Secure network communications in a mobile device over IPsec

Patent metadata

Field	Value
Publication number	US-9794225-B2
Application number	US-201514753146-A
Country	US
Kind code	B2
Filing date	Jun 29, 2015
Priority date	Jan 31, 2005
Publication date	Oct 17, 2017
Grant date	Oct 17, 2017

Abstract

Methods and systems of communicating with secure endpoints included within a secured network from a mobile device external to the secured network is disclosed. The method includes initiating a VPN-based secure connection to a VPN appliance, and initializing a stealth-based service on the mobile device. The method further includes transmitting user credential information from the mobile device to a VDR broker via the VPN appliance, and receiving status information from the VDR broker identifying a VDR associated with the mobile device and providing a connected status. The method also includes communicating with one or more secure endpoints within the secured network via a VPN connection to the VDR via the VPN appliance and through the VDR to the one or more secure endpoints within a community of interest based on the user credential information transmitted to the VDR broker.

First claim

The invention claimed is:

1. A method of communicating with secure endpoints included within a secured network from a mobile device external to the secured network, the method comprising:
initiating a virtual private network (VPN) based secure connection to a VPN appliance;
initializing a stealth-based service on the mobile device;
transmitting user credential information from the mobile device to a virtual data relay (VDR) broker via the VPN appliance;
receiving status information from the VDR broker identifying a VDR associated with the mobile device and providing a connected status; and
communicating with one or more secure endpoints within the secured network via a VPN connection to the VDR via the VPN appliance and through the VDR to the one or more secure endpoints within a community of interest based on user credential information transmitted to the VDR broker.

2. The method of claim 1 , wherein the community of interest includes a user of the mobile device and the one or more secure endpoints but excludes one or more second endpoints within the secured network, wherein the one or more second endpoints are obscured to the user of the mobile device while the mobile device has the connected status.

3. The method of claim 1 , wherein the mobile device includes a mobile security application installed thereon.

4. The method of claim 1 , wherein the mobile device includes a first application and a second application installed thereon, and wherein the user credential information is collected by the first application.

5. The method of claim 4 , wherein communicating with one or more secure endpoints comprises initiating communication from the first application, wherein the second application is excluded from the community of interest and lacks access to the one or more secure endpoints.

6. The method of claim 4 , further comprising:
transmitting second user credential information from the second application on the mobile device to the VDR broker;
receiving status information from the VDR broker identifying a second VDR associated with the mobile device and providing the connected status; and
communicating with one or more second secure endpoints within the secured network via a VPN connection to the second VDR via the VPN appliance and through the second VDR to the one or more second secure endpoints within a second community of interest based on the second user credential information.

7. The method of claim 1 , further comprising transmitting a tunnel close command to the VDR broker via the VPN appliance.

8. The method of claim 7 , wherein transmission of the tunnel close command causes the VPN appliance to close a VPN tunnel and causes the VDR broker to shut down the VDR associated with the mobile device.

9. A system for enabling communication between a mobile device and one or more secure endpoints included within a secured network, the system comprising:
a mobile gateway communicatively connectable to the mobile device via a tunneled connection, configured to manage a plurality of a virtual data recorder (VDR) connectivity states for each VDR connection, the plurality of VDR connectivity states including:
an inactive state;
a request VDR state;
an assigned VDR state;
a provisioning request state; and
a community of interest (COI) active state;
the mobile gateway including:
a processor operating as a VDR broker and configured to allocate VDRs to mobile devices based on authentication credentials received from the mobile devices and obtain key information to provide to the allocated VDRs for use in secure communications within the secured network;
one or more VDRs associated with the mobile device and providing proxied secure communications using the key information obtained from an authentication server based on the authentication credentials provided by the mobile device.

10. The system of claim 9 , further comprising the mobile device, wherein the mobile device includes a Stealth connectivity application installed thereon.

11. The system of claim 10 , further comprising a VPN appliance connected between the mobile device and the mobile gateway.

12. The system of claim 9 , further comprising the authentication server, wherein the authentication server is within the secured network communicatively connected to the mobile gateway.

13. The system of claim 9 , further comprising a licensing VDR at the mobile gateway configured to maintain a licensing tunnel to a licensing server within the secured network, wherein, upon failure of the licensing tunnel, each of the VDRs allocated at the mobile gateway are interrupted.

14. The system of claim 9 , wherein the key information is associated with a community of interest of which the mobile device is a member based on the received authentication credentials.

Assignees

• Johnson Robert A
• Trocki James
• Vallevand Mark K
• Rajcan Steven L
• Hinaman Ted
• Unisys Corp

Inventors

• Johnson Robert A
• Trocki James
• Vallevand Mark K
• Rajcan Steven L
• Hinaman Ted

Classifications

• H04W88/16

  Gateway arrangements · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/104

  Grouping of entities · CPC title