Dynamic VPN Address Allocation

Abstract

To provide a method and a related system for automatically avoiding address conflict when establishing a safe communication link on a public network between a local computer associated with a local network and a remote computer located outside the local network.SOLUTION: In order to avoid address conflict, an address reserved for use by a local network and an address reserved for use by a remote network are determined. At least one local address is selected from usable local addresses so that the address is an address that does not conflict with the address reserved for the local network or the address reserved for the remote network. The selected local address is used in relation to establishing a safe communication link between the local computer and the remote computer.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] Related Applications This application claims the benefit under 35 U.S.C. § 119 of U.S. Provisional Patent Application No. 61 / 505,754, entitled "Dynamic VPN Address Allocation," filed July 8, 2011, which is hereby incorporated by reference in its entirety for all purposes. [Background technology]

[0002] background Virtual private networks (VPNs) are widely used to secure connections between computers (including computerized devices) and / or computer networks over insecure networks. The insecure networks can be public, private, or a combination of public and private networks. To securely communicate information over such insecure networks, computers often establish a connection, divide the information into data packets, and send the data packets over the network from a source to a destination. Once received at the destination, the information is restored by combining the received data packets in the proper order. The data packets are created using a well-defined format, also known as a protocol, to enable the source and destination computers to successfully pack and unpack the information.

[0003] The Internet Protocol (IP) is the standard protocol often used to send information across most private networks and the public Internet. The Internet community has standardized on two versions of the IP protocol: version 4 (IPv4) and IP version 6 (IPv6). Both versions, IPv4 and IPv6, require that numeric addresses indicating the network locations of the source and destination computers be placed in the header section of each data packet. These numeric addresses are called the source address and destination address.

[0004] Internet Protocol version 4, IPv4, requires four bytes for each source and destination address, with a maximum of two 32 unique addresses. However, this address size does not address the maximum number of network addresses needed and the demands of efficient network routing. This address limitation is often addressed by creating two address categories: public addresses and private addresses. Private addresses are reserved for use within private networks and may be duplicated and used independently by any number of private networks.

[0005] To send data packets from one computer with a private address to another computer over the public Internet, network address translation (NAT) may be used to convert the packets with private addresses into packets with public addresses. Address translation is often performed in a computer that acts as a gateway between the public Internet and the private network. Summary of the Invention

[0006] overview Certain aspects disclosed herein relate to methods and corresponding systems or computer-implemented methods for automatically avoiding address conflicts when establishing a secure communications link over a public network between a local computer associated with a local network and a remote computer associated with a remote network located outside the local network. In some aspects, at least one processor is configured and arranged to: (a) determine addresses reserved for use by the local network and addresses reserved for use by the remote network; (b) select at least one local address from among a plurality of available local addresses, the local address being an address that does not conflict with any of the reserved addresses of the local network or the remote network; and (c) associate the selected local address with respect to establishing the secure communications link between the local computer and the remote computer.

[0007] Some aspects disclosed herein relate to methods and corresponding systems or computer-implemented methods for establishing a virtual private network link over a public network between a first computer associated with a first local network and a second computer associated with a second local network. In some aspects, at least one processor is configured and arranged to automatically generate a new local network address for each of the first computer and the second computer in conjunction with establishing a secure communications link if the local network address would otherwise conflict with other addresses in use on the respective local networks.

[0008] In some aspects, from among a plurality of available remote addresses, at least one remote address may be selected to be an address that does not conflict with a reserved address of the remote network. The selected local address and the selected remote address may be used in connection with establishing a secure communication link. In an aspect, the selected local address may be an address that does not conflict with the selected remote address. In some aspects, the selected remote address may be an address that does not conflict with the selected local address. In some aspects, the selected remote address may be added to the reserved addresses of the local network and removed from the reserved addresses of the local network when the secure connection is terminated. In some aspects, the selected local address may be added to the reserved addresses of the remote network and removed from the reserved addresses of the remote network when the secure connection is terminated.

[0009] Some aspects disclosed herein relate to methods and corresponding systems or computer-implemented methods for providing a domain name service for establishing a secure communications link over a public network between at least two computers, at least one of which is connected to a local network. In some aspects, the domain name service system is configured to (a) connect to a communications network, (b) indicate whether the domain name service supports the establishment of a secure communications link, (c) assign an address to each of the computers for use in establishing the secure communications link between the two computers, and (d) use a different address for each of the computers for use in establishing the secure communications link if the assigned address conflicts with an address associated with the local network to which the computers are connected or with an address associated with a third computer on an existing secure communications link to which at least one of the first two computers is connected.

[0010] Certain aspects disclosed herein relate to a method and corresponding system or computer-implemented method for providing a domain name service for establishing secure communication links between at least one computer connected to a local network and each of a plurality of computers connected to a second local network so as to provide secure communications over a public network. In one aspect, the domain name service system (a) is connected to the communication network, (b) indicates whether the domain name service supports the establishment of secure communication links, and (c) is configured to assign addresses to each of the computers for use in establishing the secure communication links between the one computer and each of the plurality of computers such that each address assigned to each of the computers does not conflict with addresses already associated with the local network to which each computer is connected.

[0011] Certain aspects disclosed herein relate to methods and corresponding systems or computer-implemented methods for communicating between a local computer and a remote computer. In some aspects, multiple addresses are selected at the local computer for use in communicating with the remote computer. The selected addresses are addresses other than existing addresses currently in use by the local computer and devices connected to the local computer. One address of the selected multiple addresses is verified against existing addresses currently in use by the remote computer and devices connected to the remote computer, and if the address is not in use by the remote computer, the address is used to communicate between the local computer and the remote computer.

[0012] In some aspects, the selected local address may be used to address the local computer when establishing a secure communications link. In some aspects, the selected local address may include an Internet Protocol (IP) address. In certain aspects, the selected local address may include an IP address and a network mask. The selected local address may be generated from a table configured to include multiple available local addresses. The selected local address may be generated randomly or pseudo-randomly.

[0013] In some aspects, at least one remote address can be selected from among a plurality of available remote addresses, the selected remote address can be an address that does not conflict with a reserved address of the remote network, and the selected local address and the selected remote address can be used in connection with establishing a secure communications link.

[0014] Additionally, the selected local address and the selected remote address may be used to address the local computer and the remote computer, respectively, when establishing a secure communications link. In some aspects, both the selected local address and the selected remote address may be stored as a pair and reused each time a secure communications link is established between the local computer and the remote computer.

[0015] In some aspects, the secure communication link may be a virtual private network (VPN) link. In some aspects, the secure communication link may be a host-to-host connection. In some aspects, the secure communication link may be a host-to-network connection. In some aspects, the secure communication link may be a network-to-network connection.

[0016] In some aspects, the plurality of available local addresses may be configured to include a set of unused local addresses, and the selected local address may be generated according to the set of unused local addresses.

[0017] In some aspects, the processor may be configured and arranged to associate each local address with a session initiation protocol used to establish a secure communications link between the local computer and the remote computer. In some aspects, the processor may be configured and arranged to generate the local address as part of the session initiation protocol used to establish a secure communications link between the local computer and the remote computer.

[0018] In one aspect, the association of each generated local address and the establishment of a secure communication link can be in response to a request for a domain name. In one aspect, the association of each generated private address and the establishment of a secure communication link can be in response to a request for a secure domain name.

[0019] In one aspect, the remote computer may be associated with a second local network and may be assigned a second local address that does not conflict with a local address already in use on the second local network. Both the local address assigned to the local computer and the second local network address assigned to the remote computer may be used to enable routing of communications between the local computer and the remote computer over a secure communications link.

[0020] In some aspects, the processor may be configured and arranged to generate a plurality of local addresses for a corresponding number of local computers associated with the local network. In some aspects, the processor may be configured and arranged to generate the plurality of local addresses as part of a session initiation protocol associated with establishing a secure communications link between the remote computer and each of the corresponding local computers.

[0021] In an aspect, the secure communication link may be established in response to a request for an address corresponding to a domain name. In an aspect, the secure communication link may be established in response to a request for an address corresponding to a secure domain name.

[0022] In some aspects, the domain name service may be configured to use different addresses when establishing secure communications links between a computer and at least each of the plurality of computers when an address assigned to the computer conflicts with an address already associated with the local network to which the computer is connected, by using a different address for each computer of the plurality of computers with which a conflict exists.

[0023] In some aspects, the domain name service may be configured to use a different address for any of a plurality of computers by reassigning a different address for all of the computers if the address assigned to any of the plurality of computers conflicts with an address already associated with the local network to which the computer is connected. [The present invention 1001] 1. A system for automatically avoiding address conflicts when establishing a secure communications link over a public network between a local computer associated with a local network and a remote computer located outside the local network and associated with a remote network, comprising: (a) determining addresses reserved for use by the local network and addresses reserved for use by the remote network; (b) selecting at least one local address from among a plurality of available local addresses, the local address being an address that does not conflict with the reserved addresses of the local network or the reserved addresses of the remote network; and (c) associating the selected local address with respect to establishing the secure communications link between the local computer and the remote computer. At least one processor constructed and arranged to Including, the system. [The present invention 1002] The system of the present invention 1001, wherein the selected local address is used to address the local computer when establishing the secure communications link. [The present invention 1003] The system of the present invention 1001, wherein at least one remote address is selected from a plurality of available remote addresses, the selected remote address being an address that does not conflict with the reserved addresses of the remote network or the reserved addresses of the local computer; and the selected local address and the selected remote address are used in connection with establishing the secure communication link. [The present invention 1004] The system of the present invention 1003, wherein the selected local address is an address that does not conflict with the selected remote address. [The present invention 1005] The system of the present invention 1003, wherein the selected remote address is an address that does not conflict with the selected local address. [The present invention 1006] The system of the present invention 1003, wherein the selected remote address is added to the reserved addresses of the local network. [The present invention 1007] The system of the present invention 1006, wherein the selected remote address is removed from the reserved addresses of the local network when the secure connection is terminated. [The present invention 1008] The system of the present invention 1003, wherein the selected local address is added to the reserved addresses of the remote network. [The present invention 1009] The system of the present invention 1008, wherein the selected local address is excluded from the reserved addresses of the remote network when the secure connection is terminated. [The present invention 1010] The system of the present invention 1003, wherein the selected local address and the selected remote address are used to address the local computer and the remote computer, respectively, when establishing the secure communications link. [The present invention 1011] The system of the present invention 1002, wherein the selected local address and the selected remote address are both stored as a pair and reused each time a secure communication link is established between the local computer and the remote computer. [The present invention 1012] The system of the present invention 1001, wherein the secure communication link is a virtual private network (VPN) link. [The present invention 1013] The system of the present invention 1001, wherein the selected local address includes an Internet Protocol (IP) address. [The present invention 1014] The system of the present invention 1001, wherein the selected local address includes an IP address and a network mask. [The present invention 1015] The system of the present invention 1001, wherein the selected local address is generated from a table configured to include a plurality of available local addresses. [The present invention 1016] The system of the present invention 1001, wherein the selected local address is pseudo-randomly generated. [The present invention 1017] The system of the present invention 1001, wherein the plurality of available local addresses is configured to include a set of unused local addresses, and the selected local address is generated according to the set of unused local addresses. [The present invention 1018] The system of the present invention 1001, wherein the processor is configured and arranged to associate each local address with a session initiation protocol used to establish the secure communications link between the local computer and the remote computer. [The present invention 1019] The system of the present invention 1001, wherein the processor is configured and arranged to generate the local address as part of a session initiation protocol used to establish the secure communications link between the local computer and the remote computer. [The present invention 1020] The system of the present invention 1001, wherein the association of each generated local address and the establishment of the secure communication link is in response to a request for a domain name. [The present invention 1021] The system of the present invention 1001, wherein said association of each generated private address and said establishment of the secure communication link is in response to a request for a secure domain name. [The present invention 1022] The system of the present invention 1001, wherein the remote computer is associated with a second local network and is assigned a second local address that does not conflict with a local address already in use on the second local network, and both the local address assigned to the local computer and the second local network address assigned to the remote computer are used to enable routing of communications between the local computer and the remote computer over the secure communications link. [The present invention 1023] The system of the present invention 1001, wherein said processor is constructed and arranged to generate a plurality of local addresses for a corresponding number of local computers associated with said local network. [The present invention 1024] The system of the present invention 1023, wherein the processor is configured and arranged to generate the multiple local addresses as part of a session initiation protocol associated with establishing the secure communications link between the remote computer and each corresponding local computer. [The present invention 1025] The system of the present invention 1023, wherein a network address translator is used to translate between the generated local address used for the secure communications link and the local private address of a computer on the local network. [The present invention 1026] The system of the present invention 1024, wherein the secure communications link is established in response to a request for an address corresponding to a domain name. [The present invention 1027] The system of the present invention 1024, wherein the secure communications link is established in response to a request for an address corresponding to a secure domain name. [The present invention 1028] The system of the present invention 1001, wherein the secure communication link is a host-to-host connection. [The present invention 1029] The system of the present invention 1001, wherein the secure communication link is a host-to-network connection. [The present invention 1030] The system of the present invention 1001, wherein the secure communication link is an inter-network connection. [The present invention 1031] 1. A system for establishing a virtual private network link over a public network between a first computer associated with a first local network and a second computer associated with a second local network, comprising: at least one processor configured and arranged to automatically generate a new local network address for each of the first and second computers, in conjunction with establishing a secure communications link, if the local network address would otherwise conflict with other addresses in use on the respective local networks; Including, the system. [The present invention 1032] The system of the present invention 1031, wherein the new local network address generated is pseudo-randomly generated. [The present invention 1033] The system of the present invention 1031, wherein the new local network address generated includes an IP address. [The present invention 1034] The system of the present invention 1031, wherein the new local network address generated is generated from a table configured to include a plurality of available local addresses that do not conflict with addresses already in use by the first computer and the second computer. [This invention 1035] 1. A system for providing a domain name service for establishing a secure communications link over a public network between at least two computers, at least one of which is connected to a local network, the system comprising: (a) connected to a communications network; (b) indicating whether the domain name service supports the establishment of secure communications links; (c) assigning an address to each of the computers for use in establishing the secure communications link between the two computers; and (d) using a different address for each of the computers for use in establishing the secure communications link if the assigned address conflicts with an address associated with the local network to which the computers are connected. A domain name service system configured as follows: Including, the system. [The present invention 1036] 1. A system for providing a domain name service for establishing a secure communications link between at least one computer connected to a local network and each of a plurality of computers connected to a second local network so that secure communications can be provided over a public network, comprising: (a) connected to a communications network; (b) indicating whether the domain name service supports the establishment of secure communications links; and (c) assigning an address to each of the computers for use in establishing the secure communications link between the one computer and each of the plurality of computers such that each assigned address does not conflict with addresses already associated with the local network to which each computer is connected. A domain name service system configured as follows: Including, the system. [This invention 1037] The system of the present invention 1036, wherein the domain name service is configured to use different addresses when establishing a secure communications link between the one computer and at least each of the plurality of computers if an address assigned to the computer conflicts with an address already associated with the local network to which the computer is connected, by using a different address for each computer of the plurality of computers with which a conflict exists. [The present invention 1038] The system of the present invention 1037, wherein the domain name service is configured to use a different address for any of the plurality of computers by reassigning a different address to all of the plurality of computers if the address assigned to any such computer conflicts with an address already associated with the local network to which the computer is connected. [This invention 1039] 1. A method for communicating between a local computer and a remote computer, the method comprising the steps of: selecting, at the local computer, a plurality of addresses for use in communicating with the remote computer, the addresses being other than existing addresses currently in use by the local computer and devices connected to the local computer; verifying the selected address against existing addresses currently in use by the remote computer and devices connected to the remote computer; and If the verified address is not in use by the remote computer, then using the address to communicate between the local computer and the remote computer. [The present invention 1040] The method of claim 1039 further comprising the step of communicating between said local computer and said remote computer over a secure communications link. [This invention 1041] The method of claim 1040, wherein the secure communication link is a virtual private network (VPN) link. [The present invention 1042] The method of claim 1039, wherein the address to be verified comprises an IP address. [This invention 1043] The method of claim 1039, wherein the address to be verified includes an IP address and a network mask. [Brief explanation of the drawings]

[0024] The drawings illustrate by way of example, and not by way of limitation, one or more embodiments in accordance with the teachings of the present invention.In the drawings, like reference numerals indicate the same or similar elements.

[0025] [Figure 1] 1 is a diagram of a typical architecture used by many existing virtual private networks to enable automatic routing. [Figure 2] Figure 2A is a table containing example address assignments for a network driver that may be used with some aspects disclosed herein. Figure 2B is a routing table for the example address assignments shown in Figure 2A. [Figure 3A] 1 is a table containing three example private address blocks and their corresponding network masks. [Figure 3B] 3B is a flow diagram of a procedure for negotiating private VPN address pairs using the private address blocks shown in FIG. 3A according to an aspect disclosed herein. [Figure 4] 1 is a flow diagram for assigning virtual network driver IP address parameters according to an aspect disclosed herein. [Figure 5] 1 is a flow diagram for selecting a non-conflicting private VPN address pair according to an aspect disclosed herein. [Figure 6A]FIG. 1 is a diagram for determining a maximum address block size that may be used in address negotiation, according to an aspect disclosed herein. [Figure 6B] 1 is a flow diagram for determining a maximum address block size that may be used in address negotiation according to an aspect disclosed herein. [Figure 7] 1 is a flow diagram for generating non-conflicting private address pairs according to an aspect disclosed herein. [Figure 8] FIG. 1 is a block diagram of a virtual private network using network address translation equipment. [Figure 9] Figure 9A illustrates a network architecture in which a local computer's equipment communicates with a remote computer's equipment via a virtual private network, Figure 9B illustrates a network architecture in which the local computer uses network address translation equipment, and Figure 9C illustrates a network architecture in which both the local computer and the remote computer use corresponding network address translation equipment. [Figure 10] 1 is a flow diagram for selecting a network mask address according to an aspect disclosed herein. [Figure 11] 1 is a flow diagram of a procedure for selecting non-conflicting private network mask address blocks. [Figure 12] 1 is a flow diagram of a procedure for selecting a non-conflicting pair of network addresses according to an aspect disclosed herein. DETAILED DESCRIPTION OF THE INVENTION

[0026] Detailed Description In the following detailed description, by way of example, numerous specific details are set forth in order to provide a thorough understanding of the relevant teachings. However, it will be apparent to those skilled in the art that the teachings of the present invention may be practiced without such details. In some instances, well-known methods, procedures, components, and / or circuitry have been described at a relatively high level in order to avoid unnecessarily obscuring aspects of the teachings of the present invention.

[0027] It is understood that other configurations of the present technology will become readily apparent to those skilled in the art upon reading the following detailed description, which shows and describes, by way of example, various configurations of the present technology. As will be understood upon reading the following, the present technology is susceptible to other different configurations, and its several details are susceptible to modification in various other respects, all without departing from the scope of the present technology. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not restrictive.

[0028] Techniques for establishing secure communications, and procedures associated with those techniques, are described in U.S. patent application Ser. No. 10 / 702,522, filed Nov. 7, 2003, now Patent No. 6,839,759, U.S. patent application Ser. No. 10 / 714,849, filed Nov. 18, 2003, now Patent No. 7,418,504, U.S. patent application Ser. No. 13 / 285,962, filed Oct. 31, 2011, and U.S. patent application Ser. No. 13 / 336,790, filed Dec. 23, 2011, the teachings of which are incorporated herein by reference in their entireties.

[0029] A virtual private network (VPN) may be used to provide communication security by encrypting information data packets before transmitting the data over a network and decrypting the transmitted information at the destination source. A VPN may also encapsulate and encrypt private source and destination addresses to provide anonymity, allowing private addressing to be used at each terminal so that communicating computers on the source and destination local networks, respectively, are uniquely identified.

[0030] Virtual private network packets typically utilize unencrypted VPN packet source and destination addresses, which are typically externally visible addresses on the public network and are used by external network routers to forward the packets and ultimately deliver them to the intended destination computer.

[0031] Additionally, VPN networks enable machine-to-machine VPN security using encapsulated private addresses, which provides device-level security resulting in automatic routing of all IP packets destined for the computer at the far end of the VPN connection through the VPN, regardless of the computer application that creates and uses IP sockets.

[0032] Coordinating the allocation of non-conflicting private address blocks capable of supporting a large number of simultaneous VPN connections poses a significant challenge to network administrators, as such coordination requires the network administrators of each VPN site to agree on private address ranges that are consistent with each site's existing network configuration and do not conflict with other network sites. Further complicating this situation is the possibility that other computers may use the same private addresses to connect to different private networks, obscuring packet addressing. Therefore, a more transparent, automated approach to private address allocation is desirable.

[0033] VPNs often use IP addressing to allow computers on the VPN to route packets through an encrypted tunnel from one computer on the VPN to another computer on the VPN. These secure IP addresses must be allocated and assigned to the computers involved before or when the VPN connection is established. Address allocation must be done to avoid routing conflicts with existing or reserved network addresses. Address allocation may be done at the time of VPN server equipment setup by selecting private address blocks that are known to conflict, or at least unlikely to conflict, with the computer addresses involved. This can be done fairly reliably for semi-static applications, such as a corporate VPN server for employee roaming computers.

[0034] However, in more dynamic scenarios where a computer sets up and disconnects VPN connections to multiple computers and / or computer networks, proactively selecting and managing safe, non-conflicting IP addresses becomes difficult. As the number of computers involved and the number of simultaneous connections increases, this selection and management problem also grows exponentially. The present invention provides a unique and effective approach to solving this problem without requiring exponentially increasing computational processing.

[0035] Figure 1 illustrates an architecture that may be used to enable automatic routing. As shown in Figure 1, a VPN is implemented by creating a virtual network device driver. As shown in Figure 1, a local computer 10 is configured to run programs and includes an application layer 14 and an operating system layer 16. The application layer 14 includes a VPN module 20 and one or more applications 22 used to create data packets to be sent over the VPN. The operating system layer 16 includes an operating system IP stack 24 configured to deploy data generated by the applications 22.

[0036] Operating system packet router 26, via virtual network driver 28, assembles and encrypts data (unencrypted data packet A) according to a protocol (not shown) established by VPN module 20. The encrypted data packet (data packet B) is sent by real network driver 30 over the VPN connection via network 32 to remote computer 34.

[0037] 1 , in one embodiment, unencrypted data packet A is transmitted by VPN module 20, application 22, operating system IP stack 24, operating system packet router 26, and virtual network driver 28. The transmitted unencrypted data packet A is encrypted between operating system packet router 26 and real network driver 30 to form encrypted packet B. The encrypted data packet B is transmitted by real network driver 30 over network 32 to remote computer 34. Both unencrypted data packet A and encrypted data packet B are transmitted between operating system IP stack 24 and operating system packet router 26.

[0038] The output of the real network driver 30 includes private addresses and a routing address block (not shown), which contains the destination addresses associated with the VPN.

[0039] In one aspect, unencrypted private network packets A originate, for example, from the network socket code of application 22 and are routed to virtual network driver 28. Virtual network driver 28 forwards these packets to VPN module 20. VPN module 20 encrypts these packets A and creates encrypted packets B with a public address. Encrypted packets B are routed through operating system packet router 26 to real network driver 30 for transmission across network 32.

[0040] Encrypted incoming packets (not shown) arriving from a remote computer 34 are routed through the real network driver 30 to the VPN module 20 for decryption, and after being decrypted, are ultimately routed to the application 22.

[0041] The operating system packet router 26 makes the appropriate routing decisions based on the destination addresses found in packets A and B coming from the operating system IP stack 24. The destination addresses may be checked against a routing table, which may be based on network parameters specified for each network device.

[0042] In an aspect, multiple simultaneous VPNs may be supported by configuring VPN module 20 to associate different private destination addresses with different public destination addresses and corresponding encryption keys.

[0043] Coordinating the allocation of private address blocks to support a large number of simultaneous VPN connections without conflicting addresses presents a significant challenge to network administrators. This requires the network administrators of each VPN site to agree on a private address range that is consistent with their existing network configuration and does not conflict with other network sites.

[0044] 2A is a table containing example address assignments for network drivers that may be used with certain aspects disclosed herein. In the example shown in FIG. 2A, an IP address block typically used by small networks, i.e., 192.168.0.0, is used to establish communications. For example, real network driver 30 (shown in FIG. 1) uses an IP address of 192.168.0.21, a gateway (not shown) for real network driver 30 uses an IP address of 192.168.0.1, and virtual network driver 28 (shown in FIG. 1) uses an IP address of 192.168.3.23. Network mask 255.255.255.0 is a network mask typically used with the 192.168.0.0 block.

[0045] If a computer requests to establish a VPN connection with two or more other computers using this address block (i.e., 192.168.0.0), routing conflicts can arise. Routing can become even more complicated if other computers connected to other private networks use the same private address block (i.e., 192.168.0.0).

[0046] Figure 2B is a routing table for the address assignment example shown in Figure 2A. As shown in Figure 2B, packets with addresses in the range 192.168.3.0 through 192.168.3.255 are routed to virtual network driver 28, and packets with addresses in the range 192.168.0.0 through 192.168.0.255 are routed to real network driver 30. All other packets are sent through real network driver 30 to the local gateway computer at 192.168.0.1.

[0047] Based on the address ranges shown in Figure 2B, to avoid addressing conflicts, the private VPN addresses that remote computer 34 can use must be in the range from 192.168.3.0 to 192.168.3.254, excluding 192.168.3.23. Therefore, a conflict can occur if the virtual network driver address on remote computer 34 does not correspond to the address block 192.168.3.*. In addition, a conflict can occur if the remote computer uses IP address 192.168.3.23 or is in an existing VPN that uses IP address 192.168.3.23. The likelihood of such a conflict increases as the number of computers involved increases.

[0048] Certain aspects disclosed herein prevent addressing conflicts by allocating a block of private addresses available to a local computer that do not conflict with the local computer's local private address block for use in generating possible private addresses for use by virtual network driver 28. For example, in some aspects, the largest block of private addresses available to the local computer that do not conflict with the local computer's local private address block may be allocated. An IP address is selected (e.g., randomly) from the allocated address block, and the selected IP address and its corresponding network mask are associated with virtual network driver 28.

[0049] In some embodiments, the selected addresses and network masks may be used to propose possible private addresses during VPN setup negotiations between the local computer 10 and the remote computer 34. For example, the remote computer 34 may have a set of similarly generated addresses and their corresponding network masks and select a matching address / network mask pair that allows both ends (i.e., the local computer 10 and the remote computer 34) to route private addresses through their respective virtual network drivers 28 without conflicts.

[0050] FIG. 3A is a table containing three example private address blocks and their corresponding network masks.

[0051] Typically, each IP address contains four octets, and each octet in an IP address is represented by eight bits. For example, in the IP address 192.168.0.0, the first octet is set to 192, the second octet is set to 168, the third octet is set to 0, and the fourth octet is also set to 0.

[0052] Each octet value is a decimal number representing a binary value, and each binary value may contain eight bits, each of which may be set to either 0 or 1. If a bit is set to 1, it is considered active; if it is set to 0, it is considered inactive. In the above example, the value of the first octet, 192, can be calculated using the following eight numbers: 128, 64, 32, 16, 8, 4, 2, and 1, resulting in a binary value of 11000000. Because the binary value 1100000 sets only the first two bits as active, only the first two of the eight values used to define the first octet are used to calculate the octet value, giving this octet a value of 128 + 64 = 192.

[0053] To accommodate different network sizes, the IP address space is divided into three sections: Class A, which covers IP addresses ranging from (0.xxx) to (126.xxx), Class B, which covers IP addresses ranging from (128.xxx) to (191.xxx), and Class C, which covers IP addresses ranging from (192.xxx) to (253.255.255.255).

[0054] As shown in FIG. 3A, private network address blocks 192.168.0.0, 172.16.0.0, and 10.0.0.0 have network masks 255.255.0.0, 255.240.0.0, and 255.0.0.0, respectively, and are often used by private networks.

[0055] 3B is a flow diagram of a procedure for negotiating a private VPN address pair according to certain aspects disclosed herein. In some aspects, the private address pair may be selected from among the private address blocks shown in FIG. 3A.

[0056] 3B, negotiation of a private VPN address pair may begin at the local computer 10 end by allocating 305 a block of private addresses available to the local computer 10 that do not conflict with existing private address blocks of the local computer 10. Once allocated, the private address block is used to generate 305 several private addresses that are assigned to the virtual network driver 28 (shown in FIG. 1) of the local computer 10. Similarly, at the remote computer side 34, a block of private addresses available to the remote computer 34 that do not conflict with existing private address blocks of the remote computer 34 is allocated and used to generate 310 several private addresses that are assigned to the virtual network driver (not shown) of the remote computer 34.

[0057] In some aspects, the private addresses assigned to the virtual network drivers may be randomly generated from a range of allocated addresses. In some aspects, the private addresses assigned to the virtual network drivers may be pseudo-randomly generated. In some aspects, the private addresses assigned to the virtual network drivers may be selected from a list of available private addresses. For example, in some aspects, the allocated addresses may be arranged sequentially, and a numbering service (not shown) may select the first address in the sequence and assign the selected address to the virtual network driver. The local computer 10 and the remote computer 34 may use similar or different selection schemes to select addresses for assignment to their respective virtual network drivers.

[0058] Address negotiation begins on the local computer 10 side, 315, and the local computer assigns a non-conflicting address, ip_rand loc and their corresponding network masks mask_max locto the remote computer 34. As previously mentioned, non-conflicting addresses may be selected from among the addresses in the allocated block using various selection methods known in the art. For example, in one aspect, non-conflicting addresses may be randomly generated.

[0059] At the remote computer 34 side, the remote computer waits 320 for the address negotiation procedure to begin. Address negotiation begins after the remote computer 34 receives the addresses forwarded by the local computer 10. After receiving the addresses, the remote computer 34 examines the received addresses to determine whether any of the addresses conflict with addresses already in use by the remote host 34, and selects a non-conflicting address pair from among the addresses that do not conflict with its existing addresses. loc and ip rem Select 330.

[0060] The remote computer 34 receives the selected address vs. loc and ip rem to the local computer 10. The local computer 10 accepts 335 the address pair forwarded by the remote computer 34 and creates and initiates 345 a VPN session using the address pair. The remote computer 34 also creates and initiates 350 a new VPN session using the selected address pair.

[0061] 4 is a flow diagram for assigning IP address parameters for a virtual network driver according to certain aspects disclosed herein. A procedure for assigning IP address parameters for a virtual network driver begins 410 by initializing 420 one or more address vector pairs for use with aspects described herein. The address vector pair may include one or more blocks of private addresses and their corresponding network masks. For example, in certain aspects, an address block pair may be used to initialize the address vector pair as follows: IP allocated ={IP Block0, IP Block1, ... ,IP Block k} Mask allocated ={Mask Block0, Mask Block1, ..., Mask Block k}

[0062] For example, in one aspect, the address block pair shown in FIG. 3A may be used to initialize the address vector pair as follows: IP allocated ={191.168.0.0, 172.16.0.0, 10.0.0.0} Mask allocated ={255.255.0.0, 255.240.0.0, 255.0.0.0}

[0063] After the address blocks are initialized 420, the computer (local computer 10 and / or remote computer 34) determines whether any addresses in the initialized address vector are conflicting addresses. Specifically, in some aspects, the computer may determine 430 all private address blocks in local use and reserve those private address blocks already in use for local use by the computer. In some aspects, the computer may maintain a vector of reserved address blocks and their associated network masks, for example: IP reserved ={IP reserved_0 , IP reserved_1 , ...., IP reserved_k-1} Mask reserved ={Mask reserved_0 , Mask reserved_1 , .... , Mask reserved_k-1}

[0064] The maximum address block size that can be used in address negotiation can be determined 440 by finding the largest address block from the addresses in the initialized address vector that does not contain any addresses that conflict with addresses already in use by the computer. Specifically, addresses are selected from the addresses in each initialized address block such that they do not overlap with addresses in the reserved address vector. Specifically, addresses are selected from the addresses in each initialized address block such that they do not overlap with addresses in the reserved address vector. selected ) is chosen to satisfy the following form: TIFF0007724272000001.tif5128. For example, suppose k=0, 1, ..., n, where n is a finite number, then the maximum address block size of the IP address field and the network mask field, selected_MAX_k and Mask selected_MAX_k may be found as follows, respectively: TIFF0007724272000002.tif12149.

[0065] Therefore, Mask selected_k Mask allocated_k is a subset of Mask reserved_k Do not overlap with any other blocks. Similarly, selected_k Also, IP allocated_k is a subset of IP reserved_k Does not overlap blocks.

[0066] A number of addresses (e.g., private addresses) are selected from the largest address block and assigned to the virtual network drivers of the local and remote computers 450. In some aspects, the addresses may be selected randomly. In some aspects, the addresses may be selected pseudo-randomly. Other selection schemes known in the art may also be used.

[0067] For example, in some aspects, assuming k=0, 1, . . . , n, for each k, where n is a finite number, an address may be selected (eg, randomly) according to the following format: {IP selected_k &Mask selected_k}= (IP selected_MAX_k &Mask selected_MAX_k )|rand|~(IP selected_MAX_k &Mask selected_MAX_k ) where rand is a randomly generated 32-bit value, & is the bitwise AND operator, | is the bitwise OR operator, and ~ is the bitwise NOT operator. selected_k &Mask selected_k} Address blocks are assigned to virtual network drivers.

[0068] 5 is a flow diagram for selecting a non-conflicting private VPN address pair according to certain aspects disclosed herein. In some aspects, address negotiation may begin by initializing an index value k, for example, by setting the value of k to 0 (i.e., k=0) 501. The value of k is determined by the maximum address block size k. max 510 to be examined against.

[0069] k≧k max If so, a new non-conflicting private address pair is generated 515. The generated non-conflicting private address pair is used by the virtual network driver (IP selected_local_k ) and assigns it to the virtual network driver (IP selected_remote_k The generated address, i.e., IP selected_local_k and IP selected_remote_k is assigned 530 as a non-conflicting address that can be used to establish communications between the local computer and the remote computer.

[0070] k≦k max In this case, the address negotiation procedure described herein is performed by negotiating the kth selected IP address block of the local computer, i.e., IP selected_local_k is within the set of available addresses of the remote computer (e.g., if the address is in use by the remote computer or a device associated with the remote computer, the address is unavailable) 525. Specifically, the address negotiation procedure involves: IP selected_local_k ∈{IP rand_rem_k , Mask max_rem} where {IP rand_rem_k , Mask max_rem_k} is the kth available address block of the remote computer.

[0071] The kth selected IP address block IP of the local computer selected_local_k is determined not to be within the set of available addresses of the remote computer, the value of the index k is reset, for example, by setting k=k+1, and the maximum address block size k is again set. max 510. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0072] However, if it is determined that the kth selected IP address block of the local computer is included in the set of available addresses of the remote computer, the address negotiation procedure described herein continues by assigning the kth selected IP address block of the remote computer, i.e., IP selected_remote_k is within the local computer's set of available addresses (e.g., if the address is in use by the local computer or a device associated with the local computer, the address is unavailable) 535. Specifically, the address negotiation procedure involves: IP selected_remote_k ∈{IP rand_loc_k , Mask max_loc_k} where {IP rand_loc_k , Mask max_loc_k} is the kth available address block of the local computer.

[0073] kth selected IP address block IP of remote computer selected_remote_k If it is determined that k is not within the local computer's available address set, the value of index k is reset, for example, by setting k=k+1, and k is again set to the maximum address block size. maxAfter the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0074] However, if it is determined that the kth selected IP address block of the remote computer is included in the set of available addresses of the local computer, the address negotiation procedure described herein continues by assigning the kth selected IP address block of the local computer, i.e., IP selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k 540. Specifically, in some aspects, the procedure IP selected_local_k !=IP selected_remote_k where the operator ! is the logical "not" operator.

[0075] The kth selected IP address block IP of the local computer selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k (i.e., IP selected_local_k !=IP selected_remote_k is false), the value of the index k is reset, for example, by setting k=k+1, and the maximum address block size k is again set. max 510. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0076] However, the kth selected IP address block IP of the local computer selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k is not the same as (i.e., IP selected_local_k!=IP selected_remote_k is true), the address negotiation procedure described herein continues by assigning the kth selected IP address block of the local computer, i.e., IP selected_local_k , belongs to a set defined by all reserved addresses of the local computer (i.e., addresses used by the local computer or equipment associated with the local computer) and all reserved addresses of the remote computer (i.e., addresses used by the remote computer or equipment associated with the remote computer) 550. In addition, the address negotiation procedure described herein continues by determining whether the kth selected IP address block of the remote computer, i.e., IP selected_remote_k It also determines whether , belongs to the set defined by all reserved addresses of the local computer (i.e., addresses in use by the local computer or equipment associated with the local computer) and all reserved addresses of the remote computer (i.e., addresses in use by the remote computer or equipment associated with the remote computer). Specifically, the procedure Determine whether the file is TIFF0007724272000003.tif21128.

[0077] The kth selected IP address block IP of the local computer selected_local_k is the set defined by reserved VPN addresses (i.e., the set defined by all reserved addresses of the local computer and all reserved addresses of the remote computer {IP reserved_local , IP reserved_remote}), that is, If TIFF0007724272000004.tif6128 is determined to be false, or if the kth selected IP address block of the remote computer is selected_remote_kis the set defined by reserved VPN addresses (i.e., the set defined by all reserved addresses of the local computer and all reserved addresses of the remote computer {IP reserved_local , IP reserved_remote}), that is, If TIFF0007724272000005.tif6128 is determined to be false, the value of the index k is reset, for example, by setting k=k+1, and the maximum address block size k is again set. max 510. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0078] However, the kth selected IP address block IP of the local computer selected_local_k is determined not to belong to the set defined by the reserved VPN addresses (i.e., TIFF0007724272000006.tif6128 is determined to be true), and the kth selected IP address block IP of the remote computer selected_remote_k is determined not to belong to the set defined by the reserved VPN addresses (i.e., TIFF0007724272000007.tif6128 is determined to be true), the address negotiation procedure described herein continues with the IP selected_local_k and IP selected_remote_k as a non-conflicting address that can be used to establish communications between the local computer and the remote computer 530 .

[0079] 6A is a flow diagram for determining a maximum address block size that may be used in address negotiation according to an aspect disclosed herein. As previously mentioned, a starting address start is determined for use in establishing a VPN connection. k and the end address endk An address block having the address 192.168.0.0 or 255.255.0.0 may be allocated 610. For example, in some embodiments, the address block 192.168.0.0 or 255.255.0.0 may be allocated. The allocated address block may include some overlapping addresses currently in use by computers (e.g., local computer 10 and remote computer 34) and their associated devices. These overlapping addresses are identified 620. The remaining addresses (i.e., non-conflicting addresses) are also identified 630. From the identified non-conflicting IP addresses, the largest block of non-conflicting addresses may be identified 640. The identified largest block may be selected as the largest block. In some embodiments, a portion of the identified largest block may be selected, provided that the selected portion is larger than the other non-conflicting blocks. In some embodiments, the selection of the address block may be made by restricting the address block that may be defined by an IP address and a corresponding routing network mask. Such a network mask is generally defined as follows: mask=~(2 n -1), where 2≦n≦32 and the ~ operator is the one's complement of a 32-bit integer. In this case, start=ip&mask and end=start+(2 n -1), which means that any and all IP addresses (addr) in this block will satisfy addr&mask=ip&mask.

[0080] 6B is a flow diagram for determining a maximum address block size that may be used in address negotiation according to certain aspects disclosed herein. As previously described, to determine the maximum address block size, an initial private address block is first selected 610. Reserved address blocks include addresses already in use by computers (e.g., local computer 10 and remote computer 34) and their associated devices. Available address blocks are then identified by determining blocks of the initially selected private address blocks that are not already occupied by reserved address blocks. In certain aspects, the available address blocks may be determined by determining the intersection of the initial address block and the reserved address blocks and subtracting the set resulting from the intersection from the initial address block set. Specifically, Available IP Addresses = Initial IP Address - (Initial IP Address ∩ Reserved IP Addresses) where ∩ is the intersection operator.

[0081] The largest address block may be obtained by comparing the IP address blocks among the available IP address blocks and selecting the largest block 640 .

[0082] 7 is a flow diagram for generating non-conflicting private address pairs according to certain aspects disclosed herein. To determine non-conflicting address pairs for both the local computer 10 (FIG. 1) and the remote computer 34 (FIG. 1), certain aspects disclosed herein may determine 710 the largest private address block common to the local computer 10 and the remote computer 34. An address pair may be selected 720 from among addresses included in the common address block. In certain aspects, the address pair may be randomly selected from among addresses included in the common address block. In certain aspects, the address pair may be pseudo-randomly selected from among addresses included in the common address block. In some aspects, the selected addresses may be selected sequentially from among a list of addresses included in the common address block. Other selection schemes known in the art may also be used.

[0083] After an address pair is selected from among the addresses contained in the common address block, the selected address pair is checked against addresses already in use by the virtual private network to determine whether they are already in use (i.e., whether they are reserved addresses) 730. For example, the addresses may be verified as follows: TIFF0007724272000008.tif6155, IP selected_local represents the address selected for the local computer, and IP selected_remote represents the address selected for the remote computer, and the IP reserved_local represents an address reserved by the local computer, and reserved_remote represents an address reserved by a remote computer, and & is the logical "and" operator.

[0084] If the selected address pair is considered to belong to the reserved addresses of the local computer 10 and the remote computer 34 (i.e., TIFF0007724272000009.tif13141 is false), another address from among the addresses contained in the common address block is selected.

[0085] If the selected address pair is deemed not to belong to the reserved addresses of the local computer 10 and the remote computer 34 (i.e., TIFF0007724272000010.tif13141 is true), selected address pair, IP selected_local , IP selected_remote The value 740 is used to allocate to the virtual network driver.

[0086] 8 is a block diagram of a system using network address translation equipment to connect a local device 810 of a private network to a public network 840. The device 810 of the private network may use a local network address block 815 to maintain connectivity within the private network. The device 810 connects to the public network (e.g., the Internet) 840 through a network address translation (NAT) device 820 and a VPN gateway 830.

[0087] NAT 820 translates local network addresses in local address block 815 used by local device 810 into corresponding private IP addresses 825 that can be used by VPN gateway 830 to establish connections over public network 840.

[0088] The VPN gateway 830 uses a private address 825 to maintain communication between the local device 810 and the remote device over the VPN tunnel. The VPN gateway 830 may also connect to a public network 840 using a statically or dynamically assigned public IP address.

[0089] 9A-9C include block diagrams of systems that use network address translation equipment to connect a local device 810 of a private network to a public network 840. FIG.

[0090] 9A illustrates a network in which a local computer device 810L communicates with a remote computer device 810R via a virtual private network. Specifically, each device 810L, 810R connects to a corresponding VPN gateway 830L, 830R using a local IP address. Each VPN gateway 830L, 830R, in turn, connects its corresponding device to a public network 840 using a statically or dynamically assigned public IP address (e.g., using Dynamic Host Configuration Protocol (DHCP) provided by the network's Internet Service Provider (ISP)).

[0091] 9B shows a network architecture in which a local computer 810L uses a network address translation device (NAT) 820. Specifically, the local computer 810L communicates with the NAT 820L using a block of local addresses. The NAT 820L translates the local addresses into corresponding private addresses that are used by a VPN gateway 830L to establish a connection with the local computer 810L. The VPN gateway 830L connects the local computer to a public network 840 using a statically or dynamically assigned public address. On the remote computer side, a VPN gateway 830R communicates with the public network 840 using a statically or dynamically assigned public IP address. The VPN gateway 830R also communicates with the remote computer 810R using a private address assigned to the remote computer 810R.

[0092] 9C illustrates a network architecture in which a local computer 810R and a remote computer 810L both use corresponding NAT devices 820R and 820L. Specifically, the local computer 810R communicates with the NAT 820L using a block of local addresses. The NAT 820L translates the local addresses into corresponding private addresses used by a VPN gateway 830L to establish a connection with the local computer 810L. The VPN gateway 830L connects the local computer to a public network 840 using a statically or dynamically assigned public address. On the remote computer side, the VPN gateway 830R communicates with its corresponding NAT device 820R using a block of private addresses. The NAT device 820R translates the private addresses into corresponding local addresses used to communicate with the remote device 810R.

[0093] For example, in Figure 9C, if the network behind 820 / 830L is 192.168.1.0 / 255.255.255.0, device 810L has address 192.168.1.5, and the network behind 820 / 830R is 10.10.1.0 / 255.255.255.0, and device 810R has address 10.10.1.4, the two local area networks (LANs) use non-conflicting private address blocks that can be used instead of the randomly generated block for the VPN. However, if the left network behind 820 / 830L and the right network behind 820 / 830R both use 192.168.1.0 / 255.255.255.0, VPN tunnels to each other using the existing LAN addresses may have conflicting addresses. In this case, an embodiment generates non-conflicting addresses for each side. For example, 10.10.1.0 / 255.255.255.0 on the left side, 10.10.2.0 / 255.255.255.0 on the right side, etc. The left NAT device performs one-to-one NAT for 192.168.1.0 addresses, representing them as 10.10.1.0 addresses through the VPN to the right LAN, and the right LAN also performs one-to-one NAT for 192.168.1.0 addresses, representing them as 10.10.2.0 addresses through the VPN tunnel to the left LAN. Note that generated private addresses are needed on both the left and right sides so that in the event of a LAN address conflict, each side can communicate with its local devices and with remote devices over the VPN. The generated address block used by NAT device 820 to represent the VPN does not need to be the same size as the LAN address block, as long as only a small number of LAN devices need to be provided to other peer devices 810 through the VPN. This generated address block may be a smaller address block in which only devices with VPN access are translated in NAT device 820 to addresses with VPN access.

[0094] In some aspects, when selecting an address block for a LAN-to-LAN VPN, each LAN may use a private address block that does not conflict with other LANs. In such aspects, there is no need to generate address blocks (e.g., randomly); LAN addresses may be used. If each LAN also maintains VPNs with several other LANs, these address blocks may not conflict with all peers whose VPNs are routing packets. In the event of an address block conflict, an embodiment may generate non-conflicting addresses to represent addresses on the LAN with conflicting addresses. The VPN device on the LAN may perform one-to-one network address translation (NAT), where each conflicting address on the LAN is changed to an address in the generated address block for representation to peer VPN devices. If only a subset of addresses on a LAN need be available via the VPN, the LAN may be represented using a smaller generated address block, in which case the VPN-available addresses translate one-to-one with addresses in the smaller generated address block that are provided and routed via the VPN.

[0095] In some embodiments, unique private addresses may be used to conduct at least one of host-to-host, host-to-network, or network-to-network VPN tunnels. For example, a calculated tunnel address may be published to a domain name service (DNS) so that VPN peers can find new hosts via VPN tunnel and DNS requests. When a VPN device runs multiple VPNs with multiple peer hosts and / or networks, a new VPN may be introduced for which the VPN tunnel address or address block may not be available on the new VPN device. To overcome these issues, some embodiments may allow various VPN peers to reach the device by different addresses. In such embodiments, multiple addresses by the peers are published to a secure DNS, which resolves the name to the appropriate address based on the requestor.

[0096] In some embodiments, existing VPNs may be renegotiated so that all VPNs use the same VPN address or address block. This impacts secure DNS. In such embodiments, a named device is represented by a unique address that is independent of the requestor, and only one address is published in the DNS for that name.

[0097] In some embodiments, DNS services, including name-to-VPN address pairs, may be provided only to VPN devices. In some embodiments, access to DNS services may be restricted. For example, DNS services may be restricted to certain internal networks, a set of network addresses, or may require authentication.

[0098] In some embodiments, a VPN address may be calculated and / or a VPN may be instantiated in response to a DNS request. In such embodiments, the host or network initiating the VPN may receive the DNS request, determine whether the host / network has permission to conduct a VPN with the peer host or network, perform the exchange to calculate the private address and set up the VPN, set up the VPN, and return the peer's VPN IP address, if known, to the DNS request, where the communication that triggered the DNS request then takes place in the newly created VPN.

[0099] 10 is a flow diagram for selecting a network mask address according to certain aspects disclosed herein. In some aspects, the procedure may first initialize an index value k, for example, by setting the value of the index value k to 0 (i.e., k=0) 1001. The value of k is set equal to the maximum address block size k. max 1010 to be examined against.

[0100] k≧k maxIf so, a new non-conflicting private address pair is generated 1015. The generated non-conflicting private address pair is used by the virtual network driver (IP selected_local_k ) and assigns it to the virtual network driver (IP selected_remote_k The generated address, i.e., IP selected_local_k and IP selected_remote_k is used to select the smallest network mask address block that can be used to establish communication between the local and remote computers 1035 .

[0101] k≦k max , the procedure described herein is to find the kth selected IP address block of the local computer, i.e., IP selected_local_k is included in the remote computer's set of available addresses (e.g., within a pre-allocated address block 1020 that does not conflict with addresses used by the remote computer or equipment associated with the remote computer). Specifically, the procedure IP selected_local_k ∈{IP selected_remote , Mask max_remote} Determine whether it is.

[0102] The kth selected IP address block IP of the local computer selected_local_k is not in the set of available addresses of the remote computer, the value of the index k is reset, for example by setting k=k+1, and again the maximum address block size k max 1010. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0103] However, if it is determined that the kth selected local IP address block is included in the set of available addresses of the remote computer, the procedure described herein continues by determining the kth selected IP address block of the remote computer, i.e., IP selected_remote_k determines whether the address conflicts with an existing address of the local computer (e.g., if the address is in use by the local computer or a device associated with the local computer) or with the largest network mask value reserved by the local computer 1030. Specifically, the address negotiation procedure includes: IP selected_remote_k ∈{IP reserved_local , Mask max_local} Determine whether it is.

[0104] kth selected IP address block IP of remote computer selected_remote_k is not within the local computer's set of available addresses, the value of index k is reset, for example, by setting k=k+1, and again the maximum address block size k max 1010. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0105] However, if it is determined that the kth selected remote IP address block is included in the local computer's set of available addresses, the procedure described herein continues by determining the kth selected IP address block of the local computer, i.e., IP selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k 1040. Specifically, in some aspects, the procedure IP selected_local_k !=IP selected_remote_k where the operator ! is the logical "not" operator.

[0106] The kth selected IP address block IP of the local computer selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k (i.e., IP selected_local_k !=IP selected_remote_k is false), the value of the index k is reset, for example, by setting k=k+1, and the maximum address block size k is again set. max 1010. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0107] However, the kth selected IP address block IP of the local computer selected_local_k is the kth selected IP address block of the remote computer, i.e., IP selected_remote_k is not the same as (i.e., IP selected_local_k !=IP selected_remote_k is true), the procedure described herein continues by searching the kth selected IP address block of the local computer, i.e., IP selected_local_k , belongs to a set defined by all reserved addresses of the local computer (i.e., addresses used by the local computer or equipment associated with the local computer) and all reserved addresses of the remote computer (i.e., addresses used by the remote computer or equipment associated with the remote computer) 1050. Additionally, the address negotiation procedure described herein continues by determining whether the kth selected IP address block of the remote computer, i.e., IP selected_remote_kIt also determines whether , belongs to the set defined by all reserved addresses of the local computer (i.e., addresses in use by the local computer or equipment associated with the local computer) and all reserved addresses of the remote computer (i.e., addresses in use by the remote computer or equipment associated with the remote computer). Specifically, the procedure Determine whether the file is TIFF0007724272000011.tif21128.

[0108] The kth selected IP address block IP of the local computer selected_local_k is the set defined by reserved VPN addresses (i.e., the set defined by all reserved addresses of the local computer and all reserved addresses of the remote computer {IP reserved_local , IP reserved_remote}), that is, If TIFF0007724272000012.tif7128 is determined to be false, or if the kth selected IP address block of the remote computer is selected_remote_k is the set defined by reserved VPN addresses (i.e., the set defined by all reserved addresses of the local computer and all reserved addresses of the remote computer {IP reserved_local , IP reserved_remote}), that is, If TIFF0007724272000013.tif6128 is determined to be false, the value of the index k is reset, for example, by setting k=k+1, and the maximum address block size k is again set. max 1010. After the value of index k is reset, the procedure continues by verifying possible conflicts for the next address in the address block, i.e., the k+1th address block.

[0109] However, the kth selected IP address block IP of the local computer selected_local_k is determined not to belong to the set defined by the reserved VPN addresses (i.e., TIFF0007724272000014.tif6128 is determined to be true), and the kth selected IP address block IP of the remote computer selected_remote_k is determined not to belong to the set defined by the reserved VPN addresses (i.e., TIFF0007724272000015.tif6128 is determined to be true), the procedure described herein continues by selecting 1035 the smallest block of network mask addresses that can be used to establish communications between the local computer and the remote computer.

[0110] 11 is a flow diagram of a procedure for selecting a non-conflicting private network mask address block. The procedure begins by determining 1110 the total number of desired private local addresses. For example, in one aspect, the total number of desired addresses is determined 1110. n where n is a finite number. A maximum number of private network mask addresses is also initialized. For example, in one embodiment, the network mask that provides the total number of desired addresses is 2 32 -2 n is calculated as follows.

[0111] The total number of desired private local addresses is compared to the maximum number of private network addresses (Mask max_local <Mask private_local ) 1130, if the number of desired private local addresses is greater than the number of private network mask addresses, a new non-conflicting address pair, IP selected_local , IP selected_remote are generated 1150 as described with reference to FIG.

[0112] However, if the number of desired private local addresses is less than the number of private network mask addresses, then the highest number assigned to the network mask addresses is selected 1140 as the non-conflicting mask address.

[0113] 12 is an example of a procedure for selecting a non-conflicting network address pair according to an aspect disclosed herein. To determine a non-conflicting address pair that can be used to establish communication between two network devices, i.e., device 1 and device 2, a candidate recommended address (PA1) of a first device is selected from a pool of private addresses (PAP) that does not include device 1's reserved address (RA1) 1210. Specifically, device 1's candidate recommended address (PA1) is It is selected to be TIFF0007724272000016.tif4128.

[0114] Similarly, a candidate recommended address (PA2) for the second device is selected from the pool of private addresses (PAP) that does not include the reserved address (RA2) of device 2 1220. Specifically, the candidate recommended address (PA2) for device 2 is: It is selected to be TIFF0007724272000017.tif5128.

[0115] A matching IP address pair is selected 1230 from among the addresses included in candidate recommended addresses for device 1 (PA1) and candidate recommended addresses for device 1 (PA2).

[0116] If a matching address is found for the candidate address, the address is added to the reserved addresses of the other device 1250. Specifically, if the selected address IPA1 of device 1 is determined to match the selected address IPA2 of device 2, the selected address IPA1 of device 1 is added to the reserved addresses RA2 of device 2, and the selected address IPA2 of device 2 is added to the reserved addresses RA2 of device 1.

[0117] If no matching address is found for the candidate address, a new matching address IPA1 is selected for device 1 1260. The new matching address pair is selected from a pool of private addresses (PAP) that does not include device 1's reserved address (RA1) and device 2's selected address IPA2. If the new matching address IPA1 is successfully obtained for device 1, the matching address pair is added to device 1's reserved addresses and device 2's reserved addresses 1250. Specifically, IPA1 is added to device 2's reserved addresses RA2, and device 2's selected address IPA2 is added to device 1's reserved addresses RA2.

[0118] If no matching address is found for the candidate address, a new matching address IPA2 is selected for device 2 1270. The new matching address pair is selected from a pool of private addresses (PAP) that does not include device 2's reserved address (RA2) and device 1's selected address IPA1. If the new matching address IPA2 is successfully obtained for device 2, the matching address pair is added to device 1's reserved addresses and device 2's reserved addresses. Specifically, IPA1 is added to device 2's reserved addresses RA2, and device 2's selected address IPA2 is added to device 1's reserved addresses RA2.

[0119] If no matching addresses are found for the candidate addresses, new matching addresses IPA1 and IPA2 are selected for device 1 and device 2, respectively 1280. The new address IPA1 is selected from the pool of private addresses (PAP) that does not include device 1's reserved address (RA1), and the new address IPA2 is selected from the pool of private addresses (PAP) that does not include device 2's reserved address (RA2). The new address pair is added to device 1's reserved addresses and device 2's reserved addresses 1250. Specifically, IPA1 is added to device 2's reserved address RA2, and device 2's selected address IPA2 is added to device 1's reserved address RA2.

[0120] While the foregoing describes what are considered to be best modes and / or other examples, it is understood that various modifications may be made therein and that the subject matter disclosed herein may be embodied in a variety of forms and examples, and that the teachings of the present invention may be applied in numerous applications, only a few of which have been described herein. It is intended in the appended claims to claim any and all applications, modifications, and variations that fall within the precise scope of the teachings of the present invention.

[0121] Unless otherwise indicated, all measurements, values, ratings, locations, dimensions, sizes, and other specifications set forth herein, including those contained in the appended claims, are approximate and not precise, and are intended to have a reasonable range consistent with the function to which they relate and with those customary in the art to which they pertain.

[0122] The scope of protection is limited solely by the appended claims. That scope is intended to be broad enough consistent with the ordinary meaning of the claim language as interpreted in light of the specification and subsequent prosecution history, and is intended to encompass all structural and functional equivalents, and should be so interpreted. However, no portion of the claims is intended, or should be interpreted, to include subject matter that does not meet the requirements of Sections 101, 102, or 103 of the U.S. Patent Law. Any unintended inclusion of such subject matter is hereby excluded.

[0123] Except as immediately stated, nothing described or illustrated in this specification, whether claimed or not, is intended to, and should not be construed as, making available to the public any element, step, feature, object, benefit, advantage, or equivalent thereof.

[0124] Terms and expressions used herein will be understood to have the ordinary meanings associated with such terms and expressions in connection with their respective areas of research, unless a specific meaning is otherwise stated herein. Relationship terms such as first, second, etc. may be used solely to distinguish one entity or operation from another and do not necessarily require or imply any actual relationship or ordering between such entities or operations. "Comprises," "comprising," or any other variation of these terms is intended to cover non-exclusive inclusions; thus, a process, method, article, or apparatus that comprises a list of elements may include not only those elements, but also other elements not expressly listed or inherent in such process, method, article, or apparatus. The use of "a" or "an" element does not, in the absence of further constraints, exclude the presence of additional identical elements within the process, method, article, or apparatus that comprises the element.

[0125] The Abstract of the Disclosure is provided to enable the reader to quickly grasp the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the Detailed Description, various features may be grouped together in various embodiments to streamline the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Instead, as the appended claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the appended claims are hereby incorporated into the Detailed Description, with each claim standing on its own as separately claimed subject matter.

Claims

1. 1. A local device associated with a local network for automatically avoiding address conflicts when securely communicating over a public network with a remote device located outside the local network, comprising: Network drivers and at least one processor, Identifying a block of available local network addresses; selecting at least one local network address from the block based at least in part on negotiation with the remote device using the block of available local network addresses; assigning the selected at least one local network address to the network driver as a local device address for use in securely communicating with the remote device over the public network; identifying at least one remote network address based at least in part on the selected at least one local network address of the remote device for use in securely communicating with the local device over the public network; adding said at least one remote network address to a list of reserved local network addresses; and securely communicating with the remote device using a network driver based at least in part on the at least one assigned local network address; at least one processor configured to: Including local equipment.

2. 10. The local device of claim 1, wherein the network driver is a software module.

3. 10. The local device of claim 1, wherein the local network address is a private network address on the local network.

4. 10. The local device of claim 1, wherein the local device is a mobile device.

5. 10. The local device of claim 1, wherein, to communicate securely, the at least one processor is configured to encrypt packets sent to the remote device over the public network.

6. 10. The local device of claim 1, wherein, to communicate securely, the at least one processor is configured to control a network driver to communicate with the remote device over a public network using a secure communication link.

7. 10. The local device of claim 1, wherein each of the local network addresses includes an IP address and a network mask.

8. 10. The local device of claim 1, wherein the at least one processor is further configured to encrypt packets sent to the remote device over the public network.

9. At least one processor encapsulating at least one of the local device's private address or the remote device's private address in at least one selected local network address; Encrypt at least one of the local device's private address or the remote device's private address further configured as follows:

10. The local device of claim 1.

10. 10. The local device of claim 1, wherein communication with the remote device is enabled by a host-to-host connection or a host-to-network connection.

11. 1. A method performed by a local device on a local network for automatically avoiding address conflicts when communicating securely over a public network between a local device associated with the local network and a remote device located outside the local network, the method comprising: identifying, by a local device including at least one processor, a block of available local network addresses; using a block of available local network addresses, by the local device, to select at least one local network address from the block based at least in part on negotiation with the remote device; assigning, by the local device, to a network driver, the selected at least one local network address as an address of the local device for use in securely communicating with the remote device over the public network; identifying, by the local device, at least one remote network address based at least in part on the at least one local network address selected for the remote device for use in securely communicating with the local device over the public network; adding, by the local device, at least one remote network address to a list of reserved local network addresses; and communicating by the local device with the remote device using a network driver based on the at least one assigned local network address; wherein performing one or more of the operations of identifying, assigning, and negotiating is in response to a name service request for a name corresponding to a remote device.

12. further comprising receiving, by the local device, a name service request for a name corresponding to the remote device; identifying a block of available local network addresses is based at least in part on a name service request; 12. The method of claim 11.

13. 12. The method of claim 11, wherein the network driver is a software module.

14. 12. The method of claim 11, wherein each of the local network addresses includes an IP address and a network mask.

15. Encrypting packets sent over a public network to a remote device 12. The method of claim 11, further comprising:

16. communicating with the remote device using the communications link over the virtual private network; 12. The method of claim 11, further comprising:

17. encapsulating, by the local device, at least one of the local device's private address or the remote device's private address in at least one selected local network address; encrypting at least one of the local device's private address or the remote device's private address; 12. The method of claim 11, further comprising:

18. 12. The method of claim 11, wherein the local device is a mobile device.

Images