Secure Remote Access Public Communication Environment

Abstract

A method and system provide a user device with secure access to an enterprise application in an enterprise network through VPN. The enterprise application is accessed from a user device such that it sends and receives data packets through the VPN client. For this, a request to send packets, originating from the user application, is intercepted by a VPN agent associated with the user application. In turn, the VPN agent associates an address of a loop-back interface with the user application. Thereafter, packets sent by the user application, are re-directed to the VPN client through the loop-back interface. Similarly, packets received by the VPN client from the enterprise network are routed through the loop-back interface to the user application.

1 - 20 . (canceled) 
     
     
         21 . A processor-readable non-transitory medium carrying instructions for execution by at least one processor of a communication device, the instructions comprising:
 a Virtual Private Network (VPN) client comprising instructions executable by the at least one processor to implement a VPN tunnel to securely transmit traffic from the communication device to an external application on a communication network coupled to the communication device; and   a VPN agent comprising:   instructions executable by the at least one processor to intercept a request to an operating system service of the communication device for establishing a VPN connection from a user application executing on the communication device to the external application, the VPN agent being associated with the user application; and   instructions executable by the at least one processor to establish, based on the intercepted request, a communication channel within the communication device, the communication channel being configured to handle only traffic associated with the user application and extending between the VPN agent associated with the user application and the VPN client.   
     
     
         22 . The medium of  claim 21 , wherein the request to the operating system service for establishing the VPN connection comprises a call to an application program interface (API) for establishing a VPN connection. 
     
     
         23 . The medium of  claim 21 , wherein the VPN agent comprises instructions executable by the at least one processor to establish a loopback interface between the VPN client and the VPN agent. 
     
     
         24 . The medium of  claim 23 , wherein the instructions executable to establish the loopback interface comprise instructions executable by the at least one processor to change a destination address in the intercepted request to an address associated with the loopback interface. 
     
     
         25 . The medium of  claim 24 , wherein the VPN agent further comprises instructions executable by the at least one processor to change a destination address of a data packet received from the user application to the address associated with the loopback interface, and to forward the data packet from the VPN agent to the VPN client. 
     
     
         26 . The medium of  claim 25 , wherein the VPN client comprises instructions executable by the at least one processor to map the address associated with the loopback interface to an address associated with the VPN tunnel. 
     
     
         27 . The medium of  claim 26 , wherein the VPN client comprises instructions executable by the at least one processor to use a Transport Control Protocol/Internet Protocol (TCP/IP) stack to prepare the data packet for transmission on the VPN tunnel in accordance with the mapping. 
     
     
         28 . The medium of  claim 23 , wherein the VPN agent comprises instructions executable by the at least one processor to request that the VPN client listen at the loopback interface. 
     
     
         29 . The medium of  claim 21 , wherein the instructions are configured to cause the VPN client to associate the VPN agent only with the user application, and cause the VPN client to not associate the VPN client with any other application running on the communication device. 
     
     
         30 . The medium of  claim 21 , wherein the instructions executable to intercept the request for establishing the VPN connection from the user application to the external application comprise instructions executable by the at least one processor to hook an application program interface (API) call from the user application requesting creation of a VPN connection for the user application. 
     
     
         31 . The medium of  claim 21 , wherein:
 the request to the operating system for establishing the VPN connection comprises a call to an application program interface (API) for establishing a VPN connection; and   the instructions executable to establish a communication channel based on the intercepted request comprise instructions executable to establish a loopback interface between the VPN client and the VPN agent, the loopback interface being implemented as a virtual interface that enables the user application to send or receive data packets from the VPN client addressed to an IP address of the virtual interface rather than an IP address of a physical interface.   
     
     
         32 . The medium of  claim 21 , wherein the medium comprises an interface configured for coupling the medium to the communication device to enable the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         33 . The medium of  claim 32 , wherein the medium carries downloadable instructions comprising the user application. 
     
     
         34 . The medium of  claim 21 , wherein the medium is communicatively coupled to a web portal accessible by the communication device to enable the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         35 . The medium of  claim 34 , wherein the medium carries downloadable instructions comprising the user application. 
     
     
         36 . The medium of  claim 34 , wherein the medium carries instructions executable to authenticate a user of the communication device before permitting the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         37 . A processor-readable non-transitory medium carrying instructions for execution by at least one processor of a communication device, the instructions comprising:
 a Virtual Private Network (VPN) client comprising instructions executable by the at least one processor to implement a VPN tunnel to securely transmit traffic between the communication device and an external application on a communication network coupled to the communication device; and   a VPN agent comprising:   instructions executable by the at least one processor to intercept a request from a user application to an operating system service of the communication device to enable listening for requests by other applications to connect with the user application;   instructions executable by the at least one processor to request that the VPN client forward to the VPN agent requests for VPN connections to the user application received by the VPN client from an external application; and   instructions executable by the at least one processor to establish, based on a forwarded VPN connection request, a communication channel within the communication device, the communication channel being configured to handle only traffic associated with the user application and extending between the VPN agent associated with the user application and the VPN client.   
     
     
         38 . The medium of  claim 37 , wherein the request to the operating system service to enable listening for requests by other applications to connect with the user application comprises a call to an application program interface (API) for establishing a VPN connection. 
     
     
         39 . The medium of  claim 37 , wherein the VPN agent comprises instructions executable by the at least one processor to establish a loopback interface between the VPN client and the VPN agent. 
     
     
         40 . The medium of  claim 37 , wherein the instructions are configured to cause the VPN client to associate the VPN agent only with the user application, and cause the VPN client to not associate the VPN client with any other application running on the communication device. 
     
     
         41 . The medium of  claim 37 , wherein the medium comprises an interface configured for coupling the medium to the communication device to enable the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         42 . The medium of  claim 41 , wherein the medium carries downloadable instructions comprising the user application. 
     
     
         43 . The medium of  claim 37 , wherein the medium is communicatively coupled to a web portal accessible by the communication device to enable the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         44 . The medium of  claim 43 , wherein the medium carries downloadable instructions comprising the user application. 
     
     
         45 . The medium of  claim 43 , wherein the medium carries instructions executable to authenticate a user of the communication device before permitting the communication device to download the VPN client and the VPN agent from the medium. 
     
     
         46 . A processor-readable non-transitory medium carrying instructions for execution by at least one processor of a communication device, the instructions being executable to provide an operating system service that provides to the communication device an application program interface (API) configured to establish a virtual private network (VPN) connection. 
     
     
         47 . The medium of  claim 46 , wherein the API is configured as a VPN agent. 
     
     
         48 . The medium of  claim 46 , wherein the API comprises:
 instructions executable by the at least one processor to intercept a request to an operating system service of the communication device for establishing a VPN connection from a user application executing on the communication device to the external application, the VPN agent being associated with the user application; and   instructions executable by the at least one processor to establish, based on the intercepted request, a communication channel within the communication device, the communication channel being configured to handle only traffic associated with the user application and extending between the VPN agent associated with the user application and the VPN client.   
     
     
         49 . The medium of  claim 46 , wherein the API comprises instructions executable by the at least one processor to establish a loopback interface between the VPN client and the VPN agent. 
     
     
         50 . The medium of  claim 49 , wherein the instructions executable to establish the loopback interface comprise instructions executable by the at least one processor to change a destination address in the intercepted request to an address associated with the loopback interface.