NDIS Driver Process Control for SSL VPN Startup Speed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VPN technologies, particularly SSL VPNs, face issues with process access control and slow startup speeds due to the need to start a virtual network interface card when the client initiates a connection.
Innovation Solution
The implementation of a method where the NDIS intermediate driver intercepts packets from application programs, determines the process identification (PID) of the packet, and based on a PID table, decides whether to allow the process to use the SSL VPN, establishing a new packet with a virtual IP address and sending it to the intranet server through the SSL tunnel, thereby controlling access and eliminating the need for a virtual network interface card startup.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual network interface card is started when the client initiates a connection, then the client can establish an SSL tunnel and access the intranet server, but the startup speed of the client becomes slow
Solution Approach 1:
The patent extracts the virtual network interface card startup operation from the client initialization process. Instead of automatically starting the virtual network interface card when the client launches, the system uses packet interception and process identification to selectively enable VPN access only when needed, thereby eliminating the startup delay while maintaining secure tunnel establishment capability.
Solution Approach 2:
The patent introduces dynamic control of the virtual network interface card based on process identification. The system dynamically determines whether to start the virtual network interface card by intercepting packets, identifying the process ID, and checking against a allowed processes list, making the startup behavior adaptive rather than static, thus improving startup speed while maintaining security.
2Ease of operation
If all processes can use the virtual network interface card to access the intranet server, then the VPN access is convenient, but there is no way to limit access of specific processes
Solution Approach 1:
The patent applies local quality control by intercepting packets at the network driver level and examining the process identification (PID) of each packet. The system then selectively allows or denies access based on whether the PID is in the allowed processes list, enabling fine-grained control over which processes can access the intranet server through the VPN.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a packet interception and process identification system. This intermediary layer between the network interface and the application processes enables the system to monitor, identify, and control which processes are allowed to use the virtual network interface card, thereby preventing unauthorized access while maintaining convenience for authorized processes.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Embodiments of the present invention provide a virtual private network implementation method and a client device. The virtual private network implementation method in the present invention includes: intercepting, by an NDIS intermediate driver, a packet sent by an application program to an intranet server, and determining, according to a process identification PID corresponding to the packet, whether to allow a process corresponding to the packet to use an SSL VPN; if the process corresponding to the packet is allowed to use the SSL VPN, establishing, by the NDIS intermediate driver, a new packet, setting a destination address of the new packet as a local address of the client device, setting a destination port number of the new packet as a port number by using which a client receives the packet, changing a source IP address of the original packet to a virtual IP address, using the original packet as a payload of the new packet, and submitting the new packet to an NDIS network interface card driver; and sending, by the NDIS network interface card driver, the new packet to the client, and sending, by the client, the new packet to the intranet server. According to the embodiments of the present invention, a virtual private network is implemented based on process control, and a client has a fast startup speed.