Packet handling based on user information included in packet headers by a network gateway

Patent metadata

Field	Value
Publication number	US-11272043-B2
Application number	US-202016815037-A
Country	US
Kind code	B2
Filing date	Mar 11, 2020
Priority date	Jan 22, 2020
Publication date	Mar 8, 2022
Grant date	Mar 8, 2022

Abstract

The technology disclosed herein enables packet handling based on user information included in packet headers. In a particular embodiment, a method provides, in a gateway to a network environment, establishing a first connection with a first connection endpoint outside of the network environment. The method further provides identifying first user information associated with the first connection and adding the first user information to a packet header of one or more first packets associated with the first connection. Also, the method provides transferring the one or more first packets into the network environment.

First claim

What is claimed is:

1. A method of passing information about a user into a network environment from a gateway to the network environment, the method comprising:
in the gateway:
receiving first user information from a first connection endpoint outside of the network environment;
in response to authorizing the user based on the first user information, establishing a first virtual private network (VPN) connection between the gateway and the first connection endpoint;
removing encapsulation of one or more first packets received from the first connection endpoint over the first VPN connection;
adding the first user information to a packet header of the one or more first packets; and
transferring the one or more first packets into the network environment.

2. The method of claim 1 , wherein the one or more first packets comply with Internet Protocol version 4 and wherein adding the first user information to the packet header comprises:
including the first user information to an option type field of the packet header.

3. The method of claim 1 , wherein the one or more first packets comply with Internet Protocol version 6 and wherein adding the first user information to the packet header comprises:
including the first user information to an extension header of the packet header.

4. The method of claim 1 , further comprising:
in the gateway, establishing a second connection within the network environment using a transport protocol.

5. The method of claim 4 , wherein the one or more first packets comprise handshake packets exchanged during a handshake procedure for the transport protocol.

6. The method of claim 1 , wherein the one or more first packets comprise packets received via the first VPN connection.

7. The method of claim 1 , further comprising:
implementing microsegmentation within the network environment based on the first user information in the packet header.

8. The method of claim 7 , wherein implementing the microsegmentation comprises:
enforcing policies at one or more packet network interfaces within the network environment.

9. An apparatus for passing information about a user into a network environment from a gateway to the network environment, the apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media for a network traffic optimizer that, when read and executed by the processing system, direct the processing system to:
receive first user information from a first connection endpoint outside of the network environment;
in response to authorizing the user based on the first user information, establish a first virtual private network (VPN) connection between the gateway and the first connection endpoint;
removing encapsulation of one or more first packets received from the first connection endpoint over the first VPN connection;
add the first user information to a packet header of the one or more first packets; and
transfer the one or more first packets into the network environment.

10. The apparatus of claim 9 , wherein the one or more first packets comply with Internet Protocol version 4 and wherein to add the first user information to the packet header, the program instructions direct the processing system to:
include the first user information to an option type field of the packet header.

11. The apparatus of claim 9 , wherein the one or more first packets comply with Internet Protocol version 6 and wherein to add the first user information to the packet header, the program instructions direct the processing system to:
include the first user information to an extension header of the packet header.

12. The apparatus of claim 9 , wherein the program instructions further direct the processing system to:
establish a second connection within the network environment using a transport protocol.

13. The apparatus of claim 12 , wherein the one or more first packets comprise handshake packets exchanged during a handshake procedure for the transport protocol.

14. The apparatus of claim 9 , wherein the one or more first packets comprise packets received via the first VPN connection.

15. The apparatus of claim 9 , wherein the program instructions further direct the processing system to:
implement microsegmentation within the network environment based on the first user information in the packet header, wherein the microsegmentation includes enforcing policies at one or more packet network interfaces within the network environment.

16. One or more computer readable storage media having program instructions stored thereon for passing information about a user into a network environment from a gateway to the network environment, the program instructions, when read and executed by a processing system, direct the processing system to:
receive first user information from a first connection endpoint outside of the network environment;
in response to authorizing the user based on the first user information, establish a first virtual private network (VPN) connection between the gateway and the first connection endpoint;
removing encapsulation of one or more first packets received from the first connection endpoint over the first VPN connection;
add the first user information to a packet header of the one or more first packets; and
transfer the one or more first packets into the network environment.

Assignees

• Vmware Inc

Inventors

• Aluvala Suman
• Newell Craig Farley
• Yadav Amit Kumar
• Rangain Pavan Rajkumar
• Shetty Rohit Pradeep

Classifications

• H04L69/325

  in the network layer [OSI layer 3], e.g. X.25 (H04L69/16 takes precedence) · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L69/326

  in the transport layer [OSI layer 4] (H04L69/16 takes precedence) · CPC title

• H04L69/22 Primary

  Parsing or analysis of headers · CPC title