VPN TCP Connection Splitting for MSS and Tunnel Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
TCP performance degradation in VPN connections due to encapsulation overhead, leading to reduced throughput and increased retransmission timeouts, especially in multi-hop networks with varying network conditions.
Innovation Solution
Splitting the end-to-end TCP connection into two segments at the VPN concentrator, optimizing each segment's parameters independently to minimize encapsulation overhead and improve throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single end-to-end TCP connection is used across VPN tunnel, then connection simplicity is maintained, but throughput is reduced due to encapsulation overhead
Solution Approach 1:
The patent divides the single end-to-end TCP connection into two separate TCP connections: one between the VPN client and VPN concentrator, and another between the VPN concentrator and the target server. This segmentation allows each connection to be optimized independently, with the second connection having larger MSS values since it doesn't traverse the VPN tunnel encapsulation overhead, thereby improving overall throughput.
Solution Approach 2:
The VPN concentrator acts as an intermediary that terminates the first TCP connection and initiates the second TCP connection to the target server. The concentrator handles packet conversion between the two connections, managing the transition and ensuring seamless data flow while optimizing parameters for each segment.
2Reliability
If TCP connection parameters are optimized for VPN tunnel conditions, then reliability over VPN is improved, but performance on direct connections deteriorates
Solution Approach 1:
The patent applies different Maximum Segment Size (MSS) values to different TCP connections based on their specific conditions. The first connection (over VPN tunnel) uses a smaller MSS appropriate for encapsulated packets, while the second connection (direct to target server) uses a larger MSS optimized for direct transmission, allowing each connection to operate at optimal performance for its specific path.
3Stability of the object's composition
If encapsulation overhead is accounted for in MSS calculation, then packet fragmentation is prevented, but available payload space is reduced
Solution Approach 1:
The patent segments the data transmission into two paths with different MSS settings. The first connection uses reduced MSS to account for VPN encapsulation overhead and prevent fragmentation, while the second connection uses larger MSS since it bypasses the tunnel. This segmentation allows the system to optimize for packet integrity where needed while maximizing payload capacity where possible.
Data Source
AI summary
A request from a virtual private network user device (VPN user device) to establish a connection with a target device is received. A first connection with the VPN user device via a VPN tunnel is established. A second connection with the target device that is not within the VPN tunnel is established. Whether the first connection is subject to encapsulation related overhead associated with the VPN tunnel is determined. A first maximum segment size (MSS) for the first connection based on the encapsulation related overhead is set. A second MSS for the second connection based on absence of VPN encapsulation overhead is set. Data between the VPN user device and the target device via the first and second connections is transmitted, where the first MSS is selected to prevent packet fragmentation within the VPN tunnel and the second MSS is selected to optimize payload size outside the VPN tunnel.