Dynamic virtual private network

Patent metadata

Field	Value
Publication number	US-10205756-B2
Application number	US-201615347918-A
Country	US
Kind code	B2
Filing date	Nov 10, 2016
Priority date	Oct 10, 2012
Publication date	Feb 12, 2019
Grant date	Feb 12, 2019

Abstract

Various embodiments establish a virtual private network (VPN) between a remote network and a private network. In one embodiment, a first system in the remote network establishes a connection with a central system through a public network. The central system is situated between the first system and a second system in the private network. The first system receives, from the central system and based on establishing the connection, a set of VPN information associated with at least the second system. The first system disconnects from the central system and establishes a VPN directly with the second system through the public network based on the set of VPN information.

First claim

What is claimed is:

1. A method, by an information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network, for establishing a site-to-site virtual private network (VPN) between the remote network and the private network, the method comprising:
establishing, by the information processing system, a first VPN connection with the first VPN device;
receiving, by the information processing system from the first VPN device while the first VPN connection is established with the first VPN device, a request to establish a VPN with the second VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;
establishing, by the information processing system while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;
identifying, by the information processing system based on the request, a first set of VPN information associated with the second VPN device while the first VPN connection is established with the first VPN device and the second VPN connection is established with the second VPN device; and
sending, by the information processing system, the first set of VPN information to the first VPN device over the first VPN connection, wherein the first set of VPN information configures the first VPN device to establish the VPN directly with the second VPN device without communicating with the information processing system.

2. The method of claim 1 , further comprising:
identifying, based on the request, a second set of VPN information associated with the first VPN device;
establishing a connection with the second VPN device; and
sending the second set of VPN information to the second VPN device, wherein the second set of VPN information configures the second VPN device to establish the VPN directly with the first VPN device.

3. The method of claim 2 , wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:
an encryption protocol;
an encryption key;
a hashing algorithm;
an access list; and
a tunneling protocol.

4. The method of claim 3 , wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:
a VPN device identifier;
a VPN device Internet Protocol address; and
a VPN Media Access Control address.

5. An information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network for establishing a site-to-site virtual private network (VPN) between the remote network and the private network, the information processing system comprising:
a memory;
a processor communicatively coupled to the memory; and
a central VPN device communicatively coupled to the memory and the processor, wherein the central VPN device is configured to perform a method comprising:
establishing a first VPN connection with the first VPN device;
receiving, from the first VPN device while the first VPN connection is established with the first VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;
establishing, while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;
identifying, based on the request, a first set of VPN information associated with the second VPN device while the first VPN connection is established with the first VPN device and the second VPN connection is established with the second VPN device;; and
sending the first set of VPN information to the first VPN device over the first VPN connection, wherein the first, wherein the set of VPN information configures the first VPN device to establish the VPN directly with the second VPN device without communicating with the information processing system.

6. The information processing system of claim 5 , wherein the method further comprises:
identifying, based on the request, a second set of VPN information associated with the first VPN device;
establishing a connection with the second VPN device; and
sending the second set of VPN information to the second VPN device, wherein the second set of VPN information configures the second VPN device to establish the VPN directly with the first VPN device.

7. The information processing system of claim 6 , wherein the first and second sets of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:
an encryption protocol;
an encryption key;
a hashing algorithm;
an access list; and
a tunneling protocol.

8. The information processing system of claim 7 , wherein the first and second sets of VPN information further comprise address information, wherein the address information comprises at least one of:
a VPN device identifier;
a VPN device Internet Protocol address; and
a VPN Media Access Control address.

9. A non-transitory computer program storage product for establishing, by an information processing system situated between a first virtual private network (VPN) device in a remote network and a second VPN device in a private network, a site-to-site virtual private network (VPN) between the remote network and the private network, the computer program storage product comprising instructions configured to perform a method comprising:
establishing a first VPN connection with the first VPN device;
receiving, from the first VPN device while the first VPN connection is established with the first VPN device, a request to establish a VPN with the second VPN device, wherein the first VPN device is utilized by one or more clients within the remote network to communicate with the private network through via a site-to-site VPN, and wherein the second VPN device is utilized by one or more clients within the private network to communicate with the remote network through via a site-to-site VPN;
establishing, while the first VPN connection is established with the first VPN device, a second VPN connection with the second VPN device, wherein receiving the request to establish a VPN with the second VPN device from the first VPN device triggers the second VPN connection to be established with the first second VPN device, and wherein the first VPN connection and the second VPN connection creates a virtual private network between the first VPN device and the second VPN device;

Assignees

• IBM

Inventors

• Young Charles K
• White Terrence E
• Diggs Melanie R
• Colar Gerald D

Classifications

• H04L12/4662

  wherein a VLAN tag represents a service instance, e.g. I-SID in PBB · CPC title

• H04L12/4679

  Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership · CPC title

• H04L12/4675

  Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08) · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L65/1069 Primary

  Session establishment or de-establishment · CPC title