Dynamic VPN Client Timeout Detection Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network controller devices detect inactive Internet Key Exchange (IKE) peers based on static timeout values, which hinders early detection and efficient resource management in Virtual Private Network (VPN) systems.
Innovation Solution
A network device dynamically determines a timeout value for each client based on its communication patterns, using periodic messages and Dead Peer Detection (DPD) schemes to identify inactive clients and terminate connections proactively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If a static timeout value is used to detect inactive IKE peers, then the detection mechanism is simple to implement, but early detection of inactive peers is prevented and network resources cannot be freed timely
Solution Approach 1:
The patent transforms the static timeout value into a dynamic parameter that adapts to each IKE peer's communication characteristics. The system monitors message intervals between peers and automatically adjusts timeout values accordingly, enabling early detection of inactive peers while maintaining system adaptability. This resolves the contradiction by making the detection mechanism responsive to actual network conditions rather than relying on fixed configurations.
Solution Approach 2:
The patent changes the timeout parameter from a fixed static value to a dynamically calculated value based on observed message intervals. By continuously monitoring communication patterns and adjusting the timeout parameter accordingly, the system achieves early detection of inactive peers without requiring complex manual configuration or oversight.
2Productivity
If a static timeout value is used, then configuration and operation are simple, but network resource utilization is inefficient due to delayed detection
Solution Approach 1:
The system performs self-service by automatically monitoring message intervals and adjusting timeout values without requiring manual intervention. The detection mechanism autonomously adapts to each peer's communication patterns, freeing network resources timely while maintaining operational simplicity. This resolves the contradiction by enabling the system to optimize itself without increasing operational complexity.
3Loss of time
If dynamic detection based on communication patterns is implemented, then early detection of inactive peers is achieved and resources are freed timely, but the detection and measurement becomes more complex
Solution Approach 1:
The patent implements feedback by continuously monitoring message intervals between IKE peers and using this information to adjust timeout values. The system measures communication patterns, compares them against established thresholds, and dynamically adjusts detection parameters accordingly. This feedback loop enables early detection of inactive peers while managing complexity through automated adaptation rather than manual monitoring.
Data Source
AI summary
The present disclosure discloses a method and network device for dynamic detection of inactive virtual private network clients. Specifically, a network device receives periodic messages from a first device at a first interval, and determines a timeout value for the first device based at least on the first interval, at which the periodic messages are received from the first device. Subsequent to determining the timeout value, the network device detects that a message has not been received from the first device for a period of time corresponding to the timeout value for the first device. The network device then terminates at least one connection with the first device responsive to determining that no message has been received from the first device for the period of time corresponding to the timeout value for the first device.