Automatic hardware-enabled virtual private network system

• US 20050188194A1
• Filed: 12/02/2004
• Published: 08/25/2005
• Est. Priority Date: 10/07/2003
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Granted Patent: US 7,725,933 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The present invention provides a technique for automatically establishing efficient, remote, secure client connections to one or more locations using a smart card enabled client driver and a smart card enabled network edge device (“Subnet Box”) capable of establishing an end-to-end hardware encrypted tunnel between itself and the client. In an embodiment of the invention, a method of establishing a secure communications tunnel comprises the steps of: authenticating a remote client to a subnet box on a private network, wherein the remote client is connected to the subnet box via a public network, establishing a tunnel between the remote client and the subnet box, and encapsulating all traffic in the tunnel, wherein the tunnel is established only when a unique physical token is coupled to the remote device. The unique physical token comprises a smartcard and is configured to be inserted into a communications port of the remote device. The step of authenticating comprises the steps of: receiving an authentication packet, wherein the first authentication packet comprises an identifier identifying the unique physical token and a first random number, and transmitting a response authentication packet, wherein the response authentication packet comprise a second random number. The step of establishing a secure communications tunnel comprises the step of generating a cryptographic key based on the first and second random numbers.

Claims

1. An automatic hardware-enabled virtual private network system comprising:

a first token, wherein said first token is configured to be coupled to a computing device,

a subnet box, and

a key database, wherein said key database comprises a serial number and a secret cryptographic key associated with said token.

2. The system of claim 1, wherein said computing device is connected to said subnet box via a public network, said subnet box is a node on a private network, and said subnet box facilitates a virtual private network connection between said private network and said computing device when said first token is coupled to said computing device.

3. The system of claim 2, further comprising a second token, wherein said second token is configured to be coupled to said subnet box.

4. The system of claim 3, wherein said virtual private network is facilitated only when said second token is coupled to said subnet box.

5. The system of claim 1, wherein said subnet box further comprises a dynamic host configuration protocol server.

6. The system of claim 1, wherein said first token comprises said serial number and said secret cryptographic key.

7. The system of claim 1, wherein said subnet box can authenticate said first token.

8. A method of establishing a secure communications tunnel, the method comprising the steps of:

authenticating a remote client to a node on a private network, wherein said remote client is connected to said node via a public network,

establishing a tunnel between said remote client and said node, and

encapsulating all traffic in said tunnel,

wherein said tunnel is established only when a unique physical token is coupled to said remote device.

9. The method of claim 8, wherein said unique physical token comprises a smartcard.

10. The method of claim 9, wherein said physical token is configured to be inserted into a communications port of said remote device.

11. The method of claim 8, wherein said step of authenticating comprises the steps of:

receiving an authentication packet, wherein said first authentication packet comprises an identifier identifying said unique physical token and a first random number, and

transmitting a response authentication packet, wherein said response authentication packet comprise a second random number.

12. The method of claim 11, wherein said step of establishing a secure communications tunnel comprises the step of generating a cryptographic key based on said first and second random numbers.