SSL VPN Routing via External IP Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL VPN systems require changes in intranet topological structure and management policies due to the allocation of multiple virtual IP addresses and private networks, leading to network topology changes when multiple clients access the intranet.
Innovation Solution
A packet transmission method that determines whether to use a VPN tunnel based on a preset control policy, allowing packets to be sent directly without changing the intranet topology by maintaining the external network IP address and avoiding the allocation of virtual IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual IP addresses and private networks are allocated for SSL VPN clients, then secure packet transmission is enabled, but the intranet topological structure changes
Solution Approach 1:
The patent introduces a routing device as an intermediary between the SSL VPN server and intranet servers. This routing device performs packet routing and forwarding without requiring changes to the intranet topology. The routing device receives packets from the SSL VPN server, determines the appropriate intranet server based on destination IP and port, and forwards packets directly to the intranet server using the original external network IP address, thus enabling secure transmission while maintaining intranet structural integrity
Solution Approach 2:
The patent segments the packet transmission path into distinct functional components: the SSL VPN server handles encryption and security protocols, the routing device handles packet routing and forwarding, and the intranet servers handle the actual service processing. This segmentation allows each component to perform its function independently without requiring changes to the intranet topology, as the routing device acts as a transparent intermediary
2Adaptability or versatility
If multiple virtual IP addresses are allocated for multiple clients, then client access control is improved, but the intranet management policy becomes complex
Solution Approach 1:
The patent changes the parameter used for client identification from virtual IP addresses to external network IP addresses. The routing device maintains a mapping relationship between SSL VPN clients and their original external network IP addresses, allowing it to forward packets to the correct intranet server based on the original IP address and destination port. This parameter change eliminates the need for multiple virtual IP address allocations and simplifies intranet management policies
Solution Approach 2:
The routing device performs multiple functions: it receives packets from the SSL VPN server, determines the appropriate intranet server based on destination IP and port information, maintains client mapping relationships, and forwards packets to the correct server. This multi-functionality consolidates what would otherwise require complex management policies across multiple devices, simplifying the overall system management
3Reliability
If VPN tunnel is used for all packets, then security is improved, but transmission efficiency decreases
Solution Approach 1:
The patent applies different transmission methods to different packets based on their characteristics. For packets destined to intranet servers, the system uses encrypted VPN tunnel transmission to ensure security. For packets destined to external networks, the system uses direct transmission without encryption to maintain efficiency. The routing device makes this determination based on the destination IP address and port number, applying the appropriate transmission quality locally to each packet type
Data Source
AI summary
Embodiment of the present invention provides a packet transmission method. The method includes: receiving an encrypted packet sent by a client by using a virtual private network (VPN) tunnel, wherein the encrypted packet is sent by the client after the client determines, according to a preset control policy, that the control policy comprises an Internet Protocol (IP) address and a port number that are the same as a destination IP address and a destination port number of a packet to be sent and encrypts the packet to be sent, and the control policy comprises information about an IP address and a port number of an intranet server that can exchange a packet with a security socket layer protocol (SSL) VPN server; decrypting the encrypted packet; and sending the decrypted packet to a corresponding intranet server, wherein a source IP address of the decrypted packet is an external network IP address.