DYNAMIC VIRTUAL PRIVATE NETWORK

• US 20140101324A1
• Filed: 10/10/2012
• Published: 04/10/2014
• Est. Priority Date: 10/10/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: YOUNG, Charles K., WHITE, Terrence E., DIGGS, Melanie R., COLAR, Gerald D.
• Granted Patent: US 9,596,271 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/465 wherein a single frame includes a plurality of VLAN tags
• CPC Class Codes: H04L 12/4658 wherein a VLAN tag represents a service provider backbone VLAN, e.g. B-Tag, S-Tag
• CPC Class Codes: H04L 12/4662 wherein a VLAN tag represents a service instance, e.g. I-SID in PBB
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 12/4683 characterized by the protocol used
• CPC Class Codes: H04L 12/4687 MVRP [multiple VLAN registration protocol]
• CPC Class Codes: H04L 12/4691 GVRP [GARP VLAN registration protocol]
• CPC Class Codes: H04L 12/4695 VTP [VLAN trunking protocol]
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment

Abstract

Various embodiments establish a virtual private network (VPN) between a remote network and a private network. In one embodiment, a first system in the remote network establishes a connection with a central system through a public network. The central system is situated between the first system and a second system in the private network. The first system receives, from the central system and based on establishing the connection, a set of VPN information associated with at least the second system. The first system disconnects from the central system and establishes a VPN directly with the second system through the public network based on the set of VPN information.

Claims

1. A method, with a first system in a remote network, for establishing a virtual private network (VPN) between the remote network and a private network, the method comprising:

establishing a connection with a central system through a public network, wherein the central system is situated between the first system and a second system in the private network;

receiving, from the central system and based on establishing the connection, a set of VPN information associated with at least the second system;

disconnecting, based on the receiving, from the central system; and

establishing, based on the set of VPN information, a VPN directly with the second system through the public network.

2. The method of claim 1, wherein the set of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

3. The method of claim 2, wherein the set of VPN information further comprises a set of address information, wherein the set of address information comprises at least one of:

an identifier associated with the second system;

an Internet Protocol address associated with the second system; and

a Media Access Control address associated with the second system.

4. The method of claim 2, wherein establishing the VPN comprises:

creating a VPN tunnel directly with the second system based on the set of VPN tunneling information.

5. The method of claim 1, further comprising:

storing the set of VPN information in a local memory.

6. The method of claim 1, further comprising:

receiving, from at least one peer system in the remote network, a request to establish a VPN with at least one system in the private network; and

sending, a set of VPN information associated with the at least one system in the private network to at least one peer system, wherein the set of VPN information configures at least one peer system to establish a VPN directly with the at least one system in the private network through the public network.

7. The method of claim 6, wherein the set of VPN information associated with at least one system in the private network is obtained from the second system in the private network.

8. A method, with a first system in a private network, for establishing a virtual private network (VPN) between the private network and a remote network, the method comprising:

establishing a connection with a central system through a public network, wherein the central system is situated between the first system and a second system in the remote network;

receiving, from the central system and based on establishing the connection, a first set of VPN information associated with at least the second system;

disconnecting, based on the receiving, from the central system;

receiving a request directly from the first system to establish a direct VPN, wherein the request comprises a second set of VPN information;

comparing the second set of VPN information with the first set of VPN information; and

establishing, based on the first and second sets set of VPN information matching, a VPN directly with the second system through the public network.

9. The method of claim 8, wherein the first and second sets of VPN information comprise at least VPN tunneling information, and wherein the VPN tunneling information comprise at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

10. The method of claim 8, wherein each of the first and second sets of VPN information further comprises address information, wherein the address information comprises at least one of:

an identifier associated with the second system;

an Internet Protocol address associated with the second system; and

a Media Access Control address associated with the second system.

11. The method of claim 9, wherein establishing the VPN comprises:

creating a VPN tunnel directly with the second system based on at least the first and second sets of VPN tunneling information.

12. The method of claim 8, further comprising:

storing the first set of VPN information in a local memory.

13. The method of claim 8, further comprising:

receiving, from at least one peer system in the private network, a request to establish a VPN with at least one system in the remote network; and

sending, a set of VPN information associated with at least one system in the remote network to at least one peer system, wherein the set of VPN information configures at least one peer system to establish a VPN directly with at least one system in the remote network through the public network.

14. The method of claim 13, wherein the set of VPN information associated with at least one system in the remote network is obtained from the second system in the remote network.

15. A method, with a central system situated between a first system in a remote network and a second system in a private network, for establishing a virtual private network (VPN) between the remote network and the private network, the method comprising:

receiving, from the first system, a request to establish a VPN with the second system;

identifying, based on the request, a first set of VPN information associated with the second system; and

sending the first set of VPN information to the second system, wherein the set of VPN information configures the second system to establish the VPN directly with the first system.

16. The method of claim 15, further comprising:

identifying, based on the request, a second set of VPN information associated with the first system;

establishing a connection with the second system; and

sending the second set of VPN information to the first system, wherein the second set of VPN information configures the first system to establish the VPN directly with the second system.

17. The method of claim 16, wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:

an encryption protocol;

an encryption key;

a hashing algorithm;

an access list; and

a tunneling protocol.

18. The method of claim 17, wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:

an identifier associated with the second system;

an Internet Protocol address associated with the second system; and

a Media Access Control address associated with the second system.