Gateway Packet Routing Without Endpoint Table Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional VPN architectures modify the endpoint routing table, increasing security risks by providing private network information that can be manipulated for malicious access, and lack the ability to apply security policies effectively at the kernel level, leading to network latency issues.
Innovation Solution
A method and system that associate a private IP address with an endpoint having a public IP address, using a driver compliant with NDIS to capture and route packets through a policy engine for secure transmission without modifying the endpoint routing table, employing network address translation to transform private IP addresses to public ones, and applying access control lists for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional VPN architectures modify the endpoint routing table to provide layer-2 network access, then network connectivity and functionality are improved, but security risks increase due to exposure of private network information
Solution Approach 1:
The patent introduces a gateway device as an intermediary between the private network and remote endpoints. The gateway maintains the routing table modifications centrally rather than on endpoints, acting as a mediator that provides network access information to endpoints without exposing the actual private network routing structure. This resolves the contradiction by maintaining connectivity functionality while eliminating the security risk of distributed routing table exposure.
2Productivity
If VPN gateways operate at the kernel layer for maximum functionality, then packet routing capability is improved, but security policy enforcement capability deteriorates due to inability to identify application-level packet origins
Solution Approach 1:
The patent segments the VPN gateway functionality into two distinct components: a kernel-layer packet capture module that handles high-speed packet routing, and a user-space policy enforcement module that performs application-level security policy evaluation. This segmentation allows the system to maintain kernel-level routing performance while adding versatile security policy enforcement capabilities that can identify and control packets based on application origins.
3Reliability
If secondary or tertiary packet inspection is performed to identify malicious data, then security detection capability is improved, but network latency increases
Solution Approach 1:
The patent implements preliminary security policy evaluation by the gateway before packets are forwarded to endpoints. Security policies are applied and malicious packets are identified and blocked at the gateway level, preventing the need for multiple rounds of packet inspection at endpoint devices. This preliminary action maintains high security detection capability while minimizing network latency by eliminating redundant inspection cycles.
Data Source
AI summary
A method for routing packets from a gateway to an endpoint includes the step of associating a private internet protocol (IP) address with an endpoint having a public IP address. A packet addressed to the private IP address of the endpoint is captured. A policy is applied to the packet. The packet is transmitted to the public IP address of the endpoint, responsive to the application of the policy to the packet.