Virtual Address Overlay for Persistent WAN Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional VPN technologies disrupt secure communications when IP addresses change, limiting flexibility in network configurations and preventing seamless failover and load balancing across multiple paths.
Innovation Solution
The system uses virtual addresses for security associations instead of actual IP addresses, allowing packet interception and modification to map between virtual and actual addresses, enabling continued secure communication and failover without creating new tunnels, and supporting one-to-many and many-to-one path topologies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If actual IP addresses are used for security associations, then the VPN tunnel can be established initially, but the secure communication session is disrupted when IP addresses change
Solution Approach 1:
The patent introduces virtual IP addresses as intermediaries between the security association and actual physical IP addresses. The virtual addresses remain constant in the security association while acting as mediators that can be mapped to different actual addresses, allowing the session to persist even when physical addresses change due to failover or load balancing.
Solution Approach 2:
The patent creates virtual copies of IP addresses that represent the security association endpoints. These virtual address copies allow the security association to reference stable logical addresses rather than volatile physical addresses, enabling the system to maintain session state while the actual underlying addresses may change.
2Adaptability or versatility
If conventional security associations are used with actual IP addresses, then authentication can be performed, but failover and load balancing across multiple paths are prevented
Solution Approach 1:
The patent segments the address space into two distinct layers: virtual addresses for security associations and actual addresses for physical interfaces. This segmentation allows independent management of each layer, enabling complex path configurations while keeping the security association layer simple and stable.
Solution Approach 2:
The virtual address acts as an intermediary layer between the security association logic and the physical networking layer. This intermediary enables multiple actual addresses to be associated with a single virtual address, facilitating failover and load balancing without requiring changes to the security association.
3Adaptability or versatility
If virtual addresses are used for security associations, then seamless failover and load balancing are enabled, but packet interception and modification are required
Solution Approach 1:
The patent performs preliminary address mapping configuration before packets are transmitted. By pre-establishing the virtual-to-actual address mappings in security associations and routing tables, the system minimizes real-time processing complexity during packet forwarding, requiring interception and modification only when address translation is needed.
Data Source
AI summary
Instead of specifying actual transport layer IP addresses as a basis for a secure tunnel's security association, an approach described herein specifies virtual addresses. Then suitable network appliances intercept and modify packets in order to map between the virtual addresses and actual addresses. The virtual addresses satisfy IPsec or another authentication procedure that checks packets using the security association. The actual addresses are used by transport layer protocols. This overlay approach permits a session to failover from one network connection to another without requiring restoration of the session in a newly created secure tunnel after one of the network interfaces becomes unavailable, thereby obsoleting the security association based in part on the IP address of the now unavailable interface. This innovative approach also allows the use of parallel paths and the use of one-to-many or many-to-one path topologies, which would otherwise not be permitted.