Virtual relay device for providing a secure connection to a remote device

Patent metadata

Field	Value
Publication number	US-11030305-B2
Application number	US-201213664505-A
Country	US
Kind code	B2
Filing date	Oct 31, 2012
Priority date	Oct 4, 2010
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

Virtual machines in a network may be isolated by encrypting transmissions between the virtual machines with keys possessed only by an intended recipient. Within a network, the virtual machines may be logically organized into a number of community-of-interest (COI) groups. Each COI may use an encryption key to secure communications within the COI, such that only other virtual machines in the COI may decrypt the message. Remote devices may gain access to virtual machines in a network through a virtual device relay. The virtual device relay receives data from the remote device, such as a tablet or cellular phone, and forwards the data to one of the virtual machines, when the virtual device relay shares a COI with the destination virtual machine.

First claim

What is claimed is:

1. A method of providing a remote device access to a shared network, comprising:
receiving, at a router, an incoming connection request to open an IPsec tunnel to the shared network from the remote device belonging to a community of interest having a unique key;
initiating a virtual device host, wherein the virtual device host executes a virtual device relay for the remote device;
hosting the router and the virtual device relay on a server;
routing, to the virtual device host, data received from the incoming connection;
receiving, at the virtual device relay, data from the remote device, the data being encrypted with the unique key; and
forwarding the data to a second host on the shared network having the same community of interest by the virtual device relay, such that the second host can use the unique key to decrypt the data;
wherein the remote device and the second host can securely communicate through the virtual device relay by use of the unique key.

2. The method of claim 1 , further comprising:
receiving authentication information from the remote device; and
assigning the community-of-interest to the virtual device relay based on the authentication information.

3. The method of claim 2 , further comprising assigning a second community-of-interest to the virtual device relay based on the authentication information.

4. The method of claim 1 , in which the remote device is a mobile device.

5. A computer program product comprising:
a non-transitory computer-readable medium comprising:
code to receive at a router an incoming connection request to open an IPsec tunnel to a shared network from a remote device belonging to a community of interest having a unique key;
code to initiate a virtual device host, wherein the virtual device host executes a virtual device relay for the remote device;
code to host the router and the virtual device relay in a virtualized environment;
code to route, to the virtual device host, data received from the incoming connection;
code to receive, at the virtual device relay, data from a remote device, the data being encrypted with the unique key; and
code to forward the data to a second host on the shared network having the same community of interest by the virtual device relay, such that the second host can use the unique key to decrypt the data;
wherein the remote device and the second host can securely communicate through the virtual relay by use of the unique key.

6. The computer program product of claim 5 , in which the medium comprises:
code to receive authentication information from the remote device; and
code to assign the community-of-interest to the virtual device relay based on the authentication information.

7. The computer program product of claim 6 , in which the medium comprises code to assign a second community-of-interest to the virtual device relay based on the authentication information.

8. An apparatus, comprising:
a memory; and
a processor coupled to the memory, in which the processor is configured:
to receive at a router an incoming connection request to open an IPsec tunnel to a shared network from a remote device belonging to a community of interest having a unique key;
to initiate a first, virtual device host, wherein the first, virtual device host is configured to executes a plurality of virtual device relays for the remote device, each of the virtual device relays being assigned to one or more communities-of-interest of a plurality of communities-of-interest;
to host the router and the virtual device relay in a virtualized environment;
to route to the virtual device host, data received from the incoming connection
to receive, at the virtual device relay, data from the remote device, the data being encrypted with the unique key; and
to forward the data to a second host on the shared network having the same community of interest by the virtual device relay, such that the second host can use the unique key to decrypt the data,
wherein the remote device and the second host can securely communicate through the virtual device relay by use of the unique key.

9. The apparatus of claim 8 , in which the processor is further configured:
to receive authentication information from the remote device; and
to assign the community-of-interest to the virtual device relay based on the authentication information.

10. The apparatus of claim 9 , in which the processor is further configured to assign a second community-of-interest to the virtual device relay based on the authentication information.

11. The apparatus of claim 8 , in which the remote device is a mobile device.

Assignees

• Unisys Corp

Inventors

• Farina Ralph
• Hinaman Ted
• Johnson Robert A
• Rajcan Steven
• Trocki James
• Vallevand Mark

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title