METHODS AND SYSTEMS FOR IDENTIFYING DATA SESSIONS AT A VPN GATEWAY

• US 20150281408A1
• Filed: 03/27/2014
• Published: 10/01/2015
• Est. Priority Date: 03/27/2014
• Status: Active Grant

• Current Assignee: Pismo Labs Technology Limited
• Original Assignee: Pismo Labs Technology Limited
• Inventors: Kwan, Ying, Lam, Ho Cheung
• Granted Patent: US 9,674,316 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Methods and systems for identifying Internet Protocol (IP) data sessions at a VPN gateway. The VPN gateway receives encapsulating packets, wherein the encapsulating packets encapsulate IP packets. A corresponding VPN connection through which the encapsulating packets are received is identified. The VPN gateway decapsulates the encapsulating packets to retrieve the IP packets and performs deep packet inspection (DPI) on the IP packets in order to identify one or more data sessions that the IP packets belong to. A DPI database is updated accordingly, based on, at least in part, the one or more data sessions.

Claims

1. A method for identifying Internet Protocol (IP) data sessions at a VPN gateway comprising:

receiving encapsulating packets, wherein the encapsulating packets encapsulate IP packets;

identifying a corresponding VPN connection;

decapsulating encapsulating packets to retrieve IP packets;

performing deep packet inspection (DPI) on the IP packets to identify one or more data sessions the IP packets belong to; and

updating a DPI database based, at least in part, on the one or more data sessions.

2. According to the method of claim 1,

wherein the step of updating includes adding a new record in the DPI database if one or more data sessions are identified the first time.

3. According to the method of claim 1, further comprising:

displaying information corresponding to the one or more data sessions at a user interface,

wherein the information is retrieved from the DPI database.

4. According to the method of claim 3,

wherein the user interface is shown on a display, wherein the display is not coupled to the VPN gateway.

5. According to the method of claim 3,

wherein the information is retrieved from the DPI database after a query is performed.

6. According to the method of claim 3,

wherein the information is categorized according to one category and statistical data.

7. According to the method of claim 3,

wherein the information is categorized according to a plurality of categories.

8. According to the method of claim 7,

wherein the information includes correlation among items in the plurality of categories.

9. According to the method of claim 8,

wherein the plurality of categories is selected from a group consisting of source IP address, destination IP address, source port, destination port, IP protocol, application, accumulated size of IP packet payloads received, accumulated size of IP packet payloads transmitted, domain name, begin timestamp and end timestamp.

10. According to the method of 1,

wherein the VPN gateway is a VPN hub,

wherein the VPN hub establishes one or more VPN connections with one or more other VPN gateways respectively.

11. According to the method of 10,

wherein the one or more VPN connection can be an aggregated VPN connection.

12. A VPN gateway for identifying Internet Protocol (IP) data sessions, comprising:

at least one network interface;

at least one processing unit;

at least one main memory;

at least one secondary storage storing program instructions executable by the at least one processing unit for;

receiving encapsulating packets, wherein the encapsulating packets encapsulate IP packets;

identifying a corresponding VPN connection;

decapsulating encapsulating packets to retrieve IP packets;

performing deep packet inspection (DPI) on the IP packets to identify one or more data sessions the IP packets belong to; and

updating a DPI database based, at least in part, on the one or more data sessions.

13. The VPN gateway of claim 12,

wherein the step of updating includes adding a new record in the DPI database if one or more data sessions are identified the first time.

14. The VPN gateway of claim 12, wherein the at least one secondary storage further storing program instructions executable by the at least one processing unit for:

displaying information corresponding to the one or more data sessions at a user interface,

wherein the information is retrieved from the DPI database.

15. The VPN gateway of claim 14,

wherein the user interface is shown on a display, wherein the display is not coupled to the VPN gateway.

16. The VPN gateway of claim 14,

wherein the information is retrieved from the DPI database after a query is performed.

17. The VPN gateway of claim 14,

wherein the information is categorized according to one category and statistical data.

18. The VPN gateway of claim 14,

wherein the information is categorized according to a plurality of categories.

19. The VPN gateway of claim 18,

wherein the information includes correlation among items in the plurality of categories.

20. According to the method of claim 19,

wherein the plurality of categories is selected from a group consisting of source IP address, destination IP address, source port, destination port, IP protocol, application, accumulated size of IP packet payloads received, accumulated size of IP packet payloads transmitted, domain name, begin timestamp and end timestamp.

21. According to the method of 12,

wherein the VPN gateway is a VPN hub,

wherein the VPN hub establishes one or more VPN connections with one or more other VPN gateways respectively.

22. According to the method of 21,

wherein the one or more VPN connection can be an aggregated VPN connection.