Communicating data between client devices using a hybrid connection having a regular communications pathway and a highly confidential communications pathway

Patent metadata

Field	Value
Publication number	US-9646163-B2
Application number	US-201414541419-A
Country	US
Kind code	B2
Filing date	Nov 14, 2014
Priority date	Nov 14, 2014
Publication date	May 9, 2017
Grant date	May 9, 2017

Abstract

A technique communicates data between a first client device and a second client device. The technique involves establishing a regular communications pathway from the first client device to the second client device through a communications server, and establishing a highly confidential communications pathway from the first client device to the second client device. The highly confidential communications pathway circumvents the communications server. The technique further involves, after the regular communications pathway and the highly confidential communications pathway are established, conveying highly sensitive information from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway.

First claim

What is claimed is:

1. A method of communicating data between a first client device and a second client device, the method comprising:
establishing a regular communications pathway from the first client device to the second client device through a communications server;
establishing a highly confidential communications pathway from the first client device to the second client device, the highly confidential communications pathway circumventing the communications server;
after the regular communications pathway and the highly confidential communications pathway are established, conveying highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway to avoid exposing the highly sensitive data to the communications server through the regular communications pathway; and
performing a load balancing operation which load balances traffic which is exchanged between the first client device and the second client device, the traffic being load balanced among the regular communications pathway and the highly confidential communications pathway.

2. The method as in claim 1 wherein conveying the highly sensitive data from the first client device to the second client device includes:
receiving, by control circuitry of the first client device, data items for transmission to the second client device;
assigning, by the control circuitry of the first client device, a classification to each data item of the data items; and
sending, by the control circuitry of the first client device, the data items to the second client device through one of (i) the regular communications pathway and (ii) the highly confidential communications pathway based on the classification assigned to each data item of the data items.

3. The method as in claim 2 wherein assigning the classification to each data item of the data items includes:
applying a set of classification rules to the data items to assign a “regular” classification value to regular security data items and a “highly confidential” classification value to highly confidential data items, the “regular” classification value being different than the “highly confidential” classification value, and each data item being assigned at most one of the “regular” classification value and the “highly confidential” classification value.

4. The method as in claim 3 wherein sending the data items includes:
applying a set of pathway policies to each data item of the data items to send all data items which were assigned the “highly confidential” classification value exclusively through the highly confidential communications pathway.

5. The method as in claim 4 , further comprising:
transmitting all data items which were assigned the “regular” classification value exclusively through the regular communications pathway.

6. The method as in claim 4 , further comprising:
transmitting at least one of the data items which were assigned the “regular” classification value through the highly confidential communications pathway.

7. The method as in claim 1 wherein the first client device and the second client device form a portion of a private enterprise network;
wherein the communications server does not form any portion of the private enterprise network; and
wherein establishing the regular communications pathway from the first client device to the second client device through the communications server includes creating (i) a first datapath between the first client device and the communications server and (ii) a second datapath between the second client device and the communications server to form the regular communications pathway from a set of server-based datapaths.

8. The method as in claim 7 wherein establishing the highly confidential communications pathway from the first client device to the second client device includes:
creating an endpoint-to-endpoint datapath between the first client device and the second client device to form the highly confidential communications pathway.

9. The method as in claim 8 wherein the communications server resides in a third-party datacenter;
wherein the first client device and the second client device exchange the highly sensitive data only through the endpoint-to-endpoint datapath to avoid sharing the highly sensitive data with the third-party datacenter; and
wherein creating the endpoint-to-endpoint datapath between the first client device and the second client device includes providing the highly confidential communications pathway in response to initial communications exchanged between the first client device and the second client device through the set of server-based datapaths, the regular communications pathway formed from the set of server-based datapaths carrying regular data which is different than the highly sensitive data.

10. The method as in claim 1 , further comprising:
while monitoring availability of the highly confidential communications pathway, detecting existence of a break in the highly confidential communications pathway; and
in response to detecting the existence of the break in the highly confidential communications pathway, preventing conveyance of additional highly sensitive data from the first client device to the second client device.

11. The method as in claim 10 , further comprising:
while monitoring availability of the highly confidential communications pathway, detecting re-establishment of the highly confidential communications pathway; and
after the highly confidential communications pathway has been re-established, conveying the additional highly sensitive data from the first client device to the second client device only through the highly confidential communications pathway.

12. The method as in claim 10 , further comprising:
in response to detecting existence of the break in the highly confidential communications pathway, outputting an alert to a user of the first client device to indicate that the first client device is unable to send further highly sensitive data to the second client device.

13. The method as in claim 1 , further comprising
after the regular data is exchanged between the first client device to the second client device through the regular communications pathway, conveying further regular data between the first client device and the second client device through the highly confidential communications pathway.

14. The method as in claim 13 wherein conveying further regular data includes:
while monitoring availability of the regular communications pathway, detecting existence of a break in the regular communications pathway; and
in response to detecting existence of the break in the regular communications pathway, conveying the further regular data between the first client device and the second client device through the highly confidential communications pathway.

15. A computer program product having a non-transitory computer readable medium which stores a set of instructions to communicate data between a first client device and a second client device, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:
establishing a regular communications pathway from the first client device to the second client device through a communications server;
establishing a highly confidential communications pathway from the first client device to the second client device, the highly confidential communications pathway circumventing the communications server;
after the regular communications pathway and the highly confidential communications pathway are establis

Assignees

• Citrix Systems Inc
• Getgo Inc

Inventors

• Nickolov Alexander

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title