NETWORK MOBILITY OVER A MULTI-PATH VIRTUAL PRIVATE NETWORK

• US 20090122990A1
• Filed: 11/13/2007
• Published: 05/14/2009
• Est. Priority Date: 11/13/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Tran, Paulina Dung, Leung, Kent, Gundavelli, Srinath
• Granted Patent: US 8,272,046 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Methods and apparatus for applying a single virtual private network (VPN) address to tunnels or connections associated with different access interfaces are disclosed. In one embodiment, a method includes establishing a first tunnel between a node and a VPN server. The first tunnel has a first address. The method also includes assigning a VPN address to the first tunnel, as well as establishing a second tunnel between the node and the VPN server. The second tunnel has a second address. The VPN address is assigned to the second tunnel, and VPN address is accessed by both the first address and the second address.

Claims

1. A method comprising:

establishing a first tunnel between a node and a virtual private network (VPN) server, wherein the first tunnel has a first address;

assigning a VPN address to the first tunnel;

establishing a second tunnel between the node and the VPN server, wherein the second tunnel has a second address; and

assigning the VPN address to the second tunnel, wherein the VPN address is arranged to be accessed by the first address and the second address.

2. The method of claim 1 wherein the first address is a first Internet Protocol (IP) address and the second address is a second IP address.

3. The method of claim 1 wherein the node is a mobile node.

4. The method of claim 3 wherein the mobile node is in communication with a mobile network, and the VPN server is in communication with a local area network.

5. The method of claim 1 wherein the first tunnel is associated with a Wi-Fi interface, and the second tunnel is associated with a cellular interface.

6. The method of claim 1 wherein establishing the first tunnel includes initiating a first Internet key exchange (IKE) session for the first address and establishing the second tunnel includes initiating a second IKE session for the second address, initiating the second IKE session including specifying the VPN address.

7. The method of claim 6 further including establishing an Internet Protocol security protocol suite (IPSec) session with the VPN address.

8. The method of claim 1 wherein traffic is arranged to be exchanged between the node and the VPN using the second tunnel if the first tunnel is unavailable.

9. Logic encoded in one or more tangible media for execution and when executed operable to:

establish a first tunnel between a node and a virtual private network (VPN) server, wherein the first tunnel has a first address;

assign a VPN address to the first tunnel;

establish a second tunnel between the node and the VPN server, wherein the second tunnel has a second address; and

assign the VPN address to the second tunnel, wherein the VPN address is arranged to be accessed by the first address and the second address.

10. The logic of claim 9 wherein the first address is a first Internet Protocol (IP) address and the second address is a second IP address.

11. The logic of claim 9 wherein the node is a mobile node.

12. The logic of claim 11 wherein the mobile node is in communication with a mobile network, and the VPN server is in communication with a local area network.

13. The logic of claim 9 wherein the first tunnel is associated with a Wi-Fi interface, and the second tunnel is associated with a cellular interface.

14. The logic of claim 9 wherein the logic operable to establish the first tunnel is further operable to initiate a first Internet key exchange (IKE) session for the first address and to establish the second tunnel includes initiating a second IKE session for the second address, the logic operable to initiate the second IKE session further being operable to specify the VPN address.

15. The logic of claim 14 further including logic operable to establish an Internet Protocol security protocol suite (IPSec) session with the VPN address.

16. An apparatus comprising:

means for establishing a first tunnel to a node, wherein the first tunnel has a first address;

means for assigning a virtual private network (VPN) address to the first tunnel;

means for establishing a second tunnel to the node, wherein the second tunnel has a second address; and

means for assigning the VPN address to the second tunnel, wherein the VPN address is arranged to be accessed by the first address and the second address.

17. The apparatus of claim 16 wherein the first address is a first Internet Protocol (IP) address and the second address is a second IP address.

18. The apparatus of claim 16 wherein the node is a mobile node.

19. The apparatus of claim 18 wherein the mobile node is in communication with a mobile network, and the apparatus further includes means for communicating with a local area network.

20. The apparatus of claim 16 wherein the first tunnel is associated with a Wi-Fi interface, and the second tunnel is associated with a cellular interface.

21. The apparatus of claim 16 wherein the means for establishing the first tunnel include means for initiating a first Internet key exchange (IKE) session for the first address and the means for establishing the second tunnel include means for initiating a second IKE session for the second address, the means for initiating the second IKE session including means for specifying the VPN address.

22. The apparatus of claim 21 further including means for establishing an Internet Protocol security protocol suite (IPSec) session with the VPN address.

23. An apparatus comprising:

a port arrangement;

logic for establishing a plurality of tunnels between the port arrangement and a node; and

logic for assigning a common virtual private network (VPN) address to the plurality of tunnels.

24. The apparatus of claim 23 wherein the logic for establishing the plurality of tunnels includes logic for establishing a first tunnel and logic for establishing a second tunnel, the first tunnel having a first address and the second tunnel having a second address.

25. The apparatus of claim 24 wherein the logic for assigning the common VPN address to the plurality of tunnels includes logic for obtaining the common VPN address for the first tunnel and logic for assigning the common VPN address to the second tunnel, wherein the common VPN address is arranged to be accessed by the first address and the second address.