Method and system for VPN isolation using network namespaces

Patent metadata

Field	Value
Publication number	US-9769120-B2
Application number	US-201614994383-A
Country	US
Kind code	B2
Filing date	Jan 13, 2016
Priority date	Nov 22, 2011
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

One embodiment of the present invention provides a system for providing exclusive access to a virtual private network (VPN) connection to an authorized application. During operation, the system creates a unique network namespace that is different from a default network namespace of a host system. The system then places a pseudo network interface associated with the VPN connection into the unique network namespace. Furthermore, the system places at least one socket for an authorized application into the unique network namespace. The system also precludes unauthorized applications on the host from accessing the unique network namespace, thereby facilitating exclusive access to the VPN connection by the authorized application.

First claim

What is claimed is:

1. A computer executable method for providing access to a virtual private network (VPN) connection to an authorized application, comprising:
creating a unique network namespace of a host system that contains a network resource for the authorized application;
placing a pseudo tunnel interface associated with the VPN connection into the unique network namespace by moving the pseudo tunnel interface from a default network namespace into the unique network namespace, wherein a routing table corresponding to the pseudo tunnel interface is inaccessible from the default network namespace; and
precluding unauthorized applications on the host system from accessing the unique network namespace, thereby facilitating the access to the VPN connection by the authorized application.

2. The method of claim 1 , further comprising placing a communication object for the authorized application into the unique network namespace.

3. The method of claim 2 , wherein the communication object includes at least one socket for the authorized application.

4. The method of claim 1 , wherein precluding the unauthorized applications on the host system from accessing the unique network namespace includes precluding all unauthorized applications on the host system from accessing the unique network namespace.

5. The method of claim 1 , wherein the unique network namespace is different from a default network namespace of the host system.

6. The method of claim 1 , wherein the authorized application is a virtual machine.

7. The method of claim 6 , further comprising:
intercepting a socket-creation request from an application on the virtual machine; and
creating a socket on the host system on behalf of the virtual machine.

8. The method of claim 1 , further comprising establishing the VPN connection by a VPN client which resides in the default network namespace of the host system.

9. The method of claim 1 , further comprising receiving a set of network parameters by a VPN client and passing the network parameters to a connectivity service on the host system.

10. The method of claim 1 , further comprising applying a set of network parameters received via the VPN connection to the pseudo tunnel interface.

11. The method of claim 1 , wherein the host system comprises a mobile device.

12. A computer readable non-transitory storage medium storing instructions which when executed by a computer cause the computer to perform a method, the method comprising:
creating a unique network namespace of a host system on the computer that contains a network resource for an authorized application;
placing a pseudo tunnel interface associated with a VPN connection into the unique network namespace by moving the pseudo tunnel interface from a default network namespace into the unique network namespace, wherein a routing table corresponding to the pseudo tunnel interface is not visible within the default network namespace; and
precluding unauthorized applications on the host system from accessing the unique network namespace, thereby facilitating access to the VPN connection by the authorized application.

13. The computer readable non-transitory storage medium of claim 12 , wherein the method further comprises placing a communication object for the authorized application into the unique network namespace.

14. The computer readable non-transitory storage medium of claim 12 , wherein a routing table corresponding to the pseudo tunnel interface is inaccessible from an application placed in the default network namespace.

15. A computing system for providing access to a virtual private network (VPN) connection to an authorized application, comprising:
a network namespace creation mechanism configured to create a unique network namespace of a host system that contains a network resource for the authorized application, wherein the network resource comprises a pseudo tunnel interface associated with the VPN connection that is placed into the unique network namespace by moving the pseudo tunnel interface from a default network namespace of the host system into the unique network namespace and a routing table corresponding to the pseudo tunnel interface is inaccessible from the default network namespace;
wherein unauthorized applications on the host system are precluded from accessing the unique network namespace, thereby facilitating the access to the VPN connection by the authorized application.

16. The computing system of claim 15 , further comprising a connectivity service configured to place the pseudo tunnel interface into the unique network namespace.

17. The computing system of claim 15 , further comprising a socket management mechanism configured to place a communication object for the authorized application into the unique network namespace.

Assignees

• Vmware Inc

Inventors

• Fainkichen Alexander
• Newell Craig

Classifications

• H04N21/4437 Primary

  Implementing a Virtual Machine [VM] (virtual machines in general G06F9/45533) · CPC title

• H04N21/443

  OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB · CPC title

• G06F9/46

  Multiprogramming arrangements · CPC title

• G06F9/45529

  Embedded in an application, e.g. JavaScript in a Web browser · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title