Systems and methods for determining endpoint configurations for endpoints of a virtual private network (VPN) and deploying the configurations to the endpoints

• US 9,319,300 B2
• Filed: 12/09/2009
• Issued: 04/19/2016
• Est. Priority Date: 12/09/2008
• Status: Active Grant

• Current Assignee: Gluware IP LLC
• Original Assignee: Glue Networks, Inc.
• Inventors: Gray, Jeff, Huynh Van, Olivier
• Primary Examiner(s): Banks Harold, Marsha D
• Assistant Examiner(s): WYLLIE, CHRISTOPHER T
• Application Number:
  US12/634,536
• Publication Number:
  US 20100142410A1
• Time in Patent Office: 2,323 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/17 Shortcut routing, e.g. using next hop resolution protocol [NHRP]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Systems and Methods for determining endpoint configurations for endpoints of a virtual private network (VPN) and deploying the configurations to the endpoints. Parameters required for building the configurations are accepted from a user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising: endpoint IP addressing scheme information, network design information, and templates used to define profiles of the endpoints. The configurations for the parameters are generated, wherein the parameters comprise endpoint authentication information, and the configurations are set based on endpoint hardware-specific information with no further input required from the user. Each endpoint is queried to verify that the endpoint hardware-specific information is consistent with the configurations for the endpoint. The configurations are deployed to the endpoints of the VPN.

Claims

1. A computerized method for automatically determining complete customized endpoint configurations for each of a plurality of endpoints of at least one virtual private network (VPN) and deploying the configurations to the endpoints, comprising:

accepting, using at least one user interface, parameters required for building the configurations from at least one user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising;

endpoint IP addressing scheme information, network design information, and templates used to define profiles of the endpoints;

automatically generating, using at least one configuration engine, the configurations for the parameters wherein the parameters comprise endpoint authentication information, and setting the configurations based on endpoint hardware-specific information with no further input required from the user;

querying each endpoint to verify that the endpoint hardware-specific information is consistent with the configurations for the endpoint; and

deploying, using at least one scheduler, the configurations to the endpoints of the VPN, wherein the VPN is a multipoint Generic Routing Encapsulation (mGRE) VPN using Next HOP Resolution Protocol (NHRP);

wherein the computerized method prevents misconfigurations and overlapping IP address spaces;

wherein the computerized method;

automatically assigns endpoint Internet Protocol (IP) addressing, automatically selects a currently unused IP Subnet from a Master IP Subnet, and automatically determines the currently unused IP Subnet from the Master IP Subnet using IP Subnetting.

2. The method of claim 1, further comprising:

validating the parameters utilizing the at least one configuration engine.

3. The method of claim 1, wherein the deploying is distributed into time slots so that resource starvation and connection bottlenecks are avoided.

4. The method of claim 1, wherein a consistent network addressing plan is utilized.

5. The method of claim 1, wherein all hardware platforms with all possible combinations of field upgradable parts are managed.

6. The method of claim 1, wherein a contemporaneous inventory is maintained of all VPN hardware to which the configurations are automatically deployed.

7. The method of claim 1, wherein the parameters further comprise network resiliency information.

8. The method of claim 1, wherein the parameters further comprise:

security rules, routing policies, or licensing information, or any combination thereof.

9. The method of claim 1, wherein the parameters are used to create endpoint specific settings and hardware-specific configuration settings.

10. The method of claim 1, wherein at least one orchestrator generates a proper endpoint configuration code.

11. The method of claim 10, wherein customer-level objects are utilized.

12. The method of claim 11, wherein the customer-level objects comprise:

networks, Public Key Infrastructure (PKI) Root Certificate Authorities (CAs), endpoint templates, High Availability (HA) groups, or IP address pools, or any combination thereof.

13. The method of claim 12, wherein the IP address pools comprise:

Master IP Subnet (MIS) groups, Master IP Subnets (MIS), and IP Subnets, or any combination thereof.

14. The method of claim 1, wherein the endpoint addressing scheme information comprises at least one mGRE IP subnet prefix.

15. The method of claim 1, wherein the network design information comprises at least one network ID.

16. The method of claim 1, wherein the endpoints are capable of belonging to the same network.

17. The method of claim 1, wherein the endpoints are capable of belonging to the same customer.

18. The method of claim 1, wherein the endpoints are capable of belonging to many networks.

19. The method of claim 1, wherein the endpoints are capable of belonging to many customers.

20. The method of claim 1, wherein activity logs are created and maintained.

21. The method of claim 20, wherein the activity logs comprise:

output of the configuration engine, scheduler, or delivery engine, or any combination thereof.

22. The method of claim 1, wherein the mGRE VPN using NHRP is using at least one Master IP Subnet.

23. The method of claim 1, wherein the mGRE VPN using NHRP protocol is resilient due to the use of high availability (HA) groups, which allows VPN headends (VHEs) to fail without affecting the user experience.

24. The method of claim 23, wherein all VHEs that are part of the same mGRE VPN using NHRP use at least one daisy chaining High Availability (HA) Group.

25. The method of claim 24, wherein all VPN headends (VHEs) that are part of the same mGRE VPN using NHRP have all their internal interfaces connected on the same local area network (LAN) segment.

26. The method of claim 25, wherein all VHE internal interfaces are automatically numbered by the at least one configuration engine.

27. The method of claim 26, wherein all the VHEs are daisy chained together.

28. The method of claim 23, wherein NHRP maps and Next Hop Server (NHS) server entries are configured for each VPN headend (VHE).

29. The method of claim 28, wherein if there are greater than two VHEs, two NHRP maps are created and two NHS server entries are created for each VHE.

30. The method of claim 29, wherein one NHRP map is a primary map, and the other NHRP map is a secondary map;

and wherein one NHS server entry is a primary entry, and the other NHS server entry is a secondary entry.

31. The method of claim 1, wherein a Customer Premises Equipment (CPE) is attached to at least one mGRE VPN using NHRP.

32. The method of claim 31, wherein a deterministic algorithm is used to select which VHEs a CPE will peer with.

33. The method of claim 31, wherein a CPE that is part of at least two mGRE VPNs using NHRP uses at least one bundling High Availability (HA) Group.

34. The method of claim 1, wherein endpoints that are part of the same VPN authenticate themselves to each other.

35. The method of claim 34, wherein there is at least one public key infrastructure (PKI) server.

36. The method of claim 35, wherein at least one orchestrator creates and manages at least one PKI server.

37. The method of claim 36, wherein the at least one orchestrator manages at least one associated Certificate Lifecycle.

38. The method of claim 37, wherein the at least one orchestrator synchronizes all the endpoints according to the templates.

39. The method of claim 1, wherein the templates comprise:

VPN headend (VHE) templates and/or Customer Premises Equipment (CPE) templates.

40. The method of claim 1, wherein the parameters further comprise customer specifications.

41. The method of claim 1, wherein the parameters further comprise network specifications.

42. The method of claim 40, wherein at least one orchestrator synchronizes all the endpoints according to customer specifications.

43. The method of claim 41, wherein at least one orchestrator synchronizes all the endpoints according to network specifications.

44. The method of claim 1, wherein at least one entity'"'"'s network is extended to at least one remote location.

45. The method of claim 44, wherein at least one user of at least one endpoint self-provisions at least one remote device to the at least one entity'"'"'s network.

46. The method of claim 45, wherein the at least one user self-provisions access to the at least one entity'"'"'s network by:

providing personal information, credential information, and entity information; and

receiving an endpoint.

47. The method of claim 46, wherein the received endpoint is configured by a remote device automation engine using the personal information, the credential information, and the entity information.

48. The method of claim 47, wherein certificates are generated and delivered to at least one legitimate endpoint.

49. The method of claim 48, wherein at least one fingerprint of the at least one endpoint is taken when the at least one endpoint is enrolled in the entity'"'"'s network.

50. The method of claim 49, wherein at least one orchestrator verifies that at least one fingerprint of a certificate request from at least one entity matches the at least one fingerprint of the at least one endpoint taken when the at least one endpoint was enrolled in the entity'"'"'s network.

51. The method of claim 1, wherein the at least one endpoint remains in sync with the settings defined in the network.

52. A computerized system for automatically determining complete customized endpoint configurations for each of a plurality of endpoints of at least one virtual private network (VPN) and deploying the configurations to the endpoints, comprising:

at least one processor, wherein the at least one processor is configured for;

accepting, using at least one user interface, parameters required for building the configurations from at least one user, the configurations enabling the endpoints to process a mixture of time sensitive and non-time sensitive data, and the parameters comprising;

endpoint IP addressing scheme information, network design information, and templates used to define profiles of the endpoints;

automatically generating, using at least one configuration engine, the configurations for the parameters wherein the parameters comprise endpoint authentication information, and setting the configurations based on endpoint hardware-specific information, with no further input required from the user;

querying each endpoint to verify that the endpoint hardware-specific information is consistent with the configurations for the endpoint; and

deploying, using at least one scheduler, the configurations to the endpoints of the VPN, wherein the VPN is a multipoint Generic Routing Encapsulation (mGRE) VPN using Next HOP Resolution Protocol (NHRP);

wherein the computerized method prevents misconfigurations and overlapping IP address spaces;

wherein the computerized method;

automatically assigns endpoint Internet Protocol (IP) addressing, automatically selects a currently unused IP Subnet from a Master IP Subnet, and automatically determines the currently unused IP Subnet from the Master IP Subnet using IP Subnetting.

53. The system of claim 52, further comprising:

validating the parameters utilizing the at least one configuration engine.

54. The system of claim 52, wherein the deploying is distributed into time slots so that resource starvation and connection bottlenecks are avoided.

55. The system of claim 52, wherein a consistent network addressing plan is utilized.

56. The system of claim 52, wherein all hardware platforms with all possible combinations of field upgradable parts are managed.

57. The system of claim 52, wherein a contemporaneous inventory is maintained of all VPN hardware to which the configurations are automatically deployed.

58. The system of claim 52, wherein the parameters further comprise network resiliency information.

59. The system of claim 52, wherein the parameters further comprise:

security rules, routing policies, or licensing information, or any combination thereof.

60. The system of claim 52, wherein the parameters are used to create endpoint specific settings and hardware-specific configuration settings.

61. The system of claim 52, wherein at least one orchestrator generates a proper endpoint configuration code.

62. The system of claim 61, wherein customer-level objects are utilized.

63. The system of claim 62, wherein the customer-level objects comprise:

networks, Public Key Infrastructure (PKI) Root Certificate Authorities (CAs), endpoint templates, High Availability (HA) groups, or IP address pools, or any combination thereof.

64. The system of claim 63, wherein the IP address pools comprise:

Master IP Subnet (MIS) groups, Master IP Subnets (MIS), and IP Subnets, or any combination thereof.

65. The system of claim 52, wherein the endpoint addressing scheme information comprises at least one mGRE IP subnet prefix.

66. The system of claim 52, wherein the network design information comprises at least one network ID.

67. The system of claim 52, wherein the endpoints are capable of belonging to the same network.

68. The system of claim 52, wherein the endpoints are capable of belonging to the same customer.

69. The system of claim 52, wherein the endpoints are capable of belonging to many networks.

70. The system of claim 52, wherein the endpoints are capable of belonging to many customers.

71. The system of claim 52, wherein activity logs are created and maintained.

72. The system of claim 71, wherein the activity logs comprise:

output of the configuration engine, scheduler, or delivery engine, or any combination thereof.

73. The system of claim 52, wherein the mGRE VPN using NHRP is using at least one Master IP Subnet.

74. The system of claim 52, wherein the mGRE VPN using NHRP is resilient due to the use of high availability (HA) groups, which allows VPN headends (VHEs) to fail without affecting the user experience.

75. The system of claim 74, wherein all VPN headends (VHEs) that are part of the same mGRE VPN using NHRP use at least one daisy chaining High Availability (HA) Group.

76. The system of claim 75, wherein all VPN headends (VHEs) that are part of the same mGRE VPN using NHRP have all their internal interfaces connected on the same local area network (LAN) segment.

77. The system of claim 76, wherein all VHE internal interfaces are automatically numbered by the at least one configuration engine.

78. The system of claim 77, wherein all the VHEs are daisy chained together.

79. The system of claim 74, wherein NHRP maps and Next Hop Server (NHS) server entries are configured for each VPN headends (VHE).

80. The system of claim 79, wherein if there are greater than two VHEs, two NHRP maps are created and two NHS server entries are created for each VHE.

81. The system of claim 80, wherein one NHRP map is a primary map, and the other NHRP map is a secondary map;

and wherein one NHS server entry is a primary entry, and the other NHS server entry is a secondary entry.

82. The system of claim 52, wherein a Customer Premises Equipment (CPE) is attached to at least one mGRE VPN using NHRP.

83. The system of claim 82, wherein a deterministic algorithm is used to select which VPN headends (VHEs) a CPE will peer with.

84. The system of claim 82, wherein a CPE that is part of at least two mGRE VPNs using NHRP uses at least one bundling High Availability (HA) Group.

85. The system of claim 52, wherein endpoints that are part of the same VPN authenticate themselves to each other.

86. The system of claim 85, wherein there is at least one public key infrastructure (PKI) server.

87. The system of claim 86, wherein at least one orchestrator creates and manages at least one PKI server.

88. The system of claim 87, wherein the at least one orchestrator manages at least one associated Certificate Lifecycle.

89. The system of claim 88, wherein the at least one orchestrator synchronizes all the endpoints according to the templates.

90. The system of claim 52, wherein the templates comprise:

VHE templates and/or CPE templates.

91. The system of claim 52, wherein the parameters further comprise customer specifications.

92. The system of claim 91, wherein at least one orchestrator synchronizes all the endpoints according to customer specifications.

93. The system of claim 52, wherein the parameters further comprise network specifications.

94. The system of claim 93, wherein at least one orchestrator synchronizes all the endpoints according to network specifications.

95. The system of claim 52, wherein at least one entity'"'"'s network is extended to at least one remote location.

96. The system of claim 95, wherein at least one user of at least one endpoint self-provisions at least one remote device to the at least one entity'"'"'s network.

97. The system of claim 96, wherein the at least one user self-provisions access to the at least one entity'"'"'s network by:

providing personal information, credential information, and entity information; and

receiving an endpoint.

98. The system of claim 97, wherein the received endpoint is configured by a remote device automation engine using the personal information, the credential information, and the entity information.

99. The system of claim 98, wherein certificates are generated and delivered to at least one legitimate endpoint.

100. The system of claim 99, wherein at least one fingerprint of the at least one endpoint is taken when the at least one endpoint is enrolled in the entity'"'"'s network.

101. The system of claim 100, wherein at least one orchestrator verifies that at least one fingerprint of a certificate request from at least one entity matches the at least one fingerprint of the at least one endpoint taken when the at least one endpoint was enrolled in the entity'"'"'s network.

102. The system of claim 52, wherein the at least one endpoint remains in sync with the settings defined in the network.