Tunnel Interface for PTMP VPN Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec protocols struggle to provide point-to-multi-point (PTMP) or non-broadcasting multi-access (NBMA) VPN services without requiring support on all networking devices and introduce overhead, as they are designed for point-to-point links only.
Innovation Solution
The method involves establishing and managing VPN tunnels by creating a next hop tunnel table that maps next hops from a routing table to tunnel identifiers, allowing for the forwarding of broadcast, multicast, or unicast data units through appropriate VPN tunnels without altering existing routing or VPN tunnel structures, using a tunnel interface in network devices like gateways.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec protocols are used to provide VPN tunnels, then security of communications is improved, but the ability to support point-to-multi-point or non-broadcasting multi-access environments is limited
Solution Approach 1:
The patent introduces a tunnel interface as an intermediary component between the routing table and VPN tunnels. This tunnel interface receives data units from the routing table, determines appropriate VPN tunnels based on destination addresses, and forwards them securely. This intermediary layer enables PTMP/NBMA functionality without modifying the core IPsec point-to-point mechanism, thus maintaining security while improving adaptability.
Solution Approach 2:
The patent segments the VPN tunnel management into separate functional components: a routing table for path determination, a tunnel interface for data unit processing, and individual VPN tunnels for secure transmission. This segmentation allows the system to maintain simple point-to-point IPsec tunnels while using the tunnel interface to aggregate multiple tunnels for PTMP/NBMA services, resolving the contradiction between simplicity and versatility.
2Adaptability or versatility
If GRE tunneling is used to provide PTMP service, then point-to-multi-point functionality is improved, but device complexity and overhead are increased
Solution Approach 1:
The patent extracts the PTMP service logic from the data plane by implementing it in the control plane through the tunnel interface. The tunnel interface handles destination address analysis and VPN tunnel selection, while the actual data transmission uses simple IPsec point-to-point tunnels. This extraction eliminates the need for complex GRE tunneling at the data plane, reducing device complexity while maintaining PTMP capability.
Solution Approach 2:
The tunnel interface serves multiple functions: it processes data units from the routing table, determines appropriate VPN tunnels based on destination addresses, and forwards them through the secure tunnel. This multi-functional design provides PTMP service capability without requiring separate complex tunneling protocols for each function, thereby reducing overall device complexity while improving versatility.
Data Source
AI summary
A system establishes a virtual private network (VPN) tunnel to a destination and determines a next hop for the VPN tunnel. The system inserts the next hop, and an address associated with the destination, into an entry of a first table. The system inserts the next hop, and a tunnel identifier corresponding to the established VPN tunnel, into an entry of a second table. The system associates one or more security parameters, used to encrypt traffic sent via the VPN tunnel, with the tunnel identifier.