Dynamic virtual private network

• US 10,205,756 B2
• Filed: 11/10/2016
• Issued: 02/12/2019
• Est. Priority Date: 10/10/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Young, Charles K., White, Terrence E., Diggs, Melanie R., Colar, Gerald D.
• Primary Examiner(s): Rubin, Blake J
• Application Number:
  US15/347,918
• Publication Number:
  US 20170063800A1
• Time in Patent Office: 824 Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/465 wherein a single frame includes a plurality of VLAN tags
• CPC Class Codes: H04L 12/4658 wherein a VLAN tag represents a service provider backbone VLAN, e.g. B-Tag, S-Tag
• CPC Class Codes: H04L 12/4662 wherein a VLAN tag represents a service instance, e.g. I-SID in PBB
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 12/4683 characterized by the protocol used
• CPC Class Codes: H04L 12/4687 MVRP [multiple VLAN registration protocol]
• CPC Class Codes: H04L 12/4691 GVRP [GARP VLAN registration protocol]
• CPC Class Codes: H04L 12/4695 VTP [VLAN trunking protocol]
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment

Abstract

Various embodiments establish a virtual private network (VPN) between a remote network and a private network. In one embodiment, a first system in the remote network establishes a connection with a central system through a public network. The central system is situated between the first system and a second system in the private network. The first system receives, from the central system and based on establishing the connection, a set of VPN information associated with at least the second system. The first system disconnects from the central system and establishes a VPN directly with the second system through the public network based on the set of VPN information.

Claims

1. A method, by an information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network, for establishing a site-to-site virtual private network (VPN) between the remote network and the private network, the method comprising:

establishing, by the information processing system, a first VPN connection with the first VPN device;

receiving, by the information processing system from the first VPN device while the first VPN connection is established with the first VPN device, a request to establish a VPN with the second VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;

establishing, by the information processing system while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;

identifying, by the information processing system based on the request, a first set of VPN information associated with the second VPN device while the first VPN connection is established with the first VPN device and the second VPN connection is established with the second VPN device; and

sending, by the information processing system, the first set of VPN information to the first VPN device over the first VPN connection, wherein the first set of VPN information configures the first VPN device to establish the VPN directly with the second VPN device without communicating with the information processing system.

2. The method of claim 1, further comprising:

identifying, based on the request, a second set of VPN information associated with the first VPN device;

establishing a connection with the second VPN device; and

sending the second set of VPN information to the second VPN device, wherein the second set of VPN information configures the second VPN device to establish the VPN directly with the first VPN device.

3. The method of claim 2, wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

4. The method of claim 3, wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:

a VPN device identifier;

a VPN device Internet Protocol address; and

a VPN Media Access Control address.

5. An information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network for establishing a site-to-site virtual private network (VPN) between the remote network and the private network, the information processing system comprising:

a memory;

a processor communicatively coupled to the memory; and

a central VPN device communicatively coupled to the memory and the processor, wherein the central VPN device is configured to perform a method comprising;

establishing a first VPN connection with the first VPN device;

receiving, from the first VPN device while the first VPN connection is established with the first VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;

establishing, while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;

identifying, based on the request, a first set of VPN information associated with the second VPN device while the first VPN connection is established with the first VPN device and the second VPN connection is established with the second VPN device;

; and

sending the first set of VPN information to the first VPN device over the first VPN connection, wherein the first, wherein the set of VPN information configures the first VPN device to establish the VPN directly with the second VPN device without communicating with the information processing system.

6. The information processing system of claim 5, wherein the method further comprises:

identifying, based on the request, a second set of VPN information associated with the first VPN device;

establishing a connection with the second VPN device; and

sending the second set of VPN information to the second VPN device, wherein the second set of VPN information configures the second VPN device to establish the VPN directly with the first VPN device.

7. The information processing system of claim 6, wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

8. The information processing system of claim 7, wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:

a VPN device identifier;

a VPN device Internet Protocol address; and

a VPN Media Access Control address.

9. A non-transitory computer program storage product for establishing, by an information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network, a site-to-site virtual private network (VPN) between the remote network and the private network, the computer program storage product comprising instructions configured to perform a method comprising:

establishing a first VPN connection with the first VPN device;

receiving, from the first VPN device while the first VPN connection is established with the first VPN device, a request to establish a VPN with the second VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;

establishing, while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the first second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;

identifying, based on the request, a first set of VPN information associated with the second VPN device while the first VPN connection is established with the first VPN device and the second VPN connection is established with the second VPN device;

; and

sending the first set of VPN information to the first VPN device over the first VPN connection, wherein the first set of VPN information configures the first VPN device to establish the VPN directly with the second VPN device without communicating with the information processing system.

10. The computer program storage of claim 9, wherein the method further comprises:

identifying, based on the request, a second set of VPN information associated with the first VPN device;

establishing a connection with the second VPN device; and

sending the second set of VPN information to the second VPN device, wherein the second set of VPN information configures the second VPN device to establish the VPN directly with the first VPN device.

11. computer program storage of claim 10, wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

12. The computer program storage of claim 11, wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:

a VPN device identifier;

a VPN device Internet Protocol address; and

a VPN Media Access Control address.