System and method for separating addresses from the delivery scheme in a virtual private network

• US 20060077977A1
• Filed: 08/11/2005
• Published: 04/13/2006
• Est. Priority Date: 12/10/1999
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Schuba, Christoph L., Caronni, Germano, Gupta, Amit, Kumar, Sandeep, Scott, Glenn C., Markson, Tom R.
• Granted Patent: US 7,685,309 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2525 Translation at a client
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Methods and systems consistent with the present invention establish a virtual network on top of current IP network naming schemes. The virtual network uses a separate layer to create a modification to the IP packet format that is used to separate network behavior from addressing. As a result of the modification to the packet format, any type of delivery method may be assigned to any address or group of addresses. The virtual network also maintains secure communications between nodes, while providing the flexibility of assigning delivery methods independent of the delivery addresses.

Claims

1-7. -7. (canceled)

8. A computer connected to a public-network infrastructure over which a private network operates, the private network having a plurality of nodes and uses a plurality of delivery schemes, the computer comprising:

a memory comprising;

one of the plurality of nodes for communicating over the private network; and

a security layer that receives from the one node communications comprising internal addresses that are suitable for use in communicating within the private network that translates the internal addresses into external addresses that are suitable for use in communicating over the public-network infrastructure, wherein the internal addresses are not associated with the delivery scheme, that encrypts the communications, and that transmits the communications over the public network to destinations of the communications; and

a processor for running the one node and the security layer.

9. The computer of claim 8 wherein the delivery scheme is anycast, multicast, or unicast.

10. The computer of claim 8 wherein the security layer runs in kernel mode.

11. The computer of claim 8 wherein the one node communicates over a plurality of channels.

12. The computer of claim 8 wherein the security layer prevents senders other than the plurality of nodes from sending communications to the one node.

13. The computer of claim 8 wherein the security layer is part of a protocol stack.

16. The computer of claim 8, wherein each external address is unique to a computer hosting one or more of the plurality of nodes.

14. A method in a public network having a network infrastructure that is used by a private network over which a plurality of clients communicate with a plurality of servers each having an external address, the private network uses a plurality of delivery schemes to communicate with the clients and servers, comprising:

requesting an internal address from an address server, wherein the internal address corresponds to a set of servers, wherein the address server maps the internal address to an external address for each of the servers, and wherein each internal address is not associated with a delivery scheme; and

permitting the client to communicate with the set of servers on the private network in a secure manner based on a selected delivery scheme.

15. The method of claim 14, wherein permitting the client to communicate comprises sending a packet from the client to the set of servers by accessing the address server and adding a particular external address for the set of servers.

17. The method of claim 14, wherein each of the external addresses is a unique external address.