Pseudo Server Module for Secure VPN Routing

Solution Overview

Problem

Conventional VPN encryption protocols like IPsec and SSL face limitations, including difficulty in routing encrypted packet traffic through firewalls, vulnerability due to visible IP addresses, and inability to support real-time applications, which restrict their effectiveness in secure communication networks.

Innovation Solution

A system and method that captures and redirects packet traffic at the remote device, using an address inspection driver and pseudo server module to form a secure communications link, allowing packet modification and routing at layers other than where filtering occurs, enabling secure communication while minimizing latency for real-time applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If IPsec encryption protocol is implemented at network layer, then secure communication is achieved, but firewall routing becomes difficult and creates bottlenecks

Engineering Contradiction:

Improvesecure communicationVSAvoidfirewall routing

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces a tunnel endpoint and encapsulation mechanism as an intermediary between the IPsec encrypted traffic and the firewall. The encrypted packets are encapsulated within UDP or TCP packets, allowing them to traverse NAT-based firewalls that would otherwise block or bottleneck IPsec traffic. This intermediary layer resolves the contradiction by making encrypted traffic compatible with firewall routing requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent moves the encryption operation from the network layer to the transport layer by implementing IPsec over UDP/TCP. This dimensional shift in the protocol stack allows encrypted traffic to be carried within application-layer protocols that are naturally permitted through firewalls, thereby resolving the routing difficulty while maintaining security.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

2Ease of operation

If remote device address is made visible to private network, then routing is simplified, but security vulnerability increases

Engineering Contradiction:

ImproveroutingVSAvoidsecurity vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a tunnel endpoint and encapsulation mechanism as an intermediary between the IPsec encrypted traffic and the firewall. The encrypted packets are encapsulated within UDP or TCP packets, allowing them to traverse NAT-based firewalls that would otherwise block or bottleneck IPsec traffic. This intermediary layer resolves the contradiction by making encrypted traffic compatible with firewall routing requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent moves the encryption operation from the network layer to the transport layer by implementing IPsec over UDP/TCP. This dimensional shift in the protocol stack allows encrypted traffic to be carried within application-layer protocols that are naturally permitted through firewalls, thereby resolving the routing difficulty while maintaining security.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Adaptability or versatility

If SSL encryption protocol is implemented at transport layer, then web applications are supported, but real-time applications and routing protocols are not supported

Engineering Contradiction:

Improveapplication supportVSAvoidreal-time application performance

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent segments the encryption function from the transport protocol by implementing IPsec encryption within UDP or TCP data payloads. This segmentation allows different transport protocols (UDP for real-time, TCP for reliable delivery) to coexist with encrypted traffic, enabling both real-time applications and routing protocols to function simultaneously without the limitations of SSL's transport-layer constraint.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS7496097B2System, apparatus and method for establishing a secured communications link to form a virtual private network at a network protocol layer other than at which packets are filtered

Publication Date: 2009.02.24 CITRIX SYSTEMS INC

AI summary

A system, apparatus and a method for implementing a secured communications link at a layer other than that at which packets are filtered are disclosed. In one embodiment, a computer system is configured to form a virtual private network (“VPN”) and comprises an address inspection driver to identify initial target packet traffic addressed to a target server. Also, the computer system includes a pseudo server module to receive rerouted initial target packet traffic from the address inspection driver. The pseudo server module is configured to convey packet regeneration instructions to a VPN gateway. The address inspection driver functions to identify additional target packet traffic addressed to the target server and routes the additional target packet traffic to the pseudo server. In one embodiment, the pseudo server is configured to strip header information from the additional target packet traffic to form a payload, and thereafter, to route the payload to the target server.