VPN Tunnel Routing for Mixed Encrypted and Unencrypted Streams

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing VPN protocols face challenges in efficiently managing a combination of unencrypted and encrypted streams, leading to overhead and reduced maximum throughput.

Innovation Solution

A system and method for establishing VPN tunnels with a session table to differentiate between destination addresses that require encryption or not, routing unencrypted streams over an outer VPN channel and encrypted streams over an inner VPN channel, and bypassing encryption/decryption where applicable.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all VPN traffic is encrypted to ensure security, then security is improved, but processing overhead increases and throughput decreases

Engineering Contradiction:

ImprovesecurityVSAvoidthroughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments VPN traffic into two distinct categories: encrypted traffic and unencrypted traffic. By creating separate processing paths for each type, the system avoids applying encryption overhead to traffic that does not require it, thereby improving throughput while maintaining security for sensitive traffic streams.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies different quality treatments to different portions of VPN traffic based on their specific requirements. Sensitive traffic receives full encryption processing, while non-sensitive traffic bypasses encryption. This localized quality approach optimizes resource allocation and reduces unnecessary processing overhead.

Inventive Principle:

Principle #3Local quality

2Reliability

If encryption is applied to all VPN streams to maintain security standards, then security is improved, but processing overhead increases

Engineering Contradiction:

ImprovesecurityVSAvoidprocessing overhead

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent extracts the encryption processing step from the universal VPN traffic handling process. By identifying and separating traffic that does not require encryption, the system removes unnecessary processing overhead while maintaining security protocols for traffic that genuinely needs encryption protection.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies encryption selectively based on the specific requirements of each traffic stream rather than uniformly to all traffic. This localized quality approach ensures that security resources are concentrated where needed while minimizing energy consumption and processing overhead in other areas.

Inventive Principle:

Principle #3Local quality

3Productivity

If a session table is used to track destination addresses for VPN routing, then routing efficiency is improved, but device complexity increases

Engineering Contradiction:

Improverouting efficiencyVSAvoidsession table management

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent performs preliminary actions by pre-populating the session table with destination addresses and their corresponding encryption requirements before traffic arrives. This advance preparation enables rapid routing decisions without requiring complex real-time analysis, improving routing efficiency while keeping the management complexity manageable.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260006004A1Virtual private network (VPN) tunneling over a data network combining both encrypted and unencrypted data streams

Publication Date: 2026.01.01 FORTINET INC

AI summary

For a new network session, it is determined whether to encrypt prior to transmitting over the VPN channel. Unencrypted is sent over the outer VPN channel and encrypted is sent over the inner VPN channel. The inner VPN channel is established over the outer VPN channel. A session table is updated with the new session. Responsive to being sent over the unencrypted VPN channel, encryption is bypassed prior to transmitting over the unencrypted VPN channel, and responsive to being sent over the encrypted VPN channel, sends the new session for encryption prior to transmitting over the encrypted VPN channel. The unencrypted VPN channel also bypasses decryption upon receipt.