Application-Specific Network-Layer VPN Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual private network (VPN) technologies often require the use of VPN proxies and route table modifications, which can increase processing burdens and complicate the secure communication of network traffic from specific applications to servers, especially in Layer 4 VPN implementations.
Innovation Solution
A client device module intercepts application-level network traffic and determines on an application-by-application basis whether to send it through a network-layer VPN tunnel defined by the client device's and VPN gateway's network addresses, potentially avoiding the need for a VPN proxy and route table updates by using a network-layer VPN (Layer 3) approach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a transport-layer VPN (Layer 4) is used with proxies and route table modifications, then secure communication is achieved, but processing burden and device complexity increase
Solution Approach 1:
The patent segments the VPN functionality by creating separate virtual network adapters for different applications. Each application can have its own virtual adapter with specific routing rules, allowing selective VPN tunneling without requiring system-wide route table modifications. This segmentation reduces the processing burden on the VPN gateway while maintaining secure communication for specific applications.
Solution Approach 2:
The patent introduces virtual network adapters as intermediary components between applications and the network. These virtual adapters act as mediators that intercept application traffic, apply VPN encryption selectively, and forward traffic through appropriate tunnels. This intermediary layer simplifies the VPN implementation by handling security functions at the network adapter level rather than requiring complex proxy configurations.
2Reliability
If a transport-layer VPN (Layer 4) with proxies is used, then application-specific security is achieved, but ease of operation deteriorates due to proxy configuration requirements
Solution Approach 1:
The patent enables applications to self-configure VPN connections through virtual network adapters. Each virtual adapter is automatically associated with specific applications and contains pre-configured routing rules. When an application binds to its designated virtual adapter, the VPN connection is automatically established without requiring manual proxy configuration or route table modifications, significantly improving ease of operation.
Solution Approach 2:
The patent performs preliminary configuration by pre-establishing virtual network adapters and associating them with specific applications before runtime. The routing rules and VPN tunnel parameters are pre-configured in the virtual adapter settings. This preliminary action eliminates the need for complex runtime configuration or manual proxy setup, allowing applications to simply bind to their designated virtual adapter to initiate secure communication.
3Device complexity
If network-layer VPN (Layer 3) is used without proxies, then device complexity is reduced, but adaptability to specific applications deteriorates
Solution Approach 1:
The patent segments the network interface by creating multiple virtual network adapters, each dedicated to specific applications. This segmentation allows the system to use simple network-layer VPN tunneling without proxies, while still achieving application-specific security by directing different applications to different virtual adapters with appropriate routing rules. Each virtual adapter maintains independent routing tables that direct traffic from associated applications through the VPN tunnel.
Solution Approach 2:
The patent makes virtual network adapters multi-functional by combining the capabilities of network interface cards, VPN clients, and routing controllers in a single component. Each virtual adapter can handle multiple functions: receiving application traffic, applying VPN encryption, performing routing decisions, and managing connection state. This universality allows network-layer VPN to provide application-specific security without requiring separate proxy components for each application.
Data Source
AI summary
Techniques are described for providing secure communication of network traffic from specific applications operating on a client device to a server device using a network-layer virtual private network (VPN). For example, a module on a client device may intercept network traffic from an application executing on the client device. The module may then determine whether to send the application-layer data through a network-layer VPN tunnel from the client device to a gateway device. This network-layer VPN tunnel may be defined by a network address of a physical adapter of the client device and a network address of the VPN gateway. In other words, there may be no need for the interposition of a VPN proxy on the client device. The module makes this determination on an application-by-application basis. The client device then forwards the application-layer data through the VPN tunnel based on the determination.