Authentication scheme in a virtual private network

Patent metadata

Field	Value
Publication number	US-11539671-B1
Application number	US-202117529238-A
Country	US
Kind code	B1
Filing date	Nov 17, 2021
Priority date	Nov 17, 2021
Publication date	Dec 27, 2022
Grant date	Dec 27, 2022

Abstract

A method in a virtual private network (VPN) environment, the method including determining, by a VPN server, an encrypted authentication packet based at least in part on utilizing an encryption key and a nonce to encrypt one or more fields of an initial authentication packet; transmitting, by the VPN server to an authentication server, the encrypted authentication packet to enable VPN authentication of a device requesting VPN services from the VPN server; determining, by the authentication server, a response regarding the VPN authentication based at least in part on decrypting the one or more fields utilizing a decryption key and the nonce; and transmitting, by the authentication server to the VPN server, the response regarding the VPN authentication. Various other aspects are contemplated.

First claim

What is claimed is:

1. A method in a virtual private network (VPN) environment, the method comprising:
determining, by a VPN server, an encrypted authentication packet based at least in part on utilizing an encryption key and a nonce to encrypt one or more fields of an initial authentication packet;
transmitting, by the VPN server to an authentication server, the encrypted authentication packet to enable VPN authentication of a device requesting VPN services from the VPN server;
determining, by the authentication server, a response regarding the VPN authentication based at least in part on decrypting the one or more fields utilizing a decryption key and the nonce; and
transmitting, by the authentication server to the VPN server, the response regarding the VPN authentication.

2. The method of claim 1 , wherein the encrypted authentication packet includes a crypted code field indicating a type associated with the encrypted authentication packet and that the one or more fields are encrypted.

3. The method of claim 1 , wherein the encrypted authentication packet includes an authentication tag to enable the authentication server to determine whether the encrypted authentication packet is tampered.

4. The method of claim 1 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server.

5. The method of claim 1 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server and an authenticator field including information associated with validating the response from the authentication server.

6. The method of claim 1 , wherein the encrypted authentication packet includes a data length field indicating a length associated with the encrypted authentication packet.

7. The method of claim 1 , wherein the encryption key is the same as the decryption key.

8. A system associated with a virtual private network (VPN) environment, the system comprising:
a VPN server configured to:
determine an encrypted authentication packet based at least in part on utilizing an encryption key and a nonce to encrypt one or more fields of an initial authentication packet; and
transmit, to an authentication server, the encrypted authentication packet to enable VPN authentication of a device requesting VPN services from the VPN server; and

the authentication server configured to:
determine a response regarding the VPN authentication based at least in part on decrypting the one or more fields utilizing a decryption key and the nonce; and
transmit, to the VPN server, the response regarding the VPN authentication.

9. The system of claim 8 , wherein the encrypted authentication packet includes a crypted code field indicating a type associated with the encrypted authentication packet and that the one or more fields are encrypted.

10. The system of claim 8 , wherein the encrypted authentication packet includes an authentication tag to enable the authentication server to determine whether the encrypted authentication packet is tampered.

11. The system of claim 8 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server.

12. The system of claim 8 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server and an authenticator field including information associated with validating the response from the authentication server.

13. The device of claim 8 , wherein the encrypted authentication packet includes a data length field indicating a length associated with the encrypted authentication packet.

14. The device of claim 8 , wherein the encryption key is the same as the decryption key.

15. A non-transitory computer-readable medium configured to store instructions, which
when executed by a first processor associated with a VPN server, configure the first processor to:
determine an encrypted authentication packet based at least in part on utilizing an encryption key and a nonce to encrypt one or more fields of an initial authentication packet; and
transmit, to an authentication server, the encrypted authentication packet to enable VPN authentication of a device requesting VPN services from the VPN server; and

when executed by a second processor associated with the authentication server, configure the second processor to:
determine a response regarding the VPN authentication based at least in part on decrypting the one or more fields utilizing a decryption key and the nonce; and
transmit, to the VPN server, the response regarding the VPN authentication.

16. The non-transitory computer-readable medium of claim 15 , wherein the encrypted authentication packet includes a crypted code field indicating a type associated with the encrypted authentication packet and that the one or more fields are encrypted.

17. The non-transitory computer-readable medium of claim 15 , wherein the encrypted authentication packet includes an authentication tag to enable the authentication server to determine whether the encrypted authentication packet is tampered.

18. The non-transitory computer-readable medium of claim 15 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server.

19. The non-transitory computer-readable medium of claim 15 , wherein the one or more fields include a payload field including information associated with the device requesting the VPN services from the VPN server and an authenticator field including information associated with validating the response from the authentication server.

20. The non-transitory computer-readable medium of claim 15 , wherein the encrypted authentication packet includes a data length field indicating a length associated with the encrypted authentication packet.

Assignees

• Uab 360 It

Inventors

• Pabijanskas Karolis
• Val{Hacek Over (C)}Ik And{Hacek Over (Z)}Ej
• Keliuotis Ramünas

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title