channel that is not mediated by the secure access appliance, a request from a second client computing device for second secure session data that is different than the first secure session data and usable by the second client computing device to establish a second secure session with the secure access appliance;
• receiving, by the first client computing device and from the secure access appliance, data that indicates whether the first client computing device is allowed to send the secure session data to the second client computing device;
• generating, by the first client computing device, a message including the second secure session data for the second secure session;
• and
• sending, by the first client computing device and without mediation of the secure access appliance, and based on the data that indicates whether the first client computing device is allowed to send the secure session data, the message directly to the second client computing device only when the first client computing device is allowed to send the secure session data to the second client computing device.

A client computing device comprising:

• a session migration module that establishes a first secure session with the secure access appliance;
• one or more network interfaces that receive, directly via a communication channel that is not mediated by the secure access appliance, a request from a second client computing device for secure session data for the first secure session usable by the second client computing device to establish a second secure session with the secure access appliance;
• wherein the secure migration module receives, from the secure access appliance, data that indicates whether the first client computing device is allowed to send the secure session data to the second client computing device;
• wherein the session migration module generates a message including the secure session data for the first secure session;
• and
• wherein the one or more network interfaces send, without mediation of the secure access appliance, and based on the data that indicates whether the first client computing device is allowed to send the secure session data, the message directly to the second client computing device only when the first client computing device is allowed to send the secure session data to the second client computing device.

A secure access appliance comprising:

• a control unit having one or more processors that:
• establishes a first secure session with a first client computing device, responsive to receiving a first request from the first client computing device;
• sends, to the first client computing device, data that indicates whether the first client computing device is allowed to send the secure session data to the second client computing device;
• establishes a second secure session with a second client computing device, responsive to receiving a second request from the second client computing device, wherein establishing the second secure session is subsequent to:
• the first client receiving, directly via a communication channel that is not mediated by the secure access appliance, a third request from the second client computing device for secure session data for the first secure session that is usable by the second client computing device to establish the second secure session with the secure access appliance, and
• the first client computing device sending, without mediation of the secure access appliance, and based on the data that indicates whether the first client computing device is allowed to send the secure session data, a message including the secure session data for the first secure session directly to the second client computing device only when the first client computing device is allowed to send the secure session data to the second client computing device.

A system comprising:

• a first client computing device comprising a control unit having one or more processors;
• a second client computing device;
• a communication channel between the first client computing device and the second client computing device;
• a secure access appliance;
• wherein the first client computing device comprises a session migration module operable by the control unit having one or more processors to establish a secure session with the secure access appliance;
• wherein the first client computing device comprises one or more network interfaces configured to receive a request, directly via the communication channel that is not mediated by the secure access appliance, from the second client computing device for secure session data usable by the second client computing device to establish the secure session with the secure access appliance;
• wherein the one or more network interfaces receive, from the secure access appliance, data that indicates whether the first client computing device is allowed to send the secure session data to the second client computing device;
• wherein the session migration module is operable by the control unit to generates a message that includes the secure session data;
• wherein the one or more network interfaces are configured to directly send, without mediation of the secure access appliance, and based on the data that indicates whether the first client computing device is allowed to send the secure session data, the secure session data to the second client computing device only when the first client computing device is allowed to send the secure session data to the second client computing device;
• and
• wherein the second client computing device, responsive to receiving the message, establishes the secure session with the secure access appliance.