Tunnel interface for securing traffic over a network

• US 8,250,357 B2
• Filed: 09/13/2001
• Issued: 08/21/2012
• Est. Priority Date: 09/13/2000
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Sun, Chih-Tang, Yum, Kiho, Matthews, Abraham R.
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LE, CHAU D
• Application Number:
  US09/952,520
• Publication Number:
  US 20020152373A1
• Time in Patent Office: 3,995 Days
• Field of Search: 713/153, 713/201, 713/150, 380/49, 726 14- 16
• US Class Current: 713/153
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding

Abstract

A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing system, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality of processors in the ring configuration and using the second processing system. A secure communications tunnel is formed by routing all packets for the tunnel through an encrypting router at the sending end to obtain encrypted packets, and routing the encrypted packets through a decrypting router at the receiving end of an IP connection.

Claims

1. A method of delivering security services through a service provider network, the method comprising:

establishing a first routing node within a first processing system;

establishing a second routing node within a second processing system;

establishing an internet protocol (IP) connection communications path between the first processing system and the second processing system that includes the first routing node and the second routing node, wherein establishing includes;

connecting the first routing node to a set of one or more service provider routers of a plurality of service provider routers within the service provider network; and

configuring one or more of the plurality of service provider routers to implement a virtual private network between the set of one or more service provider routers and the second routing node;

receiving a plurality of data packets into the first routing node;

forwarding the received plurality of data packets to a selected service provider router of the set of one or more service provider routers;

encrypting the received plurality of data packets to form encrypted packets within the selected service provider router, without regard to any indication regarding encryption in the received plurality of data packets;

sending the encrypted packets from the selected service provider router to the second routing node;

receiving the encrypted packets into the second routing node;

decrypting the received encrypted packets, without regard to any indication regarding decryption in the received encrypted packets, to form decrypted packets; and

sending the decrypted packets to a destination in the second processing system.

2. The method of claim 1, wherein, to support a communications network, the first processing system includes one or more control processors, one or more access processors, and one or more processing processors.

3. The method of claim 1, wherein for a first customer of the service provider, a first virtual router within the service provider network forms the first routing node in the first processing system and is operationally connected to a second virtual router within the service provider network, and the second virtual router forms the second routing node in the second processing system.

4. The method of claim 1, wherein for each of a plurality of customers of the service provider network, the virtual private network is formed using a virtual encrypting router formed in the service provider network and operationally connected to a virtual decrypting router formed in the second processing system.

5. The method of claim 1, wherein said connecting the first routing node to a set of one or more service provider routers within the service provider network includes connecting a plurality of processors in a ring configuration within the service provider network.

6. The method of claim 5, wherein said connecting the plurality of processors in the ring configuration includes forming a dual rotating ring architecture.

7. The method of claim 5, wherein said connecting the plurality of processors in the ring configuration includes forming a dual counter-rotating ring midplane.