SYSTEM AND METHOD FOR PROVIDING VIRTUAL PRIVATE NETWORKS

• US 20100142410A1
• Filed: 12/09/2009
• Published: 06/10/2010
• Est. Priority Date: 12/09/2008
• Status: Active Grant

• Current Assignee: Gluware IP LLC
• Original Assignee: Glue Networks, Inc.
• Inventors: Gray, Jeff, HUYNH VAN, Olivier
• Granted Patent: US 9,319,300 B2
• Time in Patent Office: Days
• US Class Current: 370/255
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/17 Shortcut routing, e.g. using next hop resolution protocol [NHRP]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A computerized system and method for automatically determining customized configurations for each of a plurality of endpoints of a virtual private network (VPN) and deploying the configurations to the endpoints, comprising: accepting, using an interface, parameters required for building the configurations from a user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising: endpoint IP addressing scheme information and network design information; automatically generating, using at least one configuration engine, complete customized endpoint configurations for the parameters, and instantiating the configurations based on endpoint hardware-specific information, with no further input required from the user; and deploying, using a scheduler, the configurations to the endpoints of the at least one VPN, wherein the VPN is an mGRE VPN using NHRP protocol.

Claims

1. A computerized method for automatically determining customized configurations for each of a plurality of endpoints of at least one virtual private network (VPN) and deploying the configurations to the endpoints, comprising:

accepting, using at least one user interface, parameters required for building the configurations from at least one user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising;

endpoint IP addressing scheme information and network design information;

automatically generating, using at least one configuration engine, complete customized endpoint configurations for the parameters, and instantiating the configurations based on endpoint hardware-specific information, with no further input required from the user; and

deploying, using at least one scheduler, the configurations to the endpoints of the VPN, wherein the VPN is an mGRE VPN using NHRP protocol.

2. The method of claim 1, further comprising:

validating the parameters utilizing the at least one configuration engine.

3. The method of claim 1, wherein the deploying is distributed into reasonable time slots so that resource starvation and connection bottlenecks are avoided.

4. The method of claim 1, wherein the computerized method prevents misconfigurations.

5. The method of claim 4, wherein the computerized method prevents overlapping IP address spaces.

6. The method of claim 4, wherein the computerized method automatically queries each endpoint to verify that the hardware-specific information is consistent with the customized endpoint specific configuration for the endpoint.

7. The method of claim 1, wherein a consistent network addressing plan is utilized.

8. The method of claim 1, wherein the computerized method automatically assigns the endpoint IP addressing.

9. The method of claim 8, wherein the computerized method automatically selects an unused IP Subnet from the Master IP Subnet,

10. The method of claim 9, wherein the computerized method automatically determines the unused IP Subnet from the Master IP Subnet using IP Subnetting,

11. The method of claim 1, wherein all hardware platforms with all possible combinations of field upgradable parts are managed.

12. The method of claim 1, wherein a contemporaneous inventory is maintained of all VPN hardware to which configurations are automatically deployed,

13. The method of claim 1, wherein the parameters further comprise network resiliency information.

14. The method of claim 1, wherein the parameters further comprise endpoint authentication information.

15. The method of claim 1, wherein the parameters further comprise:

security rules, routing policies, or licensing information, or any combination thereof.

16. The method of claim 1, wherein the parameters can be used to create endpoint specific settings and hardware-specific configuration settings.

17. The method of claim 1, wherein at least one orchestrator generates a proper endpoint configuration code.

18. The method of claim 1, wherein the endpoint addressing scheme information comprises at least one mGRE IP subnet prefix.

19. The method of claim 1, wherein the network design information comprises at least one network ID.

20. The method of claim 1, wherein the endpoints are capable of belonging to the same network.

21. The method of claim 1, wherein the endpoints are capable of belonging to the same customer.

22. The method of claim 1, wherein the endpoints are capable of belonging to many networks.

23. The method of claim 1, wherein the endpoints are capable of belonging to many customers.

24. The method of claim 17, wherein customer-level objects are utilized.

25. The method of claim 18, wherein the customer-level object comprise:

networks, Public Key Infrastructure (PKI) Root Certificate Authorities (CAs), endpoint templates, High Availability (HA) groups, or IP address pools, or any combination thereof.

26. The method of claim 19, wherein the IP address pools comprise:

Master IP Subnet (MIS) groups, Master IP Subnets (MIS), and IP Subnets, or any combination thereof.

27. The method of claim 1, wherein activity logs are created and maintained.

28. The method of claim 27, wherein the activity logs comprise:

output of the configuration engine, scheduler, or delivery engine, or any combination thereof.

29. The method of claim 1, wherein the mGRE VPN using NHRP protocol is using at least one Master IP Subnet.

30. The method of claim 1, wherein the mGRE VPN using NHRP protocol is resilient due to the use of high availability (HA) groups, which allows VHEs to fail without affecting the user experience.

31. The method of claim 29, wherein all VHEs that are part of the same mGRE VPN using NHRP protocol use at least one daisy chaining HA Group.

32. The method of claim 31, wherein all VPN headends (VHEs) that are part of the same mGRE VPN using NHRP protocol have all their internal interfaces connected on the same local area network (LAN) segment.

33. The method of claim 32, wherein all VHE internal interfaces are automatically numbered by the at least one configuration engine.

34. The method of claim 1, wherein a CPE is attached to at least one mGRE VPN using NHRP protocol.

35. The method of claim 34, wherein a deterministic algorithm is used to select which VHEs a CPE will peer with.

36. The method of claim 33, wherein all the VHEs are daisy chained together.

37. The method of claim 34, wherein a CPE that is part of at least two mGRE VPNs using NHRP protocol uses at least one bundling HA Group.

38. The method of claim 1, wherein endpoints that are part of the same VPN authenticate themselves to each other.

39. The method of claim 38, wherein there is at least one public key infrastructure (PKI) server.

40. The method of claim 39, wherein at least one orchestrator creates and manages at least one PKI server.

41. The method of claim 40, wherein the at least one orchestrator can manage at least one associated Certificate Lifecycle.

42. The method of claim 1, wherein the parameters further comprise templates used to define profiles of the endpoints.

43. The method of claim 42, wherein the templates comprise:

VHE templates and/or CPE templates.

44. The method of claim 41, wherein the at least one orchestrator synchronizes all the endpoints according to the templates.

45. The method of claim 1, wherein the parameters further comprise customer specifications.

46. The method of claim 1, wherein the parameters further comprise network specifications.

47. The method of claim 45, wherein at least one orchestrator synchronizes all the endpoints according to customer specifications.

48. The method of claim 46, wherein at least one orchestrator synchronizes all the endpoints according to network specifications.

49. The method of claim 1, wherein at least one entity'"'"'s network can be extended to at least one remote location.

50. The method of claim 49, wherein at least one user of at least one endpoint can self-provision at least one remote device to the at least one entity'"'"'s network.

51. The method of claim 50, wherein the at least one user can self-provision access to the at least one entity'"'"'s network by:

providing personal information, credential information, and entity information; and

receiving an endpoint.

52. The method of claim 51, wherein the received endpoint is configured by a remote device automation engine using the personal information, the credential information, and the entity information.

53. The method of claim 52, wherein certificates are generated and delivered to at least one legitimate endpoint.

54. The method of claim 53, wherein at least one fingerprint of the at least one endpoint is taken when the at least one endpoint is enrolled in the entity'"'"'s network.

55. The method of claim 54, wherein at least one orchestrator verifies that at least one fingerprint of a certificate request from at least one entity matches the at least one fingerprint of the at least one endpoint taken when the at least one endpoint was enrolled in the entity'"'"'s network.

56. The method of claim 1, wherein the at least one endpoint remains in sync with the settings defined in the network.

57. The method of claim 37, wherein NHRP maps and NHS server entries are configured for each VHE.

58. The method of claim 57, wherein if there are greater than two VHEs, two NHRP maps are created and two NHS server entries are created for each VHE.

59. The method of claim 58, wherein one NHRP map is a primary map, and the other NHRP map is a secondary map;

and wherein one NHS server entry is a primary entry, and the other NHS server entry is a secondary entry.

60. A computerized system for automatically determining customized configurations for each of a plurality of endpoints of at least one virtual private network (VPN) and deploying the configurations to the endpoints, comprising:

at least one processor, wherein the at least one processor is configured for;

accepting, using at least one user interface, parameters required for building the configurations from at least one user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising;

endpoint IP addressing scheme information and network design information;

automatically generating, using at least one configuration engine, complete customized endpoint configurations for the parameters, and instantiating the configurations based on endpoint hardware-specific information, with no further input required from the user; and

deploying, using at least one scheduler, the configurations to the endpoints of the VPN, wherein the VPN is an mGRE VPN using NHRP protocol.

61. The system of claim 60, further comprising:

validating the parameters utilizing the at least one configuration engine.

62. The system of claim 60, wherein the deploying is distributed into reasonable time slots so that resource starvation and connection bottlenecks are avoided.

63. The system of claim 60, wherein the computerized method prevents misconfigurations.

64. The system of claim 63, wherein the computerized method prevents overlapping IP address spaces.

65. The system of claim 63, wherein the computerized method automatically queries each endpoint to verify that the hardware-specific information is consistent with the customized endpoint specific configuration for the endpoint.

66. The system of claim 60, wherein a consistent network addressing plan is utilized.

67. The system of claim 60, wherein the computerized method automatically assigns the endpoint IP addressing.

68. The system of claim 67, wherein the computerized method automatically selects an unused IP Subnet from the Master IP Subnet,

69. The system of claim 68, wherein the computerized method automatically determines the unused IP Subnet from the Master IP Subnet using IP Subnetting,

70. The system of claim 60, wherein all hardware platforms with all possible combinations of field upgradable parts are managed.

71. The system of claim 60, wherein a contemporaneous inventory is maintained of all VPN hardware to which configurations are automatically deployed,

72. The system of claim 60, wherein the parameters further comprise network resiliency information.

73. The system of claim 60, wherein the parameters further comprise endpoint authentication information.

74. The system of claim 60, wherein the parameters further comprise:

security rules, routing policies, or licensing information, or any combination thereof.

75. The system of claim 60, wherein the parameters can be used to create endpoint specific settings and hardware-specific configuration settings.

76. The system of claim 60, wherein at least one orchestrator generates a proper endpoint configuration code.

77. The system of claim 60, wherein the endpoint addressing scheme information comprises at least one mGRE IP subnet prefix.

78. The system of claim 60, wherein the network design information comprises at least one network ID.

79. The system of claim 60, wherein the endpoints are capable of belonging to the same network.

80. The system of claim 60, wherein the endpoints are capable of belonging to the same customer.

81. The system of claim 60, wherein the endpoints are capable of belonging to many networks.

82. The system of claim 60, wherein the endpoints are capable of belonging to many customers.

83. The system of claim 76, wherein customer-level objects are utilized.

84. The system of claim 77, wherein the customer-level object comprise:

networks, Public Key Infrastructure (PKI) Root Certificate Authorities (CAs), endpoint templates, High Availability (HA) groups, or IP address pools, or any combination thereof.

85. The system of claim 78, wherein the IP address pools comprise:

Master IP Subnet (MIS) groups, Master IP Subnets (MIS), and IP Subnets, or any combination thereof.

86. The system of claim 60, wherein activity logs are created and maintained.

87. The system of claim 86, wherein the activity logs comprise:

output of the configuration engine, scheduler, or delivery engine, or any combination thereof.

88. The system of claim 60, wherein the mGRE VPN using NHRP protocol is using at least one Master IP Subnet.

89. The system of claim 60, wherein the mGRE VPN using NHRP protocol is resilient due to the use of high availability (HA) groups, which allows VHEs to fail without affecting the user experience.

90. The system of claim 88, wherein all VHEs that are part of the same mGRE VPN using NHRP protocol use at least one daisy chaining HA Group.

91. The system of claim 90, wherein all VPN headends (VHEs) that are part of the same mGRE VPN using NHRP protocol have all their internal interfaces connected on the same local area network (LAN) segment.

92. The system of claim 91, wherein all VHE internal interfaces are automatically numbered by the at least one configuration engine.

93. The system of claim 60, wherein a CPE is attached to at least one mGRE VPN using NHRP protocol.

94. The system of claim 93, wherein a deterministic algorithm is used to select which VHEs a CPE will peer with.

95. The system of claim 92, wherein all the VHEs are daisy chained together.

96. The system of claim 93, wherein a CPE that is part of at least two mGRE VPNs using NHRP protocol uses at least one bundling HA Group.

97. The system of claim 60, wherein endpoints that are part of the same VPN authenticate themselves to each other.

98. The system of claim 97, wherein there is at least one public key infrastructure (PKI) server.

99. The system of claim 98, wherein at least one orchestrator creates and manages at least one PKI server.

100. The system of claim 99, wherein the at least one orchestrator can manage at least one associated Certificate Lifecycle.

101. The system of claim 60, wherein the parameters further comprise templates used to define profiles of the endpoints.

102. The system of claim 101, wherein the templates comprise:

VHE templates and/or CPE templates.

103. The system of claim 100, wherein the at least one orchestrator synchronizes all the endpoints according to the templates.

104. The system of claim 60, wherein the parameters further comprise customer specifications.

105. The system of claim 60, wherein the parameters further comprise network specifications.

106. The system of claim 104, wherein at least one orchestrator synchronizes all the endpoints according to customer specifications.

107. The system of claim 105, wherein at least one orchestrator synchronizes all the endpoints according to network specifications.

108. The system of claim 60, wherein at least one entity'"'"'s network can be extended to at least one remote location.

109. The system of claim 108, wherein at least one user of at least one endpoint can self-provision at least one remote device to the at least one entity'"'"'s network.

110. The system of claim 109, wherein the at least one user can self-provision access to the at least one entity'"'"'s network by:

providing personal information, credential information, and entity information; and

receiving an endpoint.

111. The system of claim 110, wherein the received endpoint is configured by a remote device automation engine using the personal information, the credential information, and the entity information.

112. The system of claim 111, wherein certificates are generated and delivered to at least one legitimate endpoint.

113. The system of claim 112, wherein at least one fingerprint of the at least one endpoint is taken when the at least one endpoint is enrolled in the entity'"'"'s network.

114. The system of claim 113, wherein at least one orchestrator verifies that at least one fingerprint of a certificate request from at least one entity matches the at least one fingerprint of the at least one endpoint taken when the at least one endpoint was enrolled in the entity'"'"'s network.

115. The system of claim 60, wherein the at least one endpoint remains in sync with the settings defined in the network.

116. The system of claim 97, wherein NHRP maps and NHS server entries are configured for each VHE.

117. The system of claim 116, wherein if there are greater than two VHEs, two NHRP maps are created and two NHS server entries are created for each VHE.

118. The system of claim 117, wherein one NHRP map is a primary map, and the other NHRP map is a secondary map;

and wherein one NHS server entry is a primary entry, and the other NHS server entry is a secondary entry.