Automatic hardware-enabled virtual private network system

• US 7,725,933 B2
• Filed: 12/02/2004
• Issued: 05/25/2010
• Est. Priority Date: 10/07/2003
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Primary Examiner(s): Hoffman; Brandon S
• Application Number:
  US11/001,123
• Publication Number:
  US 20050188194A1
• Time in Patent Office: 2,000 Days
• Field of Search: 726/17
• US Class Current: 726/17
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

The present invention provides a technique for automatically establishing efficient, remote, secure client connections to one or more locations using a smart card enabled client driver and a smart card enabled network edge device (“Subnet Box”) capable of establishing an end-to-end hardware encrypted tunnel between itself and the client. In an embodiment of the invention, a method of establishing a secure communications tunnel comprises the steps of: authenticating a remote client to a subnet box on a private network, wherein the remote client is connected to the subnet box via a public network, establishing a tunnel between the remote client and the subnet box, and encapsulating all traffic in the tunnel, wherein the tunnel is established only when a unique physical token is coupled to the remote device. The unique physical token comprises a smartcard and is configured to be inserted into a communications port of the remote device. The step of authenticating comprises the steps of: receiving an authentication packet, wherein the first authentication packet comprises an identifier identifying the unique physical token and a first random number, and transmitting a response authentication packet, wherein the response authentication packet comprise a second random number. The step of establishing a secure communications tunnel comprises the step of generating a cryptographic key based on the first and second random numbers.

Claims

1. An automatic hardware-enabled virtual private network system comprising:

a first token, wherein said first token is configured to be coupled to a computing device;

a subnet box configured to be coupled to a private network and to a public network, wherein the subnet box is configured to communicate with the computing device via the public network;

a second token, wherein said second token is configured to be coupled to said subnet box;

wherein said virtual private network is facilitated only when said second token is coupled to said subnet box; and

a key database, wherein said key database is coupled to said subnet box and comprises a serial number and at least one secret cryptographic key associated with said first token;

whereby the subnet box facilitates an encrypted connection between the subnet box and the computing device when the first token is coupled to the computing device.

2. The system of claim 1, wherein said subnet box further comprises a dynamic host configuration protocol server.

3. The system of claim 1, wherein said first token comprises said serial number and said secret cryptographic key.

4. The system of claim 1, wherein said subnet box can authenticate said first token.

5. The method of claim 1, wherein each serial number is unique to the first token of the computing device.

6. A method of establishing a secure communications tunnel, the method comprising the steps of:

authenticating a remote client to a subnet box on a private network, wherein said remote client is connected to said subnet box via a public network,

establishing a tunnel between said remote client and said subnet box when a first unique physical token is coupled to said remote client and a second unique physical token is coupled to said subnet box, and

encapsulating all traffic in said tunnel,

wherein said subnet box is coupled to a key database that comprises a serial number and at least one secret cryptographic key associated with said first unique physical token.

7. The method of claim 6, wherein said first unique physical token comprises a smartcard.

8. The method of claim 7, wherein said first unique physical token is configured to be inserted into a communications port of said remote client.

9. The method of claim 6, wherein said step of authenticating comprises the steps of:

receiving an authentication packet, wherein said first authentication packet comprises an identifier identifying said first unique physical token and a first random number, and

transmitting a response authentication packet, wherein said response authentication packet comprise a second random number.

10. The method of claim 9, wherein said step of establishing a secure communications tunnel comprises the step of generating a cryptographic key based on said first and second random numbers.

11. The method of claim 6, wherein each serial number is unique to the first unique physical token of the remote client.