Method and device for split tunneling

Patent metadata

Field	Value
Publication number	US-12255873-B2
Application number	US-202318104940-A
Country	US
Kind code	B2
Filing date	Feb 2, 2023
Priority date	Dec 27, 2021
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

An electronic device may obtain a security rule for supporting split tunneling, check a condition for executing a first operation related to bypassing the VPN tunnel by comparing a first value to information based on a first offset in a first element of the packet based on the security rule, check a condition for performing a second operation related to bypassing the VPN tunnel by comparing a second value to information based on a second offset in a second element of the packet when the condition for executing the first operation is satisfied and the first operation instructs that the second element of the packet be inspected, encapsulate the packet while not including the packet in the VPN tunnel and transmit the encapsulated packet to a packet forwarding server, and include the packet in the VPN tunnel and transmit the packet to the packet forwarding server.

First claim

What is claimed is:

1. An electronic device, comprising:
at least one processor comprising processing circuitry; and
a memory configured to store instructions executable by the at least one processor,
wherein the at least one processor is individually and/or collectively configured to:
obtain a security rule for supporting split tunneling, wherein the security rule comprises a plurality of rules for determining whether a packet bypasses a virtual private network (VPN) tunnel;
check a condition for executing a first operation related to bypassing the VPN tunnel at least by comparing a first value to information based on a first offset in a first element of the packet, based on the security rule;
check a condition for executing a second operation related to bypassing the VPN tunnel at least by comparing a second value to information based on a second offset in a second element of the packet when the condition for executing the first operation is satisfied and the first operation instructs that the second element of the packet be inspected;
encapsulate the packet while not including the packet in the VPN tunnel and control to transmit the encapsulated packet to a packet forwarding server when the condition for executing the first operation and/or the condition for executing the second operation is satisfied, and the first operation and/or the second operation instructs that the packet bypass the VPN tunnel;
include the packet in the VPN tunnel and control to transmit the packet to the packet forwarding server when the condition for executing the first operation and/or the condition for executing the second operation is not satisfied; and
include the packet in the VPN tunnel and control to transmit the packet to the packet forwarding server when the condition for executing the first operation and/or the condition for executing the second operation is satisfied, and the first operation and/or the second operation in a first record and/or a second record instructs that the packet be comprised in the VPN tunnel.

2. The electronic device of claim 1 , wherein the security rule comprises a plurality of records for determining whether to bypass the VPN tunnel.

3. The electronic device of claim 2 , wherein the processor is configured to: check the condition for executing the first operation related to bypassing the VPN tunnel at least by comparing the first value to the information based on the first offset in the first element of the packet, based on a first record comprised in the security rule; check the condition for executing the second operation related to bypassing the VPN tunnel at least by comparing the second value to the information based on the second offset in the second element of the packet, based on a second record when the condition for executing the first operation is satisfied, and the first operation in the first record instructs that the second record comprised in the security rule be executed; and encapsulate the packet while not including the packet in the VPN tunnel and control to transmit the encapsulated packet to the packet forwarding server when the condition for executing the first operation and/or the condition for executing the second operation is satisfied, and the first operation and/or the second operation in the first record and/or the second record instructs that the packet bypass the VPN tunnel.

4. The electronic device of claim 1 , wherein the processor is configured so that the packet is to be transmitted to at least one of a target server or a gateway, based on whether the packet bypasses the VPN tunnel.

5. The electronic device of claim 4 , wherein the packet to be transmitted to the at least one of the target server or the gateway comprises a packet of which a source address is changed to an address of the packet forwarding server.

6. The electronic device of claim 1 , wherein the processor is configured to establish a VPN connection at least by sending a request for the VPN connection to the packet forwarding server.

7. The electronic device of claim 1 , wherein the security rule comprises a rule for determining whether the packet is included in the VPN tunnel or bypasses the VPN tunnel based on protocol information comprised in the packet.

8. The electronic device of claim 7 , wherein the protocol information comprises at least one of: protocol identification information, a port number, a header type, and protocol version information.

9. The electronic device of claim 1 , wherein the processor is configured to check a condition for executing a third operation related to bypassing the VPN tunnel at least by comparing a third value to information based on a third offset in a third element of the packet based on a third record when the second operation instructs that the third record included in the security rule be executed.

10. The electronic device of claim 9 , wherein the processor is configured to include the packet in the VPN tunnel and control to transmit the packet to the packet forwarding server when at least one of the condition for executing the first operation, the condition for executing the second operation, and/or the condition for executing the third operation is satisfied, and at least one of the first operation, the second operation and/or the third operation instructs that the packet be included in the VPN tunnel.

11. The electronic device of claim 9 , wherein the processor is configured to encapsulate the packet while not including the packet in the VPN tunnel and control to transmit the encapsulated packet to the packet forwarding server when at least one of the condition for executing the first operation, the condition for executing the second operation, and/or the condition for executing the third operation is satisfied, and at least one of the first operation, the second operation and/or the third operation in a first record, a second record, and/or the third record instructs that the packet bypass the VPN tunnel.

12. The electronic device of claim 1 , wherein the encapsulating of the packet is to add an element comprising an address of the packet forwarding server to the packet.

13. The electronic device of claim 12 , wherein the processor is configured to set the address of the packet forwarding server in the element as a destination address.

14. The electronic device of claim 1 , wherein the processor is configured to receive an updated security rule from a server and update the security rule.

15. A split tunneling method, the method comprising:
obtaining a security rule for supporting split tunneling, wherein the security rule comprises a plurality of rules for determining whether a packet bypasses a virtual private network (VPN) tunnel;
checking a condition for executing a first operation related to bypassing the VPN tunnel at least by comparing a first value to information based on a first offset in a first element of the packet, based on the security rule;
checking a condition for performing a second operation related to bypassing the VPN tunnel at least by comparing a second value to information based on a second offset in a second element of the packet when the condition for executing the first operation is satisfied and the first operation instructs that the second element of the packet be inspected;
encapsulating the packet while not including the packet in the VPN tunnel, and transmitting the encapsulated packet to a packet forwarding server, when the condition for executing the first operation and/or the condition for executing the second operation is satisfied, and the first operation and/or the second operation instructs that the packet bypass the VPN tun

Assignees

• Samsung Electronics Co Ltd

Inventors

• Seo Dongwon
• Kim Taejune
• Lee Kwangyong

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L12/46

  Interconnection of networks · CPC title

• H04L9/40

  Network security protocols · CPC title