Systems and Methods for Application-Specific Access to Virtual Private Networks

Abstract

Described herein are systems and methods utilizing application-specific access to a virtual private network (“VPN”). A method may comprise receiving, from an application executing on a device, a request for a network data flow to a private network, comparing identification information associated with the application against a set of rules stored on a memory of the device, wherein the set of rules identifies conditions for the application to be authorized to access the private network, and establishing a connection for the network data flow upon the identification information satisfying the conditions for the application to access the private network.

1 . A method, comprising:
 at an electronic device that includes a processor, a memory, and a network interface, wherein the processor, memory, and network interface are configured to implement a network stack that includes a transport layer, a network layer, and lower layers:
 generating, by an application executing on the electronic device, a request for a network data flow to a private network; 
 comparing identification information associated with the application against a set of rules stored on the memory, wherein the set of rules identifies conditions for the application to be authorized to access the private network, wherein the set of rules includes:
 a signing identifier that identifies the application; and 
 a designated requirement that identifies a party that signed the application; and 
 
 upon the identification information satisfying the conditions for the application to access the private network:
 establishing a connection for the network data flow; and 
 transmitting application data from the application to the private network over the connection, wherein the application data includes one or more packets, and wherein, for each of the one or more packets:
 the packet traverses the network stack only a single time before being transmitted by the electronic device to the private network; and 
 the packet, when transmitted by the electronic device to the private network, includes a single Internet Protocol (IP) header and a single transport layer header and does not include a second transport layer header or a second IP header. 
 
 
   
     
     
         2 . The method of  claim 1 , wherein the set of rules further includes an account identification of a user account allowed to access the private network,
 wherein the identification information includes an account tag, and   wherein the identification information satisfies the conditions when the account tag matches the account identification.   
     
     
         3 . The method of  claim 1 , further comprising:
 receiving, by the network stack of the electronic device, a further packet from the private network, the further packet including header information and application data; and   removing from the further packet, during a single traversal of the network stack by the further packet, all header information from the further packet.   
     
     
         4 . The method of  claim 1 , wherein the single transport layer header is a Transmission Control Protocol (TCP) header. 
     
     
         5 . The method of  claim 1 , further comprising:
 opening a flow divert socket for application data to flow between the application to a data transportation component of the electronic device, wherein the data transportation component directs the network data flow directly to the private network.   
     
     
         6 . The method of  claim 5 , wherein the flow divert socket involves a socket filter that places the network flow data in a receive buffer accessible to the application. 
     
     
         7 . The method of  claim 1 , wherein the connection involves a Transmission Control Protocol (TCP) connection object that sets a socket option indicating that the network flow data will be tunneled over the connection. 
     
     
         8 . The method of  claim 3 , further comprising:
 filtering, by a filter of a private network agent, the application data from the further packet.   
     
     
         9 . A device, comprising:
 a memory storing a plurality of rules;   a network interface; and   a processor, wherein the processor, memory, and network interface are configured to implement a network stack that includes a transport layer, a network layer, and lower layers, the processor being further configured to perform actions that include:
 receiving a request for a network data flow to a private network from an application executing on the device; 
 comparing identification information associated with the application against a set of rules stored on the memory, wherein the set of rules identifies conditions for the application to be authorized to access the private network, wherein the set of rules includes:
 a signing identifier that identifies the application; and 
 
 a designated requirement that identifies a party that signed the application; 
 upon the identification information satisfying the conditions for the application to access the private network: 
 establishing a connection for the network data flow; and 
   transmitting application data to the private network over the connection, wherein the application data includes one or more packets, and wherein, for each of the one or more packets:
 the packet traverses the network stack only a single time before being transmitted by the device to the private network; and 
 the packet, when transmitted by the device to the private network, includes a single Internet Protocol (IP) header and a single transport layer header and does not include a second transport layer header or a second IP header. 
   
     
     
         10 . The device of  claim 9 , wherein the set of rules further includes an account identification of a user account allowed to access the private network,
 wherein the identification information includes an account tag, and   wherein the identification information satisfies the conditions when the account tag matches the account identification.   
     
     
         11 . The device of  claim 9 , wherein the actions further comprise:
 receiving, by the network stack of the device, a further packet from the private network, the further packet including header information and application data; and   removing from the further packet, during a single traversal of the network stack by the further packet, all header information from the further packet.   
     
     
         12 . The device of  claim 9 , wherein the transport layer header is a Transmission Control Protocol (TCP) header. 
     
     
         13 . The device of  claim 9 , wherein the processor is further configured to perform:
 opening a flow divert socket for application data to flow between the application to a data transportation component of the device, wherein the data transportation component directs the network data flow directly to the private network, and wherein the flow divert socket includes a socket filter placing the network flow data in a receive buffer accessible to the application.   
     
     
         14 . The device of  claim 9 , wherein the connection is a Transmission Control Protocol (TCP) connection object that sets a socket option indicating that the network flow data will be tunneled over the connection. 
     
     
         15 . A non-transitory computer readable storage medium with an executable program stored thereon that is executable by a processor, the computer readable storage medium, processor and a network interface being configured to implement a network stack that includes a transport layer, a network layer, and lower layers, wherein the program instructs the processor to perform actions that include:
 receiving a request for a network data flow to a private network from an application executing on the device;   comparing identification information associated with the application against a set of rules stored on the memory, wherein the set of rules identifies conditions for the application to be authorized to access the private network, wherein the set of rules includes:
 a signing identifier that identifies the application; and 
   a designated requirement that identifies a party that signed the application;   upon the identification information satisfying the conditions for the application to access the private network:
 establishing a connection for the network data flow; and 
 transmitting application data to the private network over the connection, wherein the application data includes one or more packets, and wherein, for each of the one or more packets: 
 the packet traverses the network stack only a single time before being transmitted to the private network; and 
   the packet, when transmitted to the private network, includes a single Internet Protocol (IP) header and a single transport layer header and does not include a second transport layer header or a second IP header.   
     
     
         16 . The computer readable storage medium of  claim 15 , wherein the set of rules further includes an account identification of a user account allowed to access the private network,
 wherein the identification information includes an account tag, and   wherein the identification information satisfies the conditions when the account tag matches the account identification.   
     
     
         17 . The computer readable storage medium of  claim 15 , wherein the actions further comprise:
 receiving, by the network stack, a further packet from the private network, the further packet including header information and application data; and   removing from the further packet, during a single traversal of the network stack by the further packet, all header information from the further packet.   
     
     
         18 . The computer readable storage medium of  claim 15 , wherein the actions further include:
 opening a flow divert socket for application data to flow between the application to a data transportation component of a device which comprises the computer readable storage medium, wherein the data transportation component directs the network data flow directly to the private network.   
     
     
         19 . The computer readable storage medium of  claim 17 , wherein the actions further include:
 filtering the application data from the further packet.   
     
     
         20 . The computer readable storage medium of  claim 15 , wherein the connection involves a Transmission Control Protocol (TCP) connection object that sets a socket option indicating that the network flow data will be tunneled over the connection.