System and method for separating addresses from the delivery scheme in a virtual private network

• US 6,970,941 B1
• Filed: 12/10/1999
• Issued: 11/29/2005
• Est. Priority Date: 12/10/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Schuba, Christoph L., Caronni, Germano, Gupta, Amit, Scott, Glenn C., Kulmar, Sandeep, Markson, Tom R.
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): El-chanti, Hussein
• Application Number:
  US09/458,043
• Time in Patent Office: 2,181 Days
• Field of Search: 709/203, 709/212, 709217-219, 709/225, 709/249, 709213-216, 709223-224, 709227-231, 709/238
• US Class Current: 709/238
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2525 Translation at a client
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Methods and systems consistent with the present invention establish a virtual network on top of current IP network naming schemes. The virtual network uses a separate layer to create a modification to the IP packet format that is used to separate network behavior from addressing. As a result of the modification to the packet format, any type of delivery method may be assigned to any address or group of addresses. The virtual network also maintains secure communications between nodes, while providing the flexibility of assigning delivery methods independent of the delivery addresses.

Claims

1. A method in a public network having a network infrastructure that is used by a private network over which a plurality of nodes communicate, the private network uses a plurality of delivery schemes to communicate between internal addresses that are suitable for use in communicating among the plurality of nodes in the private network, the method comprising:

receiving a request from a user to add a new node to the private network, the request comprising an identifier of the private network and an identifier of the user, the new node for running on a device connected to the network infrastructure, the device having a system-level component used for communicating over the private network;

attempting to authenticate the request including the private network identifier and the user identifier;

when the request has been authenticated successfully,

generating an address mapping for the new node, the address mapping used for mapping between the internal address and an external address suitable for communicating over the network infrastructure of the public network, wherein the internal address is not associated with the delivery scheme;

configuring, by the system-level component, the new node in a context such that the new node is capable of communicating with the plurality of nodes on the private network; and

sending, by the system-level component, a packet from the new node to a destination one of the plurality of nodes on the private network by accessing the address mapping and adding the external address to the packet and by causing delivery of the packet to the destination node to occur in a secure manner.

2. The method of claim 1, further comprising changing, at runtime, an association between the internal address and the delivery scheme.

3. The method of claim 1, wherein the delivery scheme is anycast, multicast, or unicast.

4. The method of claim 1 wherein configuring comprises:

preventing senders other than the plurality of nodes from communicating with the new node.

5. The method of claim 1 wherein sending the packet comprises:

encrypting the packet.

6. The method of claim 1 wherein sending further comprises:

authenticating the new node.

7. The method of claim 1 wherein the destination node has an associated address mapping between an internal address and an external address, and wherein sending further comprises:

accessing the address mapping of the destination node; and

adding the external address of the destination node to the packet.