Local Link for VPN Administrative Message Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless networking technologies, such as IEEE 802.11, face challenges in delivering administrative messages, like timeout warnings, to user devices connected through secure VPNs, as the Wi-Fi access point cannot inject messages into the secure VPN tunnel, limiting the ability to notify users of expiring connection times without relying on split VPN tunneling, which is often disabled due to security concerns.
Innovation Solution
Establishing a local communication link using link-local addresses between the user device and the access network node, allowing administrative messages to be sent independently of the VPN connection, using transport layer protocols like TCP, UDP, or SCTP, and designating specific ports for notification delivery, ensuring messages are received by the user device without compromising VPN security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure VPN tunnel is established between the user device and the enterprise network, then security is improved, but the access point cannot inject administrative messages into the tunnel
Solution Approach 1:
The patent segments the communication paths by establishing a separate local communication link (using link-local addresses) independent of the VPN tunnel. This allows administrative messages to be delivered through a different channel than the encrypted VPN traffic, resolving the contradiction between maintaining VPN security and enabling message delivery.
Solution Approach 2:
The patent introduces a local communication link as an intermediary mechanism. This intermediary uses link-local addressing and designated ports to facilitate administrative message delivery between the access point and user device without compromising the security of the VPN tunnel.
2Loss of information
If split VPN tunneling is enabled to allow message delivery, then administrative messages can be sent, but security vulnerabilities are introduced
Solution Approach 1:
Instead of using split VPN tunneling which creates security vulnerabilities, the patent segments communication into two independent paths: the encrypted VPN tunnel for data traffic and a separate local link for administrative messages. This avoids the security issues of split tunneling while achieving message delivery.
Solution Approach 2:
The patent creates a parallel communication channel (local link) that copies the essential functionality of message delivery without relying on the VPN tunnel infrastructure. This alternative path delivers administrative messages securely without compromising VPN integrity.
3Reliability
If the access point attempts to send messages through the encrypted VPN tunnel, then message delivery is blocked, but establishing alternative communication paths increases system complexity
Solution Approach 1:
The local communication link uses standard TCP/IP protocols and designated ports (such as port 9050) that are universally supported, allowing the same infrastructure to handle both VPN traffic and administrative messages without requiring specialized complex systems.
Solution Approach 2:
The system uses self-service mechanisms where the user device automatically establishes the local communication link using link-local addressing and predefined ports, reducing the need for complex manual configuration and infrastructure management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and techniques for managing local communication between a network access point and a host device. Upon connection by a host device to an access point, a local connection link is established between the access point and the host device. A network connection may be established between the access point and the host device, with the network connection being able to pass through the host device to enable communication with and beyond an access network to which the access point provides a connection. Local messages may be passed between the access point and the host device over the local connection link, separately from and independent of communication that may occur over the network connection.