System and method for separating addresses from the delivery scheme in a virtual private network

• US 7,685,309 B2
• Filed: 08/11/2005
• Issued: 03/23/2010
• Est. Priority Date: 12/10/1999
• Status: Expired due to Term

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Kulmar, Sandeep, Schuba, Christoph L., Caronni, Germano, Gupta, Amit, Scott, Glenn C., Markson, Tom R.
• Primary Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US11/201,160
• Publication Number:
  US 20060077977A1
• Time in Patent Office: 1,685 Days
• Field of Search: 709/227, 709/228, 709/231, 709/238
• US Class Current: 709/238
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2525 Translation at a client
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Methods and systems consistent with the present invention establish a virtual network on top of current IP network naming schemes. The virtual network uses a separate layer to create a modification to the IP packet format that is used to separate network behavior from addressing. As a result of the modification to the packet format, any type of delivery method may be assigned to any address or group of addresses. The virtual network also maintains secure communications between nodes, while providing the flexibility of assigning delivery methods independent of the delivery addresses.

Claims

1. A network communication system including a plurality of computers each including a memory which communicate over a private network which operates over a public network infrastructure, the network communication system including:

a plurality of software nodes operating in the memory of each of the plurality of computers;

at least one administrative software node which operates in the memory of at least one of the plurality of computers;

a channel communication unit in each administrative software node which is configured to create at least one communication channel between at least two of the plurality of software nodes; and

a security unit in each administrative software node configured to receive messages from one of the plurality of software nodes,

wherein,

the plurality of software nodes communicate with one another using a plurality of delivery schemes,

the messages include an internal address of a software node suitable for use in communicating within the private network and information for translating the internal address of the software node into an external address the software node suitable for communicating over the public network infrastructure,

the channel communication unit in one of the administrative software nodes assigns each of the communication channels a unique key information for decrypting private network identification of source software nodes and destination software nodes, and channel identification for communication between the software nodes,

one of the administrative software nodes changes the key information for each channel when a new software node is added to the channel,

one of the plurality of delivery schemes utilizes the external address of the software node for delivery of the communication and for encryption of the communication over the public network infrastructure,

the internal address of the software node is not incorporated in the encryption of the communication or in the delivery scheme used to deliver the communication over the public network infrastructure, and

the received messages are routed based on corresponding packets, which include the key information.

2. The private network of claim 1 wherein the delivery scheme is any one of anycast, multicast, or unicast.

3. The private network of claim 1 wherein the security unit runs in kernel mode.

4. The private network of claim 1 wherein the one software node communicates over a plurality of channels.

5. The private network of claim 1 wherein the security unit prevents senders other than the plurality of software nodes from sending communications to the one software node.

6. The private network of claim 1 wherein the security unit is part of a protocol stack.

7. The private network of claim 1, wherein each external address is unique to the one of the plurality of computers hosting one or more of the plurality of software nodes.

8. A network delivery system including a plurality of software nodes operating in a memory of a plurality of computers which communicate over the infrastructure of a public network, and where the software nodes utilize a plurality of delivery schemes to communicate with each other over a plurality of channels, and at least one of the software nodes acts as an administrative node which performs a method comprising the steps of:

assigning to each software node (1) an internal address, (2) a unique key information for decrypting private network identification of source software nodes and destination software nodes, and (3) channel identification for communication between the software nodes;

mapping the internal address to an external address for each of the software nodes;

encrypting a communication from a source software node to at least one destination software node using the external address of the destination software node;

delivering an encrypted communication over the private network using a delivery scheme incorporating the external address of the destination software node without incorporating the internal address of destination software node;

permitting the source and destination software nodes to communicate with each other on the private network in a secure manner based on a selected delivery scheme; and

changing the key information when a new software node is added to the channel,

wherein,

the encrypted communication is routed based on a packet, which includes the key information.

9. The network delivery system of claim 8, wherein permitting the software node to communicate comprises sending the packet from the source software node to each of the destination software nodes by accessing the administration software node and adding a particular external address for a destination node.

10. The method of claim 8, wherein each of the external addresses is a unique external address.