Method and apparatus for enabling peer-to-peer virtual private network (P2P-VPN) services in VPN-enabled network

• US 20040006708A1
• Filed: 07/02/2002
• Published: 01/08/2004
• Est. Priority Date: 07/02/2002
• Status: Active Grant

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Paul, Sanjoy, Mukherjee, Sarit
• Granted Patent: US 7,421,736 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method for providing peer-to-peer virtual private network (P2P-VPN) services over a network. The method includes identifying subnet and host addresses for each user device requesting participation in a virtual private network (VPN) session. Once the subnet and host addresses are identified, a virtual private host (VPH) is initiated for each user device, where each VPH communicates with each user device via a respective tunnel through the network, thereby enabling secure communications between the user devices.

Claims

1. A method for providing virtual private network (VPN) services, comprising:

identifying subnet and host addresses for each user device requesting participation in a virtual private network (VPN) session; and

initiating a virtual private host (VPH) for each user device, where each VPH communicates with each user device via a respective tunnel through a network, thereby enabling secure communications between said user devices.

2. The method of claim 1, further comprising:

authenticating a user device requesting participation in said VPN; and

generating a respective tunnel from said VPH to those authenticated user devices that are authorized to participate in the session.

3. The method of claim 2, wherein said authenticating step further comprises translating a network access identifier into said subnet and host addresses for each user device.

4. The method of claim 1, wherein said identifying step further comprises:

identifying a number of members forming a group;

computing a minimal number of bits in an IP address required to uniquely identify each member with a host address; and

allocating at least some of the remaining bits in the IP address as a unique subnet address for the group.

5. The method of claim 1, wherein said initiating step comprises:

assigning said subnet and host addresses to the user devices participating in said session; and

designating each VPH as an end-point of a respective tunnel by supporting communications with a respective user device.

6. The method of claim 1, wherein said subnet and host addresses are statically assigned to authorized user devices during initiation of said session.

7. The method of claim 1, wherein said subnet and host addresses are dynamically assigned to allow new authorized user devices to join a session in progress.

8. The method of claim 1, further comprising terminating a tunnel of a user device exiting said session.

9. The method of claim 1, further comprising terminating said session when less than two members are participating in said session.

10. The method of claim 1, further comprising determining billing costs for said session based on billing metrics.

11. The method of claim 10, wherein said billing metrics comprises at least one of a session time duration, group size, quality-of-service, bit-rate, a flat rate, tiered rate, bandwidth, and an access charge.

12. The method of claim 10, wherein an individual subscribing to said session is designated an owner of said session.

13. The method of claim 1, wherein said network is at least one of an IP network, a client/server network, and a peer-to-peer network.

14. In a communications system for providing wireless information, a computer readable medium in a general purpose computer system that operates as a special purpose controller when executing at least one program for broadcasting said information, comprising:

identifying subnet and host addresses for each user device requesting participation in a virtual private network (VPN) session; and

initiating a virtual private host (VPH) for each user device, where each VPH communicates with each user device via a respective tunnel through a network, thereby enabling secure communications between said user devices.

15. A virtual IP service agent (VISA) operating in a controller having a processor and memory, for enabling virtual private network (VPN) services over an IP network, comprising:

a virtual private host (VPH) bank having at least one virtual private host (VHP), each said at least one VPH allocating an IP address and forming an endpoint of a tunnel to a user device over said IP network.

16. The VISA of claim 15, further comprising:

an authentication, authorization, and accounting (AAA) client, interfacing with an AAA database of a service provider and said VPH bank, for authorizing generation of each VPH per user device.

17. The VISA of claim 16, further comprising:

a usage collector, interfacing with said AAA client and said VPH bank, for providing billing metrics to said AAA database.

18. The VISA of claim 17, further comprising:

a tunnel manager, interfacing with said VPH bank, for establishing said respective tunnel between each respective VPH and user device.

19. The VISA of claim 18, further comprising:

an edge router configurator, interfacing with said tunnel manager and VPH bank, for creating and terminating each VPN session.

20. The VISA of claim 19, wherein:

the edge router configurator identifies a session request from said device request by a network access identifier (NAI); and

the AAA client interfaces with the AAA database for authentication.

21. The VISA of claim 15, wherein said IP network comprises the Internet.

22. A method for providing virtual private network (VPN) services, comprising:

means for identifying subnet and host addresses for each user device requesting participation in a virtual private network (VPN) session; and

means for initiating a virtual private host (VPH) for each user device, where each VPH communicates with each user device via a respective tunnel through a network, thereby enabling secure communications between said user devices.