Global Server Mediator for Interoperable Secure VPN Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN technologies face interoperability issues due to proprietary IPsec implementations, limiting user access on restrictive platforms like the iPhone, where installing proprietary software is restricted, and often restrict VPN connections to transport mode, exposing the identity of communicating hosts.
Innovation Solution
A global server acts as a mediator to authenticate and establish secure VPN sessions between clients and private networks, using IKE protocols to negotiate Security Associations, facilitating secure access even on platforms with limited software installation capabilities, and ensuring compatibility across different IPsec implementations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proprietary IPsec implementations are used, then security and confidentiality are improved, but interoperability and ease of operation deteriorate
Solution Approach 1:
The patent introduces a gateway server as an intermediary component that mediates between clients using different IPsec implementations. The gateway server receives VPN connection requests from clients, performs authentication, and establishes secure communication channels to the private network. This intermediary approach allows clients with restricted software installation capabilities (like iPhones) to connect to networks using proprietary IPsec implementations without requiring the clients to install proprietary software, thereby maintaining security while improving interoperability.
2Device complexity
If transport mode is used for VPN connections, then device complexity is reduced, but identity protection deteriorates
Solution Approach 1:
The patent implements dynamic mode selection where the gateway server can adaptively choose between transport mode and tunnel mode based on the specific connection requirements and security needs. For connections requiring identity protection, the gateway server establishes tunnel mode connections that encapsulate entire IP packets including headers, thereby protecting client identities. For connections where identity protection is less critical, transport mode can be used to reduce complexity. This dynamic approach allows the system to optimize between security and simplicity on a per-connection basis.
Data Source
AI summary
A system and method for providing authenticated access to an initiating terminal in relation to the services provided by a terminating terminal via a communications network are disclosed. In one aspect, a global server comprises a communications module, which receives and processes a key exchange initiation message from the initiating terminal so as to establish an encrypted communications channel with the terminating terminal. The communications module, responsive to a received key exchange initiation message, performs an encrypted communication establishment process in respect of the received key exchange initiation message. The encrypted communication establishment process comprises authenticating the initiating terminal, and in the event that the initiating terminal is successfully authenticated, transmitting keying data corresponding to the received key exchange initiation message to the terminating terminal. The keying data is identified on the basis of data associated with the initiating terminal.