Tunnel designation system for virtual private networks

• US 7,882,558 B1
• Filed: 10/02/2006
• Issued: 02/01/2011
• Est. Priority Date: 12/07/1999
• Status: Expired due to Term

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Inventors: Lin, Yeejang James
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H
• Application Number:
  US11/542,680
• Time in Patent Office: 1,583 Days
• Field of Search: 726/14, 726/15, 726/27
• US Class Current: 726/15
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

A system and method are provided to couple tunnel servers to tunnel clients executing host applications for use in a virtual private network (VPN) environment. A receiver receives requests from host applications executing on the tunnel clients. The requests are addressed to the tunnel coupling system to establish a VPN tunnel. A processor processes the requests and an indication of loads on the tunnel servers to establish the VPN tunnels by designating at least one of the tunnel servers to each requested tunnel. A tunnel traffic distributor distributes tunnel traffic to the tunnel servers based at least part on the designations. In additional aspects, an evaluation processor evaluates the tunnel traffic before the tunnel traffic distributor distributes the tunnel traffic to the tunnel servers. For example, the evaluation performed by the evaluation processor includes at least performing security functions on the tunnel traffic. In yet another aspect, the request processor establishes the VPN tunnel by, in part, associating each VPN tunnel with characteristics of tunnel traffic for that VPN tunnel, and the tunnel traffic distributor operates in part based on the associations, without involvement of the host applications.

Claims

1. A tunnel designator to couple tunnel servers to tunnel clients executing host applications for use in a virtual private network (VPN) environment, comprising:

(a) a receiver that receives tunnel traffic from host applications executing on the tunnel clients, the tunnel traffic comprising traffic related to existing VPN tunnels and requests to establish a VPN tunnel;

(b) a processor that processes the requests, the processor also maintaining an indication of loads on the tunnel servers, the processor operative to establish

the VPN tunnels by designating at least one of the tunnel servers to each of the requests; and

(c) a tunnel traffic distributor that distributes the tunnel traffic related to existing VPN tunnels to the tunnel servers based at least part on the designations.

2. The tunnel designator of claim 1, further comprising:

an evaluation processor that evaluates the tunnel traffic before the traffic distributor distributes the tunnel traffic to the tunnel servers.

3. The tunnel designator of claim 2, wherein the evaluation performed by the evaluation processor includes at least performing security functions on the tunnel traffic.

4. The tunnel designator of claim 1, wherein:

the processor establishes the VPN tunnel with characteristics of tunnel traffic for that VPN tunnel; and

the tunnel traffic distributor operates in part based on the associations, without involvement of the host applications.

5. A method of connecting a plurality of tunnel clients to a plurality of tunnel servers using a tunnel designator, the method comprising:

using said tunnel designator to receive tunnel traffic of one or more of said tunnel clients, said tunnel traffic comprising traffic related to existing VPN tunnels;

identifying in said tunnel traffic, a request from one of said tunnel clients;

determining if said request is a valid request from one of said tunnel clients;

determining if said request is for a new tunnel,

and if so;

(a) opening a new tunnel to a selected one of said tunnel servers; and

(b) modifying an address map to include information associating said selected one of said tunnel servers to said request;

if not;

(b) using said address map to route said request to a mapped tunnel server.