# US 9,521,117 B2 · Providing virtualized private network tunnels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,117 B2 - Document ID: US9521117B2 - Status: Granted - Kind: B2 - Application number: 14/535,597 - Filed: 2014-11-07 - Published: 2015-03-05 - Granted: 2016-12-13 - Earliest claimed: 2012-10-15 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Gary Barton; Zhongmin Lang; Nitin Desai; James Robert Walker - Web page: https://patentgrep.com/patent/US9521117B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/30: Security of mobile devices; Security of mobile applications - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F 21/31: User authentication - G06F 2221/2105: Dual mode as a secondary aspect - H04L 63/0815: {providing single-sign-on or federations} - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various aspects of the disclosure relate to providing a per-application policy-controlled virtual private network (VPN) tunnel. In some embodiments, tickets may be used to provide access to an enterprise resource without separate authentication of the application and, in some instances, can be used in such a manner as to provide a seamless experience to the user when reestablishing a per-application policy controlled VPN tunnel during the lifetime of the ticket. Additional aspects relate to an access gateway providing updated policy information and tickets to a mobile device. Other aspects relate to selectively wiping the tickets from a secure container of the mobile device. Yet further aspects relate to operating applications in multiple modes, such as a managed mode and an unmanaged mode, and providing authentication-related services based on one or more of the above aspects. ## Claims ### Claim 1 A method, comprising: transmitting, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway; receiving, by the access gateway, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration; providing access to the at least one resource via the per-application policy-controlled VPN tunnel; receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time. ### Claim 2 (depends on 1) The method of claim 1, further comprising: performing an initial authentication with the mobile device and transmitting the ticket to the mobile device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: performing an update to the policy information, resulting in updated policy information; determining to transmit the updated policy information to the mobile device; and transmitting, by the access gateway, the updated policy information to the mobile device. ### Claim 4 (depends on 3) The method of claim 3, wherein performing the update to the policy information is based on a listing of applications that are installed on the mobile device. ### Claim 5 (depends on 3) The method of claim 3, wherein performing the update to the policy information is based on a listing of tickets that are issued and currently valid for the mobile device. ### Claim 6 (depends on 3) The method of claim 3, wherein determining to transmit the updated policy information is based on receiving a request for policy information from the mobile device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: transmitting, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device. ### Claim 8 (depends on 1) The method of claim 1, further comprising: transmitting, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel. ### Claim 9 (depends on 8) The method of claim 8, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket. ### Claim 10 An apparatus, comprising: at least one processor; and memory storing executable instructions configured to, when executed by the at least one processor, cause the apparatus to: transmit, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through the apparatus; receive, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration; provide access to the at least one resource via the per-application policy-controlled VPN tunnel; receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a first time; close the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a second time. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to: perform an update to the policy information, resulting in updated policy information; determine to transmit the updated policy information to the mobile device; and transmit the updated policy information to the mobile device. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein causing the apparatus to determine to transmit the updated policy information is based on receipt of a request for policy information from the mobile device. ### Claim 13 (depends on 10) The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to: transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the executable instructions are configured to, when executed by the at least one processor, cause the apparatus to: transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket. ### Claim 16 One or more non-transitory computer-readable media storing instructions configured to, when executed, cause a computing device to: transmit, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through the computing device; receive, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration; provide access to the at least one resource via the per-application policy-controlled VPN tunnel; receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a first time; close the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, receive, during the validity duration, the ticket to cause the per-application policy-controlled VPN tunnel to be re-established a second time. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to: perform an update to the policy information, resulting in updated policy information; determine to transmit the updated policy information to the mobile device; and transmit the updated policy information to the mobile device. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to: transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data associated with the application stored at the mobile device. ### Claim 19 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the instructions are configured to, when executed, cause the computing device to: transmit, to the mobile device, a selective wipe command instructing the mobile device to perform a selective wipe of data stored by the mobile device for providing the per-application policy-controlled VPN tunnel. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable media of claim 19, wherein the data stored by the mobile device for providing the per-application policy-controlled VPN tunnel comprises the ticket.