Architecture for virtual private networks

• US 6,226,748 B1
• Filed: 06/12/1997
• Issued: 05/01/2001
• Est. Priority Date: 06/12/1997
• Status: Expired due to Term

• Current Assignee: Avaya Incorporated
• Original Assignee: VPNet Technologies, Inc. (Avaya Incorporated)
• Inventors: Lawler, John, Palma, Derek, Hunt, William E., Bots, Henk J.
• Primary Examiner(s): Beausoleil, Robert
• Assistant Examiner(s): Baderman, Scott T.
• Application Number:
  US08/874,090
• Time in Patent Office: 1,419 Days
• Field of Search: 713/201, 713/153-154, 713/160-161, 709/225, 709/229, 709/204, 709/218, 709/238
• US Class Current: 726/15
• CPC Class Codes: H04L 12/46 Interconnection of networks
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Protocols and architecture for secure virtual private networks. Intraenterprise data communications are supported in a secure manner over the Internet or other public network space with the implementation of secure virtual private networks. Members of a virtual private network group exchange data that may be compressed, encrypted and authenticated, if the exchange is between members of the group.

Claims

1. A method for sending a data packet from a first member of a virtual private network to a second member of said virtual private network comprising the steps of:

receiving said data packet enroute to said second member;

determining that said data packet is being sent between members of said virtual private network;

determining the packet manipulation rules for packets sent between members of said virtual private network;

forming a secure data packet by executing said packet manipulation rules on said data packet; and

forwarding said secure data packet to said second member of said virtual private network;

wherein said step of determining the packet manipulation rules comprises the step of accessing a lookup table that maintains information identifying compression, encryption and authentication algorithms to be utilized for data packets sent between members of the virtual private network;

wherein said step of forming a secure data packet comprises the steps of encrypting at least a payload portion of the data packet according to the identified encryption algorithm; and

providing authentication information for the data packet according to the identified authentication algorithm; and

wherein said step of forming a secure data packet further comprises the step of compressing said payload portion of the data packet according to the compression algorithm identified.

2. The method according to claim 1, wherein said compressing step occurs prior to said encrypting step.

3. A method for securely exchanging data packets by members of a virtual private network comprising the steps of:

generating a first data packet which includes a source address, a destination address and a data payload portion;

transmitting said first data packet toward the destination address;

intercepting said first data packet enroute to said destination address;

verifying that said first data packet is being sent between members of a virtual private network group;

determining the packet manipulation rules for packets sent between members of said virtual private network group;

generating a second data packet by performing said packet manipulation rules on said first data packet;

forwarding said second data packet toward said destination address;

receiving said second data packet;

verifying that said second data packet is being sent between members of said virtual private network group;

determining the packet manipulation rules for packets sent between members of said virtual private network group;

generating a third packet by reversing the identified packet manipulation rules, said third packet including said data payload portion; and

delivering said third data packet to said destination address.

4. The method according to claim 3 wherein said second packet conceals said source and destination addresses.

5. The method according to claim 3 wherein said step of generating a third packet includes the step of recovering said source and destination addresses for inclusion in said third packet.