Patent Publication Number: US-8543696-B1

Title: Network access

Description:
FIELD OF THE INVENTION 
     The present invention concerns the provision of controlled access to a web page or other networked resources. Embodiments of the invention find particular, but not exclusive use, in the area known as remote desktop access. This is related to the growing phenomenon of staff using computing devices including portable computing device(s) for work-related activities via remote desktop access. 
     BACKGROUND 
     It is now relatively common for employees to work on their employer&#39;s business using their own devices. Such devices can include portable devices such as laptop computers, netbook computers, tablet computers (such as the Apple® iPad®) and smartphones. However, although use of such devices can be convenient to both the employee and the employer, their use can create security vulnerabilities, since the employer is not in ultimate control of the devices and is unable to fully implement security and/or access policies. 
     Corporations often use applications to allow access to business critical data. Users can access these applications running directly or via Virtual Desktop Infrastructure (VDI) or Remote Desktop Services (RDS) sessions, henceforth referred to as a virtual desktop, from almost any device anywhere, provided a suitable network connection is available. This may present a problem to corporations in terms of control and security of their business information when users use virtual desktops from portable devices, since the data may be more susceptible to being compromised by technological means e.g. packet sniffing. Also, simple visual interception (known as shoulder surfing) can be a problem, whereby sensitive data can simply be observed by third parties on the screen of the user&#39;s device. 
     It is an aim of embodiments of the present invention to permit the application of an access policy, which takes into account a number of different conditions to allow, block or redirect access to certain resources or web pages on the basis of the evaluation of these conditions. 
     SUMMARY 
     According to the present invention there is provided an apparatus and method as set forth in the appended claims. Other features of the invention will be apparent from the dependent claims, and the description which follows. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       For a better understanding of the invention, and to show how embodiments of the same may be carried into effect, reference will now be made, by way of example, to the accompanying diagrammatic drawings in which: 
         FIG. 1  shows a user connecting from a secure and/or insecure environment with an access policy being implemented according to an embodiment of the present invention; 
         FIG. 2  shows a method for administering an access policy according to an embodiment of the present invention; 
         FIG. 3  shows a method for administering an access policy according to another embodiment of the present invention; 
         FIG. 4  shows a User Interface (UI) for administering an access policy according to an embodiment of the present invention; and 
         FIG. 5  shows a computer system configured to perform embodiments of the present invention. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  shows a user connecting from a secure environment  10  using a first protocol  15  and a user connecting from an insecure environment  20  using a second protocol  25  to a data center  50  whereon virtual desktop sessions reside. The user connects to a virtual desktop session  55  via a first server  30 , assigned to connections from a secure environment  10 , or a second server  40 , assigned to connections from an insecure environment  20 . The first server has an Internet Protocol (IP) address of IP_A and the second server has an IP address of IP_B. 
     The user&#39;s virtual desktop session  55  has first open outbound connection/port to a protected resource or web page  70 ,  90  on a networked resource intended for the secure environment  100  and/or second open outbound connection/port to a resource or web page  60 ,  80  on a networked resource intended for the insecure environment  200 . The resource may be a storage device or any other type of medium for storing or supplying data. The resource or the web page  70 ,  90  may include business critical data or any other sensitive information. 
     Although in  FIG. 1  the networked resources are connected to the virtual desktop session  55  via a network connection, it is understood that the networked resources  100 ,  200  may reside inside the data center or the server whereon an instance of the user&#39;s virtual desktop session  55  is running. 
     The user is in possession of a device for accessing a remote network. The device may be any form of computing device. In the following description, attention will be focussed on a portable computing device such as a laptop computer or tablet computer, but this is not intended to be limiting. 
     In the following description, attention will be focussed on an access policy according to an embodiment of the present invention wherein the access policy runs on a virtual desktop session  55  whereto the user establishes a connection and wherefrom the user seeks access to a resource or a web page  60 ,  70 ,  80 ,  90 , but this is not intended to be limiting. It is understood that the access policy may be run on other platforms or devices, such as the user&#39;s portable computing device, with appropriate configuration changes and the access may be sought to other types of resources whereon critical data may reside. 
       FIG. 2  shows a method for administering an access policy according to an embodiment of the present invention wherein the method includes the steps of: determining open inbound connection information; determining current open outbound connection information; and assessing/identifying any access policy breach. The open inbound connection information includes a connection type used, connection port or network address assigned to a device involved in the open inbound connection. The open outbound connection information includes a URL to a web page, a connection port/network address to a resource, or any other information used for establishing a connection to a resource or a web page. Standard commands such as “netstat -an” in the Windows® command prompt environment or “GetExtendedTcpTable( )” function may be used to obtain the inbound and/or outbound connection information. The method may also include a step of disconnecting and/or redirecting an access policy breaching outbound connection. 
     The method of  FIG. 2  will now be described with reference to an embodiment shown in  FIG. 1 . 
     At step S 10 , an open inbound connection type  15 ,  25 , such as protocol used for the inbound connection to the virtual desktop session  55  from the user&#39;s laptop, is determined. Depending on an implementation of a Virtual Desktop Infrastructure (VDI) or Remote Desktop Services (RDS) system, a different protocol may be used depending on from where the laptop&#39;s connection is initiated, that is depending on whether the user&#39;s connection is from a secure or an insecure environment  10 ,  20 . 
     According to an embodiment, when the laptop connects to a data center  50  from a secure environment  10 , from a location inside a corporation&#39;s premises for example, Microsoft® Remote Desktop Protocol (RDP)  15  is used for connecting to the virtual desktop session  55 , while when the laptop connects from an insecure environment  20 , outside the corporation&#39;s premises for example, only Citrix® Independent Computing Architecture (ICA)  25  is used for the connection to the virtual desktop session  55 . Therefore the laptop&#39;s location can be determined from the protocol used for the inbound communication  15 ,  25 , whereby a decision can be made whether the inbound connection is from a secure environment  100  or an insecure environment  200 . 
     In such an embodiment, WTSQuerySessionInformation( ) function could be used to retrieve a Windows Station Name, the value of which changes depending on the connection type or protocol used. For example, if the laptop connects via RDP  15  the Windows Station Name may be RDP-Tcp and if the laptop connections via ICA  25  the Windows Station Name may be ICA-Tcp. It is then possible to determine the laptop&#39;s location from the retrieved protocol used for the inbound communication  15 ,  25 . 
     At step S 15 , an open inbound connection port and/or a network address of a device involved in the open inbound connection is determined. Such device may be a server  30 ,  40  connected to the laptop via the inbound connection. A different server may be used in accordance with wherefrom the laptop&#39;s connection is initiated, that is whether the user&#39;s connection is from a secure or an insecure environment  10 ,  20 . 
     According to an embodiment, when the laptop connects to a data center  50  from a secure environment  10 , from a location inside a corporation&#39;s premises for example, a first Citrix® server  30  is used for connecting to the virtual desktop session  55 , while when the laptop connects from an insecure environment  20 , outside the corporation&#39;s premises for example, a second Citrix® server  40  is used for the connection to the virtual desktop session  55 . The first server  30  has an IP address of IP_A and uses a first connection port Port_A and the second server  40  has an IP address of IP_B and uses a second connection port Port_B. Therefore the laptop&#39;s location can be determined from the IP address of and/or connection port used by the server  30 ,  40  involved in the inbound communication, whereby a decision can be made whether the inbound connection is from a secure environment  100  or an insecure environment  200 . 
     In an alternative embodiment, only one of steps S 10  and S 15  will take place if only one of step S 10  or S 15  is sufficient in making such determination. It is understood that in an embodiment where a user may be able to connect to either of the first or second server  30 ,  40  regardless of whether he/she is connecting from a secure or insecure environment  10 , only step S 10  may take place, and in an embodiment where any protocol  15 ,  25  can be used for the open inbound connections, only step S 15  may take place. 
     It is also understood that similar secure or insecure environment  10 ,  20  determination can be made of the laptop&#39;s inbound connection&#39;s initiating location, whether the location relates to a physical or virtual location, as long as there is an interdependence between the location and the connection type  15 ,  25 , port and/or network address of the device  30 ,  40 . 
     At step S 20 , a current open outbound connection from the virtual desktop session  55  is determined. This step S 20  determines the user&#39;s connections to a resource or web page  70 ,  90  on a networked resource intended for a secure environment  100  and/or a resource or web page  60 ,  80  on a networked resource intended for an insecure environment  200 . This determination of outbound connection can be made by identifying open outbound connection ports and/or IP addresses from the virtual desktop session  55  or by identifying URLs opened by a browser. When the browser used is Microsoft® Internet Explorer®, a Browser Helper Object (BHO) may be used to identify the open outbound connection ports and/or URLs currently accessed. 
     According to an embodiment, the user&#39;s virtual desktop session  55  has a first open outbound connection/port to a protected resource or web page  70 ,  90  on a networked resource intended for a secure environment  100  and/or second open outbound connection/port to a resource or web page  60 ,  80  on a networked resource intended for an insecure environment  200 . The resource may be a storage device or any other type of medium for storing or supplying data. The resource or the web page  70 ,  90  may comprise business critical data or any other security sensitive information. At step S 20 , the first and/or second outbound connection/port is determined. 
     In such an embodiment, a BHO calls “GetExtendedTcpTable( )” function and retrieves a first list of open outbound connections/ports and compares this first list to a second list of connections/ports/IP addresses to resources or web pages  70 ,  90  on a networked resource intended for a secure environment  100 , whereby a first open outbound connection/port can be determined. The second list is stored in an xml file which may be stored in the virtual desktop session  55 , the data center  50  or the laptop. An exemplary xml comprising the second list would be: 
     &lt;RestrictedAddresses_NAME=“BlockedAddresses”&gt; 
     &lt;BlockedAddress IP=“2.2.2.2” Port=“20” /&gt; 
     &lt;/RestrictedAddresses&gt; 
     Internet Explorer® reads data from this xml file and compares the second list extracted from the read data to the first list retrieved using “GetExtendedTcpTable( )” function. If a match is found between the items of the first and second list, the connection/port/IP address matched is either blocked or redirected in accordance with step S 30  or S 35 . 
     At step S 30  or S 35 , the determinations made in steps S 10 , S 15  and S 20  are used to administer an access policy wherein any access policy breach is assessed and identified. Once policy breach is identified, a further step of blocking or redirecting the breaching open outbound connection may be taken. 
     According to an embodiment, when the inbound connection is determined to be from a first laptop in the secure environment  10 , the access policy permits the first laptop&#39;s virtual desktop session  55  to have access via both first open outbound connection/port to the protected resource or web page  70 ,  90  on the networked resource intended for the secure environment  100  and second open outbound connection/port to the resource or web page  60 ,  80  on the networked resource intended for the insecure environment  200 . Therefore if it is determined that either of the first and second outbound connections is open on the virtual desktop session  55  of the first laptop, step S 30  is taken wherein both first and second outbound connections are retained in their current state. 
     However, when the inbound connection is determined to be from a second laptop in the insecure environment  20 , the access policy permits the second laptop&#39;s virtual desktop session  55  to have access via only the second open outbound connection/port to the resource or web page  60 ,  80  on the networked resource intended for the insecure environment  200 . Therefore if it is determined that the first outbound connection is open on the virtual desktop session  55  of the second laptop, step S 35  is taken wherein the first outbound connection is disconnected. It is understood that when the first outbound connection is disconnected, the access policy may also display a notification or a warning message. 
     According to an embodiment, the step S 35  may also include redirecting the first outbound connection to at least one of the second outbound connection according the access policy. For example, if a browser running on the second laptop had a URL for a protected web page  70 ,  90  on the networked resource intended for the secure environment  100  open, this URL will be redirected by the access policy to another web page  60 ,  80  on the networked resource intended for the insecure environment  200 . This redirected web page may also display a warning or a notification notifying a breach of access policy or a denial of access. A Browser Helper Object (BHO) using IWebBrowser2 interface can be used to access Internet Explorer®&#39;s Navigate( )method to redirect such a URL. 
     The method of  FIG. 2  determines the connection type used  15 ,  25 , such as protocol, and/or open inbound connections and ports  30 ,  40  used by the user to connect to the virtual desktop session  55 , whereby the access policy is able to obtain additional information about the user and his/her virtual desktop session. Typically, this additional information relates to whether the user is connected to the virtual desktop  55  via a secure connection and/or from a secure environment  10  or via an insecure connection and/or from an insecure environment  20 . Then the access policy, using the additional information, restricts access from the user&#39;s virtual desktop  55  to specific resources  70 ,  90 , whereon the protected business critical data resides. 
       FIG. 3  shows a method for administering an access policy according to another embodiment of the present invention wherein a step S 40  has been added to the method of  FIG. 2 . 
     At step S 40 , a determination is made to see if an inbound connection to the virtual desktop session  55  has been re-established. This step includes performing an inbound connection check, wherein the check may be performed randomly, periodically at regular time intervals, whenever an inbound connection is requested, whenever an inbound connection type is changed, whenever an outbound connection is requested, whenever the virtual desktop session  55  exits a stand-by/suspension mode, or whenever any other type of change in state is observed. 
     According to an embodiment, the method of  FIG. 3  includes step S 40  wherein an inbound connection check is performed whenever a laptop establishes a connection to the virtual desktop session  55 . For example, if the laptop was connected to the virtual desktop session  55  but then suspends the session and reconnects from a different location, step S 40  detects this reconnection and performs a check and/or determination step on the inbound connection according to aforementioned step S 10  and/or S 15  as described for the method of  FIG. 2 . 
     If the location of the laptop has changed, steps S 20 , S 30 , and/or S 35  are also performed whereby any currently open outbound connection is also re-assessed for its adherence to the access policy and the access policy administered accordingly as described for the method of  FIG. 2 . For example, WtsWaitsystemEvent function can be used in the BHO running in the Internet Explorer® so that the BHO can be alerted of any reconnection, which may be due to a change in the location of the laptop, whereby the BHO re-assesses any currently open outbound connection for its adherence to the access policy when such a change in location occurs. 
     It is understood that the access policy may also be user or group dependent. For example, an administrator with a high level of privilege may be allowed access through any outbound connection to any protected resource regardless of his or her location while a normal user may only have a restricted access dependent on his or her location. Further, different groups of users may be assigned various levels of privileges, whereby each group&#39;s access policy and the level of access restriction applied to each member of the group may be varied accordingly. 
       FIG. 4  shows a User Interface (UI) for administering an access policy according to an embodiment of the present invention. According to an embodiment, using such UI, an access policy administrator can define a connection type and whether the defined connection type is associated with a secure environment  10  or an insecure environment, define a URL to be redirected and a second URL for the redirection to redirected to, switch on or off a URL redirection, and/or define an inbound connection port or IP address for a server associated with a secure environment  10  or an insecure environment. In this embodiment, the URL to be redirected is an example of the first open outbound connection described for step S 35  of the method of  FIG. 2  or  3 . 
       FIG. 5  shows an illustrative environment  510  according to an embodiment of the invention. The skilled person will realise and understand that embodiments of the present invention may be implemented using any suitable computer system, and the example system shown in  FIG. 5  is exemplary only and provided for the purposes of completeness only. To this extent, the data center  50  of  FIG. 1  includes the environment  510  which includes a computer system  520  that can perform a process or method described herein in order to perform an embodiment of the invention. In particular, computer system  520  is shown including a program  530 , which makes computer system  520  operable to implement an embodiment of the invention by performing a process or method described herein. 
     Computer system  520  is shown including a processing component  522  (e.g., one or more processors), a storage component  524  (e.g., a storage hierarchy), an input/output (I/O) component  526  (e.g., one or more I/O interfaces and/or devices), and a communications pathway  528 . In general, processing component  522  executes program code, such as program  530 , which is at least partially fixed in storage component  524 . While executing program code, processing component  522  can process data, which can result in reading and/or writing transformed data from/to storage component  524  and/or I/O component  526  for further processing. Pathway  528  provides a communications link between each of the components in computer system  520 . I/O component  526  can comprise one or more human I/O devices, which enable a human user  512  to interact with computer system  520  and/or one or more communications devices to enable a system user  512  to communicate with computer system  520  using any type of communications link. To this extent, program  530  can manage a set of interfaces (e.g., graphical user interface(s), application program interface, and/or the like) that enable human and/or system users  512  to interact with program  530 . Further, program  530  can manage (e.g., store, retrieve, create, manipulate, organize, present, etc.) the data, such as a plurality of data files  540 , using any solution. 
     In any event, computer system  520  can comprise one or more general purpose computing articles of manufacture (e.g., computing devices) capable of executing program code, such as program  530 , installed thereon. As used herein, it is understood that “program code” means any collection of instructions, in any language, code or notation, that cause a computing device having an information processing capability to perform a particular action either directly or after any combination of the following: (a) conversion to another language, code or notation; (b) reproduction in a different material form; and/or (c) decompression. To this extent, program  530  can be embodied as any combination of system software and/or application software. 
     Further, program  530  can be implemented using a set of modules. In this case, a module can enable computer system  520  to perform a set of tasks used by program  530 , and can be separately developed and/or implemented apart from other portions of program  530 . As used herein, the term “component” means any configuration of hardware, with or without software, which implements the functionality described in conjunction therewith using any solution, while the term “module” means program code that enables a computer system  520  to implement the actions described in conjunction therewith using any solution. When fixed in a storage component  524  of a computer system  520  that includes a processing component  522 , a module is a substantial portion of a component that implements the actions. Regardless, it is understood that two or more components, modules, and/or systems may share some/all of their respective hardware and/or software. Further, it is understood that some of the functionality discussed herein may not be implemented or additional functionality may be included as part of computer system  520 . 
     When computer system  520  comprises multiple computing devices, each computing device can have only a portion of program  530  fixed thereon (e.g., one or more modules). However, it is understood that computer system  520  and program  530  are only representative of various possible equivalent computer systems that may perform a process described herein. To this extent, in other embodiments, the functionality provided by computer system  520  and program  530  can be at least partially implemented by one or more computing devices that include any combination of general and/or specific purpose hardware with or without program code. In each embodiment, the hardware and program code, if included, can be created using standard engineering and programming techniques, respectively. 
     Regardless, when computer system  520  includes multiple computing devices, the computing devices can communicate over any type of communications link. Further, while performing a process described herein, computer system  520  can communicate with one or more other computer systems using any type of communications link. In either case, the communications link can comprise any combination of various types of optical fibre, wired, and/or wireless links; comprise any combination of one or more types of networks; and/or utilize any combination of various types of transmission techniques and protocols. 
     In any event, computer system  520  can obtain data from files  540  using any solution. For example, computer system  520  can generate and/or be used to generate data files  540 , retrieve data from files  540 , which may be stored in one or more data stores, receive data from files  540  from another system, and/or the like. 
     Some embodiments described herein relate to a computer storage product with a non-transitory computer-readable medium (also can be referred to as a non-transitory processor-readable medium) having instructions or computer code thereon for performing various computer-implemented operations. The computer-readable medium (or processor-readable medium) is non-transitory in the sense that it does not comprise transitory propagating signals (e.g., a propagating electromagnetic wave carrying information on a transmission medium such as space or a cable). The media and computer code (also referred to herein as code) may be those designed and constructed for the specific purpose or purposes. Examples of non-transitory computer-readable media include, but are not limited to: magnetic storage media such as hard disks, optical storage media such as Compact Disc/Digital Video Discs (CD/DVDs), Compact Disc-Read Only Memories (CD-ROMs), magneto-optical storage media such as optical disks, carrier wave signal processing modules, and hardware devices that are specially configured to store and execute program code, such as Application-Specific Integrated Circuits (ASICs), Programmable Logic Devices (PLDs), Read-Only Memory (ROM) and Random-Access Memory (RAM) devices. 
     Examples of computer code include, but are not limited to, micro-code or micro-instructions, machine instructions, such as produced by a compiler, code used to produce a web service, and files containing higher-level instructions that are executed by a computer using an interpreter. For example, embodiments may be implemented using Java, C++, or other programming languages and/or other development tools. 
     While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation, and as such, various changes in form and/or detail may be made. Any portion of the apparatus and/or methods described herein may be combined in any suitable combination, unless explicitly expressed otherwise. Where methods and/or schematics described above indicate certain events and/or flow patterns occurring in certain order, the ordering of certain events and/or flow patterns may be modified. Additionally certain events may be performed concurrently in parallel processes when possible, as well as performed sequentially. 
     Attention is directed to all papers and documents which are filed concurrently with or previous to this specification in connection with this application and which are open to public inspection with this specification, and the contents of all such papers and documents are incorporated herein by reference. 
     All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and/or all of the steps of any method or process so disclosed, may be combined in any combination, except combinations where at least some of such features and/or steps are mutually exclusive. 
     Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. Thus, unless expressly stated otherwise, each feature disclosed is one example only of a generic series of equivalent or similar features. 
     The invention is not restricted to the details of the foregoing embodiment(s). The invention extends to any novel one, or any novel combination, of the features disclosed in this specification (including any accompanying claims, abstract and drawings), or to any novel one, or any novel combination, of the steps of any method or process so disclosed.