VPN usage to create wide area network backbone over the internet

• US 9,667,534 B2
• Filed: 02/04/2015
• Issued: 05/30/2017
• Est. Priority Date: 07/10/2000
• Status: Expired due to Term

• Current Assignee: AlterWAN, Inc.
• Original Assignee: AlterWAN, Inc.
• Inventors: Haney, Richard D.
• Primary Examiner(s): Sinkantarakorn, Pao
• Assistant Examiner(s): Jahangir, Kabir
• Application Number:
  US14/614,302
• Publication Number:
  US 20150146734A1
• Time in Patent Office: 846 Days
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/308 Route determination based on user's profile, e.g. premium users
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 47/726 Reserving resources in multiple paths to be used simultaneously by balancing the load H04L47/125
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones

Abstract

A wide area network using the internet as a backbone utilizing specially selected ISX/ISP providers whose routers route packets of said wide area network along private tunnels through the internet comprised of high bandwidth, low hop-count data paths. Firewalls are provided at each end of each private tunnel which recognize IP packets addressed to devices at the other end of the tunnel and encapsulate these packets in other IP packets which have a header which includes as the destination address, the IP address of the untrusted side of the firewall at the other end of the tunnel. The payload sections of these packets are the original IP packets and are encrypted and decrypted at both ends of the private tunnel using the same encryption algorithm using the same key or keys.

Claims

1. A method of routing packets at a machine associated with a first network, the method comprising:

receiving packets from one or more third party sources;

identifying the received packets as either associated with a virtual private network or not associated with the virtual private network;

encapsulating packets identified as associated with the virtual private network and routing the encapsulated packets via a dedicated connection to a specific destination associated with the first network; and

routing the packets received from the one or more third party sources which are not associated with the virtual private network exclusively over at least one second connection, different than the dedicated connection;

wherein the method further comprises storing a first routing table and at least one second routing table, wherein one or more routes identified by the first routing table are mutually-exclusive to one or more routes identified by the at least one second routing table, wherein routing the encapsulated packets includes using only one or more routes of the first routing table to route the encapsulated packets, and wherein routing the packets which are not associated with the virtual private network includes using only one or more routes of the at least one second routing table.

2. The method of claim 1, wherein receiving includes using a channel service unit to receive packets via a dedicated connection that directly links the machine with a network associated with a predetermined client.

3. The method of claim 2, wherein identifying includes examining header information for received packets, comparing a network destination address from said header information with a predetermined destination address, and determining that packets are associated with the virtual private network when the network destination address matches the predetermined destination address.

4. The method of claim 1, wherein identifying includes determining whether the received packets are accompanied by a mnemonic label corresponding to the virtual private network and, if the received packets are companied by the mnemonic label, identifying the received packets as associated with the virtual private network.

5. The method of claim 4, wherein the machine is associated with a first endpoint of the first network, wherein the specific destination corresponds to a second endpoint of the first network, and wherein the mnemonic label corresponds to at least one first route that connects said first endpoint with the second endpoint of the first network.

6. The method of claim 1, wherein:

the machine is associated with a first endpoint of the first network;

the specific destination corresponds to a second endpoint of the first network;

the dedicated connection connects said first endpoint with the second endpoint of the first network;

identifying includes examining header information for received packets, comparing a network destination address from said header information with a predetermined destination address outside of the first network, and determining that packets are associated with the virtual private network when the network destination address matches the predetermined destination address; and

the specific destination is to forward packets associated with the virtual private network from the first network toward the network destination address.

7. The method of claim 1, wherein identifying includes examining header information of received packets, comparing a network destination address from said header information with a predetermined destination address, and automatically associating the received packets with the virtual private network when the network destination address and a source of the received packets match a predetermined source-destination address pair.

8. The method of claim 1, wherein encapsulating packets identified as associated with the virtual private network includes encrypting those packets using an encryption key corresponding to a decryption key known a priori to the destination associated with the first network.

9. An apparatus adapted for use in a first network, comprising:

means for receiving packets from one or more third party sources;

means for identifying the received packets as either associated with a virtual private network or not associated with the virtual private network;

means for encapsulating packets identified as associated with the virtual private network and for routing the encapsulated packets via a dedicated connection to a specific destination also associated with the first network; and

means for routing the packets received from the one or more third party sources which are not associated with the virtual private network exclusively over at least one second connection, different than the dedicated connection;

wherein said apparatus is further to store a first routing table and at least one second routing table, wherein one or more routes identified by the first routing table are mutually-exclusive to one or more routes identified by the at least one second routing table, wherein means for encapsulating packets and routing the encapsulated packets is to use only one or more routes of the first routing table to route the encapsulated packets, and wherein the means for routing is to use only one or more routes of the at least one second routing table to route the packets which are not associated with the virtual private network.

10. An apparatus comprising instructions stored on non-transitory machine-readable media, the instructions when executed to cause at least one processor in a machine associated with a first network to:

receive packets from one or more third party sources;

identify the received packets as either associated with a virtual private network or not associated with the virtual private network;

encapsulate packets identified as associated with the virtual private network and route the encapsulated packets via a dedicated connection to a specific destination associated with the first network; and

route the packets received from the one or more third party sources which are not associated with the virtual private network exclusively over at least one second connection, different than the dedicated connection;

wherein the instructions when executed are further to cause the at least one processor to

store a first routing table and at least one second routing table, one or more routes identified by the first routing table being mutually-exclusive to one or more routes identified by the at least one second routing table,

route the encapsulated packets using one or more routes of the first routing table, to the exclusion of each route of the second routing table, and

route the packets not associated with the virtual private network includes using only one or more routes of the at least one second routing table, to the exclusion of each route of the first routing table.

11. The apparatus of claim 10, wherein the instructions when executed are to cause the at least one processor to receive the packets from the one or more third party sources from a channel service unit, the channel service unit to directly link the first network to a network of a predetermined client, via a dedicated connection.

12. The apparatus of claim 11, wherein the instructions when executed are to cause the at least one processor to examine header information for received packets, to compare a network destination address from said header information with a predetermined destination address, and to determine that packets are associated with the virtual private network when the network destination address matches the predetermined destination address.

13. The apparatus of claim 10, wherein the instructions when executed are to cause the at least one processor to determine whether the received packets are accompanied by a mnemonic label corresponding to the virtual private network and, if the received packets are companied by the mnemonic label, to identify the received packets as associated with the virtual private network.

14. The apparatus of claim 13, wherein the machine is associated with a first endpoint of the first network, wherein the specific destination corresponds to a second endpoint of the first network, and wherein the mnemonic label corresponds to at least one first route that connects said first endpoint with the second endpoint of the first network.

15. The apparatus of claim 10, wherein:

the machine is associated with a first endpoint of the first network;

the specific destination corresponds to a second endpoint of the first network;

the dedicated connection connects said first endpoint with the second endpoint of the first network;

the instructions when executed are to cause the at least one processor to examine header information for received packets, to compare a network destination address from said header information with a predetermined destination address outside of the first network, and to determine that packets are associated with the virtual private network when the network destination address matches the predetermined destination address; and

the specific destination is to forward packets associated with the virtual private network from the first network toward the network destination address.

16. The apparatus of claim 10, wherein the instructions when executed are to cause the at least one processor to examine header information of received packets, to compare a network destination address from said header information with a predetermined destination address, and to automatically associate the received packets with the virtual private network when the network destination address and a source of the received packets match a predetermined source-destination address pair.

17. The apparatus of claim 10, wherein the instructions when executed are further to cause the at least one processor to encrypt packets associated with the virtual private network using an encryption key corresponding to a decryption key known a priori to the destination associated with the first network.

18. An apparatus, comprising:

at least one interface to receive first packets and second packets from a client network, the first packets to be routed via a virtual private network connection, the second packets to not be routed via the virtual private network connection;

circuitry to encapsulate the first packets and to address the first packets to a virtual private network destination using a route from a first set of one or more routes; and

circuitry to transmit the second packets without encapsulation added by said apparatus to a destination using a route of a second set of one or more routes, the routes in the first set being mutually-exclusive to the routes in the second set;

wherein

said apparatus is further to store a first routing table and at least one second routing table, one or more routes identified by the first routing table being mutually-exclusive to one or more routes identified by the at least one second routing table,

the circuitry to encapsulate and address is to route the encapsulated packets using one or more routes of the first routing table, to the exclusion of each route of the second routing table, and

the circuitry to transmit is to route the packets not associated with the virtual private network includes using only one or more routes of the at least one second routing table, to the exclusion of each route of the first routing table.

19. The apparatus of claim 18, wherein the first packets are directed to a destination external to a first network, wherein the apparatus is a first endpoint of the first network and the virtual private network destination is a second endpoint of the first network, and wherein the virtual private network destination is to de-encapsulate the first packets and to forward the first packets to the destination external to the first network.

20. The apparatus of claim 18, wherein the circuitry to encapsulate is to determine whether the received packets are accompanied by a mnemonic label corresponding to the virtual private network and, if the received packets are companied by the mnemonic label, is to associate the received packets with the virtual private network.

21. The apparatus of claim 18, wherein the circuitry to identify is to determine whether the received packets are accompanied by a mnemonic label corresponding to the virtual private network and, if the received packets are companied by the mnemonic label, is to associate the reeived packets with the virtual private network.

22. An apparatus adapted for use in a first network, comprising:

circuitry to receive packets from one or more third party sources;

circuitry to identify the received packets as either associated with a virtual private network or not associated with the virtual private network;

circuitry to encapsulate packets identified as associated with the virtual private network;

circuitry to route the encapsulated packets via a dedicated connection to a specific destination associated with the first network; and

circuitry to route the packets received from the one or more third party sources which are not associated with the virtual private network exclusively over at least one second connection, different than the dedicated connection;

wherein

said apparatus is further to store a first routing table and at least one second routing table, one or more routes identified by the first routing table being mutually-exclusive to one or more routes identified by the at least one second routing table,

the circuitry to route the encapsulated packets is to route the encapsulated packets using one or more routes of the first routing table to the exclusion of each route of the second routing table, and

the circuitry to route the packets which are not associated with the virtual private network is to route the packets not associated with the virtual private network includes using only one or more routes of the at least one second routing table, to the exclusion of each route of the first routing table.

23. The apparatus of claim 22, embodied as a router, wherein the circuitry to receive packets comprises one or more dedicated circuits to each directly link the first network to a network of a predetermined client, via a dedicated connection.