Tunnel designation system for virtual private networks

• US 7,117,530 B1
• Filed: 12/07/2000
• Issued: 10/03/2006
• Est. Priority Date: 12/07/1999
• Status: Active Grant

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Lin, Yeejang James
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/732,543
• Time in Patent Office: 2,126 Days
• Field of Search: 713/201, 713/200, 713/154, 713/153, 726 14- 15, 726/7, 726/11, 726/12, 726/27
• US Class Current: 726/15
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

A system and method are provided to couple tunnel servers to tunnel clients executing host applications for use in a virtual private network (VPN) environment. A receiver receives requests from host applications executing on the tunnel clients. The requests are addressed to the tunnel coupling system to establish a VPN tunnel. A processor processes the requests and an indication of loads on the tunnel servers to establish the VPN tunnels by designating at least one of the tunnel servers to each requested tunnel. A tunnel traffic distributor distributes tunnel traffic to the tunnel servers based at least part on the designations. In additional aspects, an evaluation processor evaluates the tunnel traffic before the tunnel traffic distributor distributes the tunnel traffic to the tunnel servers. For example, the evaluation performed by the evaluation processor includes at least performing security functions on the tunnel traffic. In yet another aspect, the request processor establishes the VPN tunnel by, in part, associating each VPN tunnel with characteristics of tunnel traffic for that VPN tunnel, and the tunnel traffic distributor operates in part based on the associations, without involvement of the host applications.

Claims

1. A method of connecting a plurality of tunnel clients to a plurality of tunnel servers using a tunnel designator, the method comprising:

using said tunnel designator to receive a request from one of said tunnel clients;

determining if said request is a valid request from one of said tunnel clients;

determining if said request is for a new tunnel, and

if so;

(a) opening a new tunnel to a selected one of said tunnel servers; and

(b) modifying an address map in the form of a mapping table to include information associating said selected one of said tunnel servers to said request, said mapping table containing a list of all of said tunnel servers and all of said requests, said association to said selected one of said tunnel servers fixed until the connection session is complete;

if not;

(b) using said address map to route said request to a mapped tunnel server.

2. The method of claim 1 further comprising:

using an evaluation processor that evaluates tunnel traffic before the tunnel traffic distributor distributes the tunnel traffic to the tunnel servers.

3. The method of claim 2, wherein the evaluation performed by the evaluation processor includes at least performing security functions on the tunnel traffic.

4. The method of claim 1, wherein:

(a) the evaluation processor establishes a VPN tunnel by, in part, associating each VPN tunnel with characteristics of tunnel traffic for that VPN tunnel; and

(b) the tunnel traffic distributor operates in part based on the associations, without involvement of the host applications.