Clientless VPN Traffic Routing for Network Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile network service providers face challenges in optimizing traffic handling due to the inability to detect characteristics of tunneled traffic in VPN connections, leading to sub-optimal customer experience, as all traffic is routed through VPNs without exception, limiting network visibility and service optimization.
Innovation Solution
Implementing a network-side discriminator function at the edge of the core network to selectively route network traffic via a VPN proxy or bypass the encrypted tunnel based on traffic characteristics, without requiring a VPN client on the user endpoint device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all traffic is routed through VPN encrypted tunnels, then security and privacy are improved, but network visibility and service optimization capability deteriorate
Solution Approach 1:
The patent segments traffic handling into two paths: encrypted VPN tunnel for security-critical traffic and unencrypted direct path for visibility-required traffic. The network device selectively routes different traffic flows through different paths based on their requirements, allowing simultaneous achievement of security and visibility.
Solution Approach 2:
Different quality characteristics are applied to different traffic flows. Some traffic receives encrypted tunnel treatment for security, while other traffic receives unencrypted direct routing for visibility. This local differentiation resolves the contradiction by applying the appropriate treatment to each traffic type.
2Reliability
If a VPN client is deployed on the user endpoint device, then VPN functionality is achieved, but device complexity and user burden increase
Solution Approach 1:
The patent introduces a network-side VPN functionality that acts as an intermediary between the user device and the network. Instead of requiring VPN client software on the device, the network device provides VPN capabilities directly, eliminating the need for complex client installations while maintaining VPN functionality.
Solution Approach 2:
The network automatically provides VPN services without requiring user configuration or client software. The network device autonomously establishes encrypted tunnels and manages VPN functionality, allowing users to access VPN services simply by connecting to the network without any additional software or setup.
3Reliability
If encrypted tunnels are used for all traffic, then security is improved, but network service optimization and traffic management capability deteriorate
Solution Approach 1:
The patent implements dynamic traffic routing where the encryption status and path selection change based on real-time traffic characteristics and network conditions. The network device continuously adapts its behavior, switching between encrypted and unencrypted paths as needed, enabling both security and service optimization.
Solution Approach 2:
The patent changes the encryption parameter selectively based on traffic type and requirements. Instead of a fixed encrypted state for all traffic, the system dynamically adjusts the encryption parameter, applying it only when security is required while leaving other traffic unencrypted for optimal service management and visibility.
Data Source
AI summary
One example of a method performed by a processing system of a device in a communications service provider core network includes obtaining a characteristic of a first network traffic flow received from a user endpoint device that is connected to the communications service provider core network via an access network, determining whether the characteristic indicates a need to route the first network traffic flow over a virtual private network, creating an encrypted tunnel from the device to a virtual private network proxy, and routing the first network traffic flow to the virtual private network proxy via the encrypted tunnel.