MULTI-TUNNEL VIRTUAL PRIVATE NETWORK

• US 20130318345A1
• Filed: 05/22/2012
• Published: 11/28/2013
• Est. Priority Date: 05/22/2012
• Status: Active Grant

• Current Assignee: L3Harris Technologies, Inc.
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Hengeveld, Thomas A.
• Granted Patent: US 9,300,570 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 45/302 Route determination based on requested QoS
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS

Abstract

Systems and methods for controlling Quality-of-Service (“QoS”) in a Virtual Private Network (“VPN”) in a transport network (303) providing a plurality of QoS bearers (330₁-330_n). The methods involve: establishing (601-615), between two VPN endpoints (319, 341), a plurality of VPN tunnels (332₀-332_i) through the transport network, including at least a default VPN tunnel (332₀) associated with a first QoS bearer (330₁) and an alternate VPN tunnel (332₁-332_i) associated with a second QoS bearer (330₂); receiving (701, 801) and analyzing a data block; applying a VPN policy (327, 329) to assign the data block to either default VPN tunnel or alternate VPN tunnel; and encapsulating the data block in a transport data block (200) including at least one indicator. The indicator specifies whether the transport data block is to be communicated by the transport network using the first QoS bearer or second QoS bearer.

Claims

1. A method for controlling Quality-of-Service (“

QoS”

) in a Virtual Private Network (“

VPN”

) in a transport network providing a plurality of QoS bearers, the method comprising;

establishing, between a first VPN endpoint and a second VPN endpoint, a plurality of VPN tunnels through said transport network, said plurality of VPN tunnels including at least a default VPN tunnel associated with a first QoS bearer and an alternate VPN tunnel associated with a second QoS bearer; and

performing the following steps at said first VPN endpoint;

receiving a first data block comprising application data;

analyzing said first data block to determine at least one characteristic thereof;

applying a VPN policy to said first data block based on said analyzing;

selectively assigning said first data block to one of said default VPN tunnel and said alternate VPN tunnel based on said applying step; and

encapsulating said first data block in a transport data block, said transport data block including at least one indicator which specifies whether said transport data block is to be communicated by said transport network using said first QoS bearer or said second QoS bearer, wherein said indicator is determined in accordance with said assigning step.

2. The method according to claim 1, further comprising:

subsequent to said encapsulating, communicating said transport data block through said transport network via one of said first and said second QoS bearer as specified by said indicator.

3. The method according to claim 1, further comprising:

prior to said encapsulating, encrypting said first data block using a cryptographic key and a cryptographic protocol; and

selecting at least one of said cryptographic key and said cryptographic protocol in accordance with said assigning step.

4. The method according to claim 1, wherein said at least one characteristic of said first data block comprises at least one selected from the group consisting of:

application identifier, application type, application protocol, source address, source port, destination address, destination port, and requested QoS level.

5. The method according to claim 1, wherein said at least one indicator comprises a port number located in a header of said transport data block.

6. The method according to claim 1, further comprising:

implementing said first VPN endpoint as a VPN client in a remote host computing device; and

wherein said application data is received from a software application executing in said remote host computing device.

7. The method according to claim 1, further comprising:

implementing said first VPN endpoint as a VPN server;

implementing said second VPN endpoint as a VPN client; and

wherein said application data is received from an application server in communication with said VPN server via a private computer network.

8. The method according to claim 7, further comprising:

selecting said VPN policy from a plurality of VPN policies based on said at least one characteristic of said first data block; and

wherein said at least one characteristic comprises a destination address associated with said VPN client.

9. The method according to claim 1, further comprising:

implementing said first VPN endpoint as a VPN server;

implementing said second VPN endpoint as a VPN client;

configuring said VPN policy at said transport network;

providing said VPN policy from said transport network to said VPN server; and

providing said VPN policy from said VPN server to said VPN client.

10. The method according to claim 1, further comprising communicating over said default VPN tunnel and said alternate VPN tunnel using a Transport Layer Security (“

TLS”

) protocol provided at layer 4 of a TCP/IP protocol stack.

11. The method according to claim 1, further comprising:

performing the following steps at said first VPN endpoint;

receiving a transport data block from said second VPN endpoint, said transport data block comprising a VPN payload and at least one indicator specifying one of said default VPN tunnel and said alternate VPN tunnel;

analyzing said transport data block to determine said indicator;

selecting at least one of a cryptographic key and a cryptographic protocol based on said indicator; and

decrypting said VPN payload using a cryptographic key and a cryptographic protocol in accordance with said selecting.

12. A system for controlling Quality-of-Service (“

QoS”

) in a Virtual Private Network (“

VPN”

) in a transport network providing a plurality of QoS bearers, the system comprising;

at least one electronic circuit configured to;

establish, between a first VPN endpoint and a second VPN endpoint, a plurality of VPN tunnels through said transport network, said plurality of VPN tunnels including at least a default VPN tunnel associated with a first QoS bearer and an alternate VPN tunnel associated with a second QoS bearer;

receive a first data block comprising application data;

analyze said first data block to determine at least one characteristic thereof;

apply a VPN policy to said first data block based on said analysis;

selectively assign said first data block to one of said default VPN tunnel and said alternate VPN tunnel based on said application of said VPN policy; and

encapsulate said first data block in a transport data block, said transport data block including at least one indicator which specifies whether said transport data block is to be communicated by said transport network using said first QoS bearer or said second QoS bearer, wherein said indicator is determined in accordance with said assignment.

13. The system according to claim 12, wherein said at least one electronic circuit is further configured to:

subsequent to said encapsulation, transmit said transport data block to said transport network.

14. The system according to claim 12, wherein said at least one electronic circuit is further configured to:

prior to said encapsulation, encrypt said first data block using a cryptographic key and a cryptographic protocol; and

select at least one of said cryptographic key and said cryptographic protocol in accordance with said assignment.

15. The system according to claim 12, wherein said at least one characteristic of said first data block comprises at least one selected from the group consisting of:

application identifier, application type, application protocol, source address, source port, destination address, destination port, and requested QoS level.

16. The system according to claim 12, wherein said at least one indicator comprises a port number located in a header of said transport data block.

17. The system according to claim 12, wherein said first VPN endpoint comprises a VPN client in a remote host computing device that includes said at least one electronic circuit;

and

wherein said application data is received from a software application executing in said remote host computing device.

18. The system according to claim 12, wherein said first VPN endpoint comprises a VPN server that includes said at least one electronic circuit, and said second VPN endpoint comprises a VPN client;

and

wherein said application data is received from an application server in communication with said VPN server via a private computer network.

19. The system according to claim 18, wherein said at least one characteristic comprises a destination address associated with said VPN client;

and

wherein said at least one electronic circuit is further configured to select said VPN policy based on said destination address.

20. The system according to claim 12, wherein said at least one electronic circuit is further configured to:

receive a transport data block from said second VPN endpoint, said transport data block comprising a VPN payload and at least one indicator specifying one of said default VPN tunnel and said alternate VPN tunnel;

analyze said transport data block to determine said indicator;

select at least one of a cryptographic key and a cryptographic protocol based on said indicator; and

decrypt said VPN payload using a cryptographic key and a cryptographic protocol in accordance with said selection.