VPN Concentrator IPsec Tunnel Prioritization for Connection Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN concentrator systems face limitations in scalability and efficiency due to the need for persistent security protocol tunnels, where only one IPsec session is active while others are redundant, leading to a limited number of concurrent connections.
Innovation Solution
An adaptive IPsec management system that identifies and maintains only the highest priority IPsec tunnel, dynamically adding or removing backup tunnels based on active status, allowing for increased concurrent connections by managing fully qualified domain names (FQDNs) and capacity thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If persistent security protocol tunnels are maintained for all possible connections, then security coverage is improved, but system scalability deteriorates due to limited concurrent connections
Solution Approach 1:
The patent implements dynamic tunnel management where the VPN concentrator actively monitors the status of IPsec tunnels and dynamically adds or removes tunnel configurations based on current network conditions. This allows the system to maintain security coverage for potential connections while only actively maintaining necessary tunnels, thereby supporting more concurrent connections.
Solution Approach 2:
The system changes the operational state parameter of tunnel configurations from persistent to conditional. By monitoring tunnel status and transitioning configurations between active and removed states based on current needs, the system optimizes the balance between security coverage and connection capacity.
2Reliability
If multiple IPsec tunnels are maintained as backup, then system reliability is improved, but device complexity increases due to redundant configurations
Solution Approach 1:
The patent implements a configuration management approach where backup tunnel configurations are discarded (removed from the concentrator) when not currently needed, and recovered (added back) when required for failover. This reduces the number of persistent configurations the device must manage while maintaining reliability through on-demand configuration recovery.
Solution Approach 2:
The system extracts and removes unnecessary tunnel configurations from the VPN concentrator, keeping only the essential active tunnel and removing backup configurations until they are needed. This reduces configuration complexity while maintaining the ability to restore reliability when primary tunnels fail.
3Adaptability or versatility
If all tunnel configurations are maintained at the VPN concentrator, then adaptability is improved, but loss of information occurs due to memory constraints limiting concurrent connections
Solution Approach 1:
The patent implements dynamic configuration management where the VPN concentrator monitors tunnel status and dynamically adjusts the number of stored tunnel configurations based on current active connections and memory availability. This allows the system to maintain adaptability for required tunnels while preventing memory exhaustion by removing unnecessary configurations.
Data Source
AI summary
This disclosure describes systems, methods, and devices related to managing Internet Protocol Security (IPsec) for virtual private network (VPN) concentrators. A method may include: identifying, by an edge gateway backend system, a first IPsec tunnel, a second IPsec tunnel, and a third IPsec tunnel between a VPN client and a VPN concentrator of the edge gateway backend system; determining, by the edge gateway backend system, that the first IPsec tunnel is a highest priority tunnel between the VPN client and the VPN concentrator; determining, by the edge gateway backend system, that the highest priority tunnel between the VPN client and the VPN concentrator is active; and deactivating, by the edge gateway backend system, fully qualified domain names of the second IPsec tunnel and the third IPsec tunnel from the VPN concentrator based on the determination that the highest priority tunnel between the VPN client and the VPN concentrator is active.