Performing source network address translation based on remote device management attributes

Patent metadata

Field	Value
Publication number	US-9894103-B2
Application number	US-201514929399-A
Country	US
Kind code	B2
Filing date	Nov 1, 2015
Priority date	Aug 28, 2015
Publication date	Feb 13, 2018
Grant date	Feb 13, 2018

Abstract

Some embodiments provide novel methods for processing remote-device data messages in a network based on data-message attributes from a remote device management (RDM) system. For instance, the method of some embodiments identifies a set of RDM attributes associated with a data message, and then performs one or more service operations based on identified RDM attribute set.

First claim

The invention claimed is:

1. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:
receiving a data message sent by a remote device;
identifying a set of remote device management (RDM) attributes associated with the received data message;
based on the RDM attribute set, performing a source network address translation (SNAT) operation that (i) identifies a rule that specifies a source network address to be inserted into a header of the received data message and (ii) inserts the source network address in the header of the data message; and
forwarding the data message to a destination of the data message within the network, said inserted source network address in the message header for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

2. The non-transitory machine readable medium of claim 1 , wherein the set of instructions for receiving the data message comprises a set of instructions for receiving the data message sent by the remote device through a tunnel that connects the remote device to the network.

3. The non-transitory machine readable medium of claim 2 , wherein the set of instructions for receiving the data message further comprises sets of instructions for:
receiving the data message at a virtual private network (VPN) gateway; and
intercepting the data message from an egress path of the VPN gateway as the VPN gateway forwards the data message to the message's destination within the network.

4. The non-transitory machine readable medium of claim 3 , wherein the data message is intercepted by a network address translator executing on a device with the VPN gateway.

5. The non-transitory machine readable medium of claim 3 , wherein the data message is intercepted by a network address translator that is a separate electronic device than the VPN gateway.

6. The non-transitory machine readable medium of claim 2 , wherein the remote device supplies at least a subset of the RDM attribute set in a header of the tunnel.

7. The non-transitory machine readable medium of claim 1 , wherein the set of instructions for performing the SNAT operation based on the identified RDM attribute set comprises a set of instructions for searching an RDM rule storage that stores a plurality of rules, each of which has a set of RDM attributes for matching to the RDM attribute set of a data message.

8. The non-transitory machine readable medium of claim 1 , wherein the set of network elements that process the data message according to the inserted source network address perform at least one of a firewall operation, a load balancing operation, a logical network segmentation operation, and a destination network address translation operation on the data message based on the inserted source network address.

9. The non-transitory machine readable medium of claim 1 , wherein the RDM attribute set includes at least one of a device identifier, an user identifier, an application identifier, an application group identifier, a remote device operating system, a remote device location, a remote device compliance status, a remote device jail broken status, and an Internet Protocol version used by the remote device.

10. A non-transitory machine readable medium storing a program for processing mobile-device data messages entering a network, the program comprising sets of instructions for:
receiving a data message sent by a remote device;
identifying a set of remote device management (RDM) attributes associated with the received data message, wherein the set of instructions for identifying the RDM attribute set comprises a set of instructions for receiving at least a subset of the RDM attribute set from an RDM server that is used to authenticate a request from the remote device to establish a VPN session through a tunnel;
based on the RDM attribute set, performing a source network address translation (SNAT) operation that inserts a new source network address in a header of the data message; and
forwarding the data message to a destination of the data message within the network, said inserted source network address in the message header for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

11. The non-transitory machine readable medium of claim 10 , wherein the remote device supplies another subset of the RDM attribute set in a header of the tunnel.

12. The non-transitory machine readable medium of claim 10 , wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset as part of an authentication approval from the RDM server.

13. The non-transitory machine readable medium of claim 10 , wherein the program further comprises a set of instructions for receiving an authentication approval from the RDM server, wherein the set of instructions for receiving the RDM attribute subset comprises a set of instructions for receiving the RDM attribute subset in a communication from the RDM server that is separate from the authentication approval.

14. A method of processing mobile-device data messages entering a network, the method comprising:
receiving a data message sent by a remote device;
identifying a set of remote device management (RDM) attributes associated with the received data message;
based on the RDM attribute set, performing a source network address translation (SNAT) operation that (i) identifies a rule that specifies a source network address to be inserted into a header for the received data message and (ii) inserts the source network address in a header of the data message; and
forwarding the data message to a destination of the data message within the network, said inserted source network address in the message header for allowing a set of network elements of the network to process the data message according to a set of policies of the network.

15. The method of claim 14 , wherein receiving the data message comprises receiving the data message sent by the remote device through a tunnel that connects the remote device to the network.

16. The method of claim 14 , wherein performing the SNAT operation based on the identified RDM attribute set comprises searching an RDM rule storage that stores a plurality of rules, each of which has a set of RDM attributes for matching to the RDM attribute set of a data message.

17. A method of processing mobile-device data messages entering a network, the method comprising:
receiving a data message sent by a remote device;
identifying a set of remote device management (RDM) attributes associated with the received data message;
based on the RDM attribute set, performing a source network address translation (SNAT) operation that inserts a new source network address in a header of the data message; and
forwarding the data message to a destination of the data message within the network, said inserted source network address in the message header for allowing a set of network elements of the network to process the data message according to a set of policies of the network,
wherein receiving the data message comprises receiving the data message sent by the remote device through a tunnel that connects the remote device to the network,
wherein the remote device supplies at least a subset of the RDM attribute set in a header of the tunnel.

18. The method of claim 17 , wherein identifying the RDM attribute set comprise

Assignees

• Nicira Inc

Inventors

• Kwok Leung Tao
• Shah Sulay
• Newell Craig
• Rykowski Adam
• Kommireddy Sridhar
• Singh Utkarsh
• Date Sagar
• Kumar Kausum
• Sengupta Anirban
• Nimmagadda Srinivas
• Jain Jayant
• Masurekar Uday
• Chamarajnagar Ravishankar

Classifications

• H04W12/08

  Access security · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title