Method and system for providing security in performance enhanced network

• US 20030172264A1
• Filed: 01/28/2003
• Published: 09/11/2003
• Est. Priority Date: 01/28/2002
• Status: Abandoned Application

• Current Assignee: Hughes Network Systems LLC (Echostar Corporation)
• Original Assignee: Hughes Electronics Corporation (AT&T, Inc.)
• Inventors: Dillon, Douglas
• Application Number:
  US10/353,231
• Publication Number:
  US 20030172264A1
• Time in Patent Office: Days
• US Class Current: 713/160
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

An approach for providing integrated firewall and network acceleration functions is disclosed. An integrated firewall and network accelerator filters packets received from a host, according to a security policy, to establish a connection for accelerating the filtered packets over a network (e.g., satellite network). The method further includes selectively triggering establishment of a tunnel (e.g., Virtual Private Network (VPN) tunnel) over the established connection, wherein the filtered packets are encrypted through the tunnel.

Claims

1. A method of providing integrated firewall and network acceleration functions, the method comprising:

receiving a plurality of packets from a host;

filtering the plurality of packets, according to a security policy, to establish a connection for accelerating the filtered packets over a network; and

selectively triggering establishment of a tunnel over the established connection, wherein the filtered packets are encrypted through the tunnel.

2. A method according to claim 1, wherein the network in the supporting step is a satellite network.

3. A method according to claim 2, wherein the host in the receiving step transmits the plurality of packets according to Transmission Control Protocol/Internet Protocol (TCP/IP) over one or more TCP connections.

4. A method according to claim 3, wherein the connection in the filtering step is accelerated by performing the steps of:

spoofing acknowledgement messages to the host; and

multiplexing the TCP connections for transport over the established connection.

5. A method according to claim 1, wherein the tunnel in the triggering step is a virtual private network (VPN) tunnel.

6. A computer-readable medium bearing instructions for providing integrated firewall and network acceleration functions, said instruction, being arranged, upon execution, to cause one or more processors to perform the method of claim 1.

7. A network device for providing integrated firewall and network acceleration functions, the device comprising:

a network performance peer configured to filter a plurality of packets received from a host, according to a security policy, to establish a connection for accelerating the filtered packets over a network; and

a tunneling peer configured to selectively trigger establishment of a tunnel over the established connection, wherein the filtered packets are encrypted through the tunnel.

8. A device according to claim 7, wherein the network is a satellite network.

9. A device according to claim 8, wherein the host transmits the plurality of packets according to Transmission Control Protocol/Internet Protocol (TCP/IP) over one or more TCP connections.

10. A device according to claim 9, wherein the network performance peer is configured to perform the steps of:

spoofing acknowledgement messages to the host; and

multiplexing the TCP connections for transport over the established connection.

11. A device according to claim 7, wherein the tunnel is a virtual private network (VPN) tunnel.

12. A network device for providing integrated firewall and network acceleration functions, the device comprising:

means for receiving a plurality of packets from a host;

means for filtering the plurality of packets, according to a security policy, to establish a connection for accelerating the filtered packets over a network; and

means for selectively triggering establishment of a tunnel over the established connection, wherein the plurality of packets are encrypted through the tunnel.

13. A device according to claim 12, wherein the network is a satellite network.

14. A device according to claim 13, wherein the host transmits the plurality of packets according to Transmission Control Protocol/Internet Protocol (TCP/IP) over one or more TCP connections.

15. A device according to claim 14, wherein the filtering means includes:

means for spoofing acknowledgement messages to the host; and

means for multiplexing the TCP connections for transport over the established connection.

16. A device according to claim 12, wherein the tunnel is a virtual private network (VPN) tunnel.

17. A method of supporting a Virtual Private Network (VPN), the method comprising:

receiving a request to establish a connection with a network performance peer over a network, wherein the network performance peer is configured to filter a plurality of packets from a host according to a security policy for transport of the filtered packets over the connection for enhancing performance of the network;

establishing the connection in response to the request; and

establishing a VPN tunnel with a security peer over the established connection, wherein the filtered packets are carried over the VPN tunnel.

18. A method according to claim 17, wherein the network is a satellite network.

19. A method according to claim 17, wherein the network performance peer is configured to perform the steps of:

spoofing acknowledgement messages to the host that generates the plurality of packets for transport over the VPN tunnel; and

multiplexing flows of the packets from the host for transport over the established connection within the VPN tunnel.

20. A computer-readable medium bearing instructions supporting a Virtual Private Network (VPN), said instruction, being arranged, upon execution, to cause one or more processors to perform the method of claim 17.