Flexible automated connection to virtual private networks

• US 7,827,292 B2
• Filed: 07/23/2001
• Issued: 11/02/2010
• Est. Priority Date: 07/23/2001
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Weber, Roy Philip, Goldman, Shelley B., Foladare, Mark Jeffrey, Chen, Yihsiu, Stone, Kevin, Schryer, Norman Loren, Killian, Thomas Joseph
• Primary Examiner(s): Follansbee; John
• Assistant Examiner(s): Tran; Nghi V
• Application Number:
  US09/911,061
• Publication Number:
  US 20030028650A1
• Time in Patent Office: 3,389 Days
• Field of Search: 709/229, 709/223, 709/220, 709/230, 713/201
• US Class Current: 709/229
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A network interface unit is provided for use intermediate a LAN and a public or private network, or a combination of both, for establishing secure links to a VPN gateway. Login by a LAN client with the network interface unit, addressing, authentication, and other configuration operations achieved using a web page-based GUI are applied in establishing tunnels from LAN clients to desired VPN destinations. Illustrative network interface units include a DHCP server and provide encryption-decryption and encapsulation-decapsulation of data packets for communication with VPN nodes. Configuration and connection of a client are further enhanced by a built-in DNS server and other functional servers to provide a high degree of autonomy in establishing connections to a desired VPN gateway via an ISP or other public and/or private network links to. The interface unit then performs required authentication exchanges, and required encryption key exchanges.

Claims

1. A method practiced at a network interface unit (NIU) directly connected to at least one local area network (LAN), said NIU also being connected to a non-secure node of a second network, which second network is in packet communication with at least one access node of a secure virtual private network (VPN), the method comprising

receiving data packets from at least one device on said at least one LAN,

multiplexing said data packets into at least one packet data stream,

modifying said at least one packet data stream in a security server in said NIU in accordance with a secure communications protocol by encrypting packets in said at least one packet data stream and encapsulating resulting encrypted packets, and

providing network destination address information from a Domain Name System (DNS) server for at least selected ones of said at least one packet data stream.

2. The method of claim 1 wherein said modifying said at least one packet data stream in a security server comprises modifying said at least one packet data stream in an Internet Protocol security (IPsec) server.

3. The method of claim 2 further comprising

receiving at least one stream of data packets from said non-secure network,

filtering out packets in said at least one stream of received data packets that are not from said VPN network, said filtering being performed by a firewall in said security server, said filtering producing at least one filtered stream of received data packets,

modifying said packets in said at least one filtered stream of received data packets by decrypting said packets in said at least one filtered stream of received data packets and decapsulating resulting decrypted packets to produce decapsulated decrypted packets, said decrypting and decapsulating being performed by said security server,

demultiplexing at least one stream of decapsulated decrypted received data packets to form at least one demultiplexed stream of said received data packets for delivery to said at least one LAN.

4. The method of claim 3 further comprising

authenticating client devices on said at least one LAN, and

wherein packets from authenticated client devices on said at least one LAN that are received at said network interface device are processed as packets received from said VPN.

5. The method of claim 1 wherein said non-secure node of a second network is part of said NIU.

6. The method of claim 5 wherein said at least selected ones of said at least one packet data stream are applied to said non-secure node of said second network.