Methods and systems for communicating using a virtual private network

• US 9,780,965 B2
• Filed: 07/08/2014
• Issued: 10/03/2017
• Est. Priority Date: 05/27/2008
• Status: Active Grant

• Current Assignee: Gluware IP LLC
• Original Assignee: Glue Networks, Inc.
• Inventors: Huynh Van, Olivier, Gray, Jeffrey G.
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Mansoury, Nourali
• Application Number:
  US14/325,757
• Publication Number:
  US 20150010008A1
• Time in Patent Office: 1,183 Days
• Field of Search: 37039531
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/17 Shortcut routing, e.g. using next hop resolution protocol [NHRP]
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

Systems and methods for communication. A network abstraction layer (NAL) is built on a public Internet; and a network virtualization layer (NVL) is built on the NAL.

Claims

1. A system for communication, comprising:

a network abstraction layer (NAL) built on a public Internet, the NAL comprising an overlay network allowing a direct Internet Protocol (IP) communication between endpoints in a virtual private network (VPN) over the Internet, wherein the NAL provides the overlay network between the endpoints, the overlay network being built over the Internet; and

a network virtualization layer (NVL) built on the NAL, the NVL comprising a VPN aggregator using a group key management encryption protocol providing synchronization of session keys to encrypt a payload between all the endpoints over the NAL such that encrypted traffic is able to be decrypted by any endpoint for an entire session to allow instantly available communication between all the endpoints, wherein the communication between all the endpoints does not require using a hub after an initial connection is established, and wherein the VPN aggregator enables aggregation of multiple encryption domains using virtualization techniques;

wherein an IP communication defines data being exchanged between the endpoints via tunnel interfaces, wherein a tunnel interface defines an interface on an endpoint that is one side of a point-to-point or point-to-multipoint link with another endpoint; and

wherein IP tunnel addresses define all IP addresses of the tunnel interfaces of an endpoint, wherein translation of the IP tunnel addresses and all LAN IP subnets of the endpoint interact IP address occurs for each endpoint, and wherein a registration process the IP addressing scheme of the each endpoint is recorded, said IP addressing scheme including public IP addresses and the IP tunnel addresses of the each endpoint and all LAN IP subnets of the each endpoint.

2. The system of claim 1, wherein the endpoints are configured to hand the communications over to a recipient in clear.

3. The system of claim 1, wherein the NVL is configured as an encryption layer on top of the NAL.

4. The system of claim 3, wherein the NVL is configured to encode and decode the communications.

5. The system of claim 1, wherein the protocol is a Group Domain of Interpretation (GDOI) protocol.

6. A method of communication, comprising:

performing processing associated with providing, with a network abstraction layer (NAL) built on a public Internet, the NAL comprising an overlay network, a direct Internet Protocol (IP) communication between endpoints in a virtual private network (VPN) over the Internet, wherein the NAL provides the overlay network between the endpoints, the overlay network being built over the Internet; and

performing processing associated with providing, with a network virtualization layer (NVL) built on the NAL, the NVL comprising a VPN aggregator using a group key management encryption protocol synchronization of session keys to encrypt a payload between all the endpoints over the NAL such that encrypted traffic is able to be decrypted by any endpoint for an entire session to allow instantly available communication between all the endpoints, wherein the communication between all the endpoints does not require using a hub after an initial connection is established, and wherein the VPN aggregator enables aggregation of multiple encryption domains using virtualization techniques;

wherein an IP communication defines data being exchanged between the endpoints via tunnel interfaces, wherein a tunnel interface defines an interface on an endpoint that is one side of a point-to-point or point-to-multipoint link with another endpoint; and

wherein IP tunnel addresses define all IP addresses of the tunnel interfaces of an endpoint, wherein translation of the IP tunnel addresses and all LAN IP subnets of the endpoint interact IP address occurs for each endpoint, and wherein a registration process the IP addressing scheme of the each endpoint is recorded, said IP addressing scheme including public IP addresses and the IP tunnel addresses of the each endpoint and all LAN IP subnets of the each endpoint.

7. The method of claim 6, further comprising handing the communications over to a recipient in clear at the endpoints.

8. The method of claim 6, wherein the NVL is configured as an encryption layer on top of the NAL.

9. The method of claim 8, further comprising encoding and decoding, with the NVL, the communications.

10. The method of claim 6, wherein the protocol is a Group Domain of Interpretation (GDOI) protocol.