Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular node for directing data and applying cryptography
Reexamination Certificate
1997-06-12
2001-01-09
Barron, Jr., Gilberto (Department: 2767)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular node for directing data and applying cryptography
C713S152000, C709S247000
Reexamination Certificate
active
06173399
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to the field of data communications. More particularly, the present invention relates to techniques for implementing secure virtual private networks over public or otherwise insecure data communications infrastructures.
2. Background
In recent years organizations have come to rely heavily on the ability to transmit electronic data between members of the organization. Such data typically includes electronic mail and file sharing or file transfer. In a centralized, single site organization, these transfers of electronic data are most commonly facilitated by a local area network (LAN) installed and operated by the particular enterprise.
Preventing unauthorized access to data traversing an enterprise's LAN is relatively straightforward. This applies to both unauthorized accesses by members of the enterprise and, more importantly, to third parties on the outside. As long as intelligent network management is maintained, unauthorized accesses to data traversing an enterprise's internal LAN are relatively easily avoided. It is when the enterprise spans multiple sites that security threats from the outside become a major concern.
For distributed enterprises that desire the conveniences of the above-described electronic data transfers, there are several options that exist today, but each with associated disadvantages. The first option is to interconnect the offices or various sites with dedicated, or private communications connections often referred to as leased lines. This is the traditional method organizations use to implement a wide area network (WAN). The disadvantages of implementing an enterprise owned and controlled WAN are obvious: they are expensive, cumbersome and frequently underutilized if they are established to handle the peak capacity requirements of the enterprise. The obvious advantage to this approach is that the lines are dedicated for use by the enterprise and are therefore secure, or reasonably secure from eavesdropping or tampering by intermediate third parties.
An alternative to the use of dedicated communications lines in a wide area network is for an enterprise to handle intersite data distributions over the emerging public network space. Over recent years, the Internet has transitioned from being primarily a tool for scientists and academics to a mechanism for global communications with broad ranging business implications. The Internet provides electronic communications paths between millions of computers by interconnecting the various networks upon which those computers reside. It has become commonplace, even routine, for enterprises, even those in nontechnical fields, to provide Internet access to at least some portion of the computers within the enterprise. For many businesses this facilitates communications with customers, potential business partners as well as the distributed members of the organization.
Distributed enterprises have found that the Internet is a convenient tool to provide electronic communications between members of the enterprise. For example, two remote sites within the enterprise may each connect to the Internet through a local Internet Service Provider (ISP). This enables the various members of the enterprise to communicate with other sites on the Internet including those within their own organization. The limiting disadvantage of using the Internet for intra-enterprise communications is that the Internet is a public network space. The route by which data communication travel from point to point can vary on a per packet basis, and is essentially indeterminate. Further, the data protocols for transmitting information over the various networks of the Internet are widely known, and leave electronic communications susceptible to interception and eavesdropping with packets being replicated at most intermediate hops. An even greater concern arises when it is realized that communications can be modified in transit or even initiated by impostors. With these disconcerting risks, most enterprises are unwilling to subject their proprietary and confidential internal communications to the exposure of the public network space. For many organizations it is common today to not only have Internet access provided at each site, but also to maintain the existing dedicated communications paths for internal enterprise communications, with all of the attendant disadvantages described above.
While various encryption and other protection mechanisms have been developed for data communications, none completely and adequately addresses the concerns raised for allowing an enterprise to truly rely on the public network space for secure intra-enterprise data communications. It would be desirable, and is therefore an object of the present invention to provide such mechanisms which would allow the distributed enterprise to rely solely on the public network space for intra-enterprise communications without concern for security risks that presently exist.
SUMMARY OF THE INVENTION
From the foregoing it can be seen that it would be desirable and advantageous to develop protocols and architecture to allow a single organization or enterprise to rely on the public network space for secure intraorganizational electronic data communications. The present invention is thus directed toward the protocols and architecture for implementing secure virtual private networks over the Internet or other public network apparatuss. The architecture of the present invention introduces a site protector or virtual private network (VPN) unit which moderates data communications between members of a defined VPN group. In accordance with one embodiment of the present invention, the site protector resides on the WAN side of the site's router or routing apparatus which is used to connect the enterprise site to the Internet. In alterative embodiments, the site protector will reside on the LAN side of the router. The essential point for all embodiments is that the site protector be in the path or all relevant data traffic.
To ensure secure data communications between members of the same VPN group, the site protector or VPN Unit implements a combination of techniques for data packet handling when packets are to be sent between members of the group. The packet handling processes include various combinations of compression, encryption and authentication, the rules for each of which may vary for members of different groups. For each group defined as a virtual private network, the various parameters defining the compression, encryption and authentication are maintained in lookup tables in the associated VPN Units. The lookup tables maintain information not only for fixed address members of the group but support is also provided for remote clients. This ability allows remote users to dial into a local Internet Service Provider and still maintain membership in a virtual private network group for secure communications over the Internet with other members of the group. In the case of a remote client, the site protector may, in one embodiment, be simulated by software running on the remote client.
In other aspects of the present invention, the VPN Units or site protectors may be dynamically configured to add or subtract members from the virtual private network group or recognize their movement, or change other parameters affecting the group. Various other packet handling aspects of the invention include addressing the problem of some data packets growing too large by the inclusion of encryption and authentication information. Another packet handling aspect provides a mechanism for Internet communications which hides information identifying the source and destination of the data packet. In this aspect of the present invention, the VPN Units are treated as the source and destination for the Internet communication data packets with the VPN Units encapsulating the source and destination addresses of the endstations.
There is also disclosed a hardware architecture and implementation for a VPN Unit. This embodiment is
Barron Jr. Gilberto
McCutchen Doyle Brown & Enersen LLP
VPNet Technologies, Inc.
LandOfFree
Apparatus for implementing virtual private networks does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Apparatus for implementing virtual private networks, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Apparatus for implementing virtual private networks will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2513538