Dynamic virtual private network

Patent metadata

Field	Value
Publication number	US-9531766-B2
Application number	US-201313768489-A
Country	US
Kind code	B2
Filing date	Feb 15, 2013
Priority date	Oct 10, 2012
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

Various embodiments establish a virtual private network (VPN) between a remote network and a private network. In one embodiment, a first system in the remote network establishes a connection with a central system through a public network. The central system is situated between the first system and a second system in the private network. The first system receives, from the central system and based on establishing the connection, a set of VPN information associated with at least the second system. The first system disconnects from the central system and establishes a VPN directly with the second system through the public network based on the set of VPN information.

First claim

What is claimed is:

1. An information processing system in a remote network for establishing a site-to-site virtual private network (VPN) between the remote network and a private network, the information processing system comprising:
a memory;
a processor communicatively coupled to the memory; and
a first VPN device communicatively coupled to the memory and the processor, wherein the first VPN device is configured to perform a method comprising:
receiving a VPN request from a client device within the remote network to establish a VPN connection with the private network;
analyzing local VPN information for VPN information associated with the private network;
determining, based on the analyzing, that the local VPN information fails to comprise VPN information associated with the private network;
establishing a VPN connection with a central system through a public network in response to the local VPN information failing to comprise VPN information associated with the private network, wherein the central system is situated between the first VPN device and a second VPN device in the private network, where the first VPN device is local to the remote network and the second VPN device is local to the private network;
receiving, from the central system and based on establishing the connection, a set of VPN information associated with at least the second VPN device;
disconnecting, based on the receiving, from the central system; and
establishing, based on the set of VPN information, a site-to-site VPN directly with the second VPN device through the public network, wherein one or more client devices within the remote network communicate with the private network utilizing the site-to-site VPN through the first VPN device.

2. The information processing system of claim 1 , wherein the set of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:
an encryption protocol;
an encryption key;
a hashing algorithm;
an access list; and
a tunneling protocol.

3. The information processing system of claim 2 , wherein the set of VPN information further comprises a set of address information, wherein the set of address information comprises at least one of:
an identifier associated with the second VPN device;
an Internet Protocol address associated with the second VPN device; and
a Media Access Control address associated with the second VPN device.

4. The information processing system of claim 2 , wherein establishing the VPN comprises:
creating a VPN tunnel directly with the second VPN device based on the set of VPN tunneling information.

5. The information processing system of claim 1 , wherein the method further comprises:
storing the set of VPN information in a local memory.

6. The information processing system of claim 1 , wherein the method further comprises:
receiving, from at least one peer system in the remote network, a request to establish a VPN with at least one system in the private network; and
sending, a set of VPN information associated with the at least one system in the private network to at least one peer system, wherein the set of VPN information configures at least one peer system to establish a VPN directly with the at least one system in the private network through the public network.

7. The information processing system of claim 6 , wherein the set of VPN information associated with at least one system in the private network is obtained from the second VPN device in the private network.

8. A computer program storage product for establishing a site-to-site virtual private network (VPN) between a first VPN device in a remote network and a second VPN device in a private network, the computer program storage product comprising instructions configured to perform a method comprising:
receiving a VPN request from a client device within the remote network to establish a VPN connection with the private network;
analyzing local VPN information for VPN information associated with the private network;
determining, based on the analyzing, that the local VPN information fails to comprise VPN information associated with the private network;
establishing a VPN connection with a central system through a public network in response to the local VPN information failing to comprise VPN information associated with the private network, wherein the central system is situated between the first VPN device and a second VPN device in the private network, where the first VPN device is local to the remote network and the second VPN device is local to the remote network;
receiving, from the central system and based on establishing the connection, a set of VPN information associated with at least the second VPN device;
disconnecting, based on the receiving, from the central system; and
establishing, based on the set of VPN information, a site-to-site VPN directly with the second VPN device through the public network, wherein one or more client devices within the remote network communicate with the private network utilizing the site-to-site VPN through the first VPN device.

9. The computer program storage product of claim 8 , wherein the set of VPN information comprises at least VPN tunneling information, and wherein the VPN tunneling information comprises at least one of:
an encryption protocol;
an encryption key;
a hashing algorithm;
an access list; and
a tunneling protocol.

10. The computer program storage product of claim 9 , wherein the set of VPN information further comprises a set of address information, wherein the set of address information comprises at least one of:
an identifier associated with the second VPN device;
an Internet Protocol address associated with the second VPN device; and
a Media Access Control address associated with the second VPN device.

11. The computer program storage product of claim 9 , wherein establishing the VPN comprises:
creating a VPN tunnel directly with the second VPN device based on the set of VPN tunneling information.

12. The computer program storage product of claim 8 , wherein the method further comprises:
storing the set of VPN information in a local memory.

13. The computer program storage product of claim 8 , wherein the method further comprises:
receiving, from at least one peer system in the remote network, a request to establish a VPN with at least one system in the private network; and
sending, a set of VPN information associated with the at least one system in the private network to at least one peer system, wherein the set of VPN information configures at least one peer system to establish a VPN directly with the at least one system in the private network through the public network.

14. The computer program storage product of claim 13 , wherein the set of VPN information associated with at least one system in the private network is obtained from the second VPN device in the private network.

15. An information processing system in a private network for establishing a site-to-site virtual private network (VPN) between the private network and a remote network, the information processing system comprising:
a memory;
a processor communicatively coupled to the memory; and
a first VPN device communicatively coupled to the memory and the processor, wherein the first VPN device is configured to perform a method comprising:
receiving a VPN request from a client device within the remote network to establish a VPN connection with the private network;
analyzing local VPN information for VPN information associated with the private network;
determining, based on the

Assignees

• IBM

Inventors

• Young Charles K
• White Terrence E
• Diggs Melanie R
• Colar Gerald D

Classifications

• H04L12/4691

  GVRP [GARP VLAN registration protocol] · CPC title

• H04L65/1069 Primary

  Session establishment or de-establishment · CPC title

• H04L12/4662

  wherein a VLAN tag represents a service instance, e.g. I-SID in PBB · CPC title

• H04L12/4675

  Dynamic sharing of VLAN information amongst network nodes (configuration of the network or of network elements H04L41/08) · CPC title

• H04L12/4679

  Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership · CPC title