Multi-access virtual private network

• US 6,158,011 A
• Filed: 02/26/1999
• Issued: 12/05/2000
• Est. Priority Date: 08/26/1997
• Status: Expired due to Term

• Current Assignee: SSL Services LLC
• Original Assignee: V-ONE Corp. (AEP Networks Ltd.)
• Inventors: Chen, James F., Wang, Jieh-Shan, Brook, Christopher T., Garvey, Francis
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/258,398
• Time in Patent Office: 648 Days
• Field of Search: 713/200, 713/201, 714/4
• US Class Current: 726/15
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168

Abstract

A virtual private network for communicating between a server and clients over an open network uses an applications level encryption and mutual authentication program and at least one shim positioned above either the socket, transport driver interface, or network interface layers of a client computer to intercept function calls, requests for service, or data packets in order to communicate with the server and authenticate the parties to a communication and enable the parties to the communication to establish a common session key. Where the parties to the communication are peer-to-peer applications, the intercepted function calls, requests for service, or data packets include the destination address of the peer application, which is supplied to the server so that the server can authenticate the peer and enable the peer to decrypt further direct peer-to-peer communications.

Claims

1. Apparatus for carrying out communications over a multi-tier virtual private network, said network including a server and a plurality of client computers, the server and client computers each including means for transmitting data to and receiving data from an open network, wherein said means for transmitting data to and receiving data from an open network includes a lower set of communications drivers, said lower set of communications drivers being arranged to receive function calls and requests for service from an applications program in order to transmit and receive said data comprising:

means for intercepting said function calls and requests for service sent by said applications program to said lower level set of communications drivers, said intercepted function calls and requests for service being limited to communications functions with no reference to encryption functions;

means for causing an applications level authentication and encryption program in said one of said client computers to communicate with the server in response to receiving said intercepted function calls and requests for service by generating a session key, using the session key generated by the applications level authentication and encryption program to encrypt file sent by the applications program, and sending function calls and requests for service to the lower level set of communications drivers in order to transmit said encrypted files over said open network.

2. A multi-tier virtual private network, comprising:

a server and a plurality of client computers, the server and client computers each including means for transmitting data to and receiving data from an open network,

wherein said means for transmitting data to and receiving data from the open network includes, in any client computer initiating communications with the server;

applications level encryption and authentication software arranged to communicate with the server in order to;

a.) mutually authenticate the server and the client computer initiating communications with the server and b.) generate a session key for use by the client computer initiating communications to encrypt files;

at least one lower level set of communications drivers;

and a shim arranged to intercept function calls and requests for service sent by an applications program to the lower level set of communications drivers in order to cause the applications level authentication and encryption program to communicate with the server, generate said session key, and encrypt files sent by the applications program before transmittal over said open network.

3. A multi-tier virtual private network as claimed in claim 2, wherein said lower level set of communications drivers includes a network driver layer, a transport driver interface layer arranged to package applications files as packets capable of being routed over the open network and supply the packets to the network driver layer for transmission to the open network, and an applications socket for facilitating service requests by said applications program to the transport driver interface layer, and wherein said shim is a socket shim positioned between the applications program and the socket to intercept function calls to the socket in order to cause the applications level authentication and encryption program to communicate with the server, generate said session key, and encrypt files sent by the applications program before the files are packaged by the transport driver interface layer.

4. Computer software for installation on a client computer of a multi-tier virtual private network, said network including a server and a plurality of client computers, the server and client computers each including means for transmitting data to and receiving data from an open network, wherein said means for transmitting data to and receiving data from an open network includes a lower set of communications drivers, said lower set of communications drivers being arranged to receive function calls and requests for service from an applications program in order to transmit and receive said data,

wherein said computer software includes:

applications level encryption and authentication software arranged to communicate with the server in order to;

a.) mutually authenticate the server and the client computer initiating communications with the server and b.) generate a session key for use by the client computer initiating communications to encrypt files;

and a shim arranged to intercept said function calls and requests for service sent by an applications program to the lower set of communications drivers, said function calls and requests for service being limited to communications functions without reference to encryption, in order to cause the applications level authentication and encryption program to communicate with the server, generate said session key, and use the session key generated by the applications level encryption and authentication software to encrypt files sent by the applications program before transmittal over said open network using function calls and requests for service transmitted by the applications level authentication and encryption program to the lower level set of communications drivers.

5. Computer software as claimed in claim 4, wherein said lower level set of communications drivers includes a network driver layer, a transport driver interface layer arranged to package applications files as packets capable of being routed over the open network and supply the packets to the network driver layer for transmission to the open network, and an applications socket for facilitating service requests by said applications program to the transport driver interface layer, and wherein said shim is a socket shim positioned between the applications program and the socket to intercept function calls to the socket in order to cause the applications level authentication and encryption program to communicate with the server, generate said session key, and encrypt files sent by the applications program before the files are packaged by the transport driver interface layer.

6. Computer software as claimed in claim 4, wherein said lower level set of communications drivers includes a network driver layer, and a transport driver interface layer arranged to package applications files as packets capable of being routed over the open network and supply the packets to the network driver layer for transmission to the open network, and wherein said shim is a transport driver interface layer shim positioned between the applications program and the transport driver interface layer to intercept service requests by the applications program to the transport driver interface layer in order to cause the applications level authentication and encryption program to communicate with the server, generate said session key, and encrypt files sent by the applications program before the files are packaged by the transport driver interface layer.

7. A method of carrying out communications over a multi-tier virtual private network, said network including a server and a plurality of client computers, the server and client computers each including means for transmitting data to and receiving data from an open network, wherein said means for transmitting data to and receiving data from an open network includes a lower set of communications drivers, said lower set of communications drivers being arranged to receive function calls and requests for service from an applications program in order to transmit and receive said data, comprising the steps of:

intercepting said function calls and requests for service sent by said applications program to said lower level set of communications drivers, said intercepted function calls and requests for service being limited to communications functions with no reference to encryption functions;

causing an applications level authentication and encryption program in said one of said client computers to communicate with the server in response to receiving said intercepted function calls and requests for service by generating a session key, using the session key generated by the applications level authentication and encryption program to encrypt file sent by the applications program, and sending function calls and requests for service to the lower level set of communications drivers in order to transmit said encrypted files over said open network.