Vpnet Technologies, Inc.

Network Appliance, Inc.

Avaya Inc.

Henk J Bots

William E Hunt

Derek A Palma

Mark R Hoke

Leslie J Arrow

John Lawler

Russell C Jones

Mark Smith

Gaurav Banga

Quentin C Liu

Bruce T Huntley

Protocols and architecture for secure virtual private networks. Intraenterprise data communications are supported in a secure manner over the Internet or other public network space with the implementation of secure virtual private networks. Members of a virtual private network group exchange data that may be compressed, encrypted and authenticated, if the exchange is between members of the group.

Architecture for virtual private networks

The invention provides a method and process for transmitting data without using additional CPU cycles and memory accesses to calculate checksums. The transmitting device obtains data from internal or external data source and stores data in memory. Data is then divided into zones and checksums are calculated for each zone. Checksums are recorded on a checksum array. A data pointer containing an address for data stored in memory, a description of the data and address for the checksum array is transferred through data transfer protocol to network and transmission layers. Network and transmission layers are then able to access and send data without having to either copy data through data transfer protocol to network and transfer layers or read all of the data to calculate the checksums. This method and process uses fewer CPU cycles and memory accesses to transmit data and is, therefore, more efficient than the prior art.

System to limit access when calculating network data checksums

A method of generating IP identification numbers for IP datagrams. A plurality of IP identification number generators are maintained. A plurality of receiving stations are associated with the plurality of IP identification number generators such that each receiving station has an IP identification number generator associated therewith. An IP identification number is generated for a datagram sent to a receiving station based on an output of the associated IP identification number generator. Also, a method of reducing a likelihood of misassembly of received data fragments from fragmented IP datagrams. The data fragments have an IP identification number. All received data fragments of the datagram are discarded upon detection of receipt of an overlapping data fragment having the IP identification number. Timeouts for reassembling datagrams are reduced. First, timeouts for reassembling the datagrams are reduced to less than a standard timeout. Second, timeouts are reduced upon detection of a gap in the received data fragments. Third, timeouts are reduced upon detection of a datagram having the same protocol identification number and source address, but having a different IP identification number. Furthermore, a method of detecting a likelihood of misassembly of data fragments from fragmented IP datagrams. Communication errors between a sending station and a receiving station are detected. A rate is determined at which an IP identification number generator associated with the receiving station wraps around. NFS re-transmissions are determined. Based on one or more of these, a likelihood of misassembly at the receiving station is determined to be high.

Prevention and detection of IP identification wraparound errors

The invention provides a method and process for transmitting data without using additional CPU cycles and memory accesses to calculate checksums. The transmitting device obtains data from an internal or external data source and stores that data in memory. The data is then divided into zones and checksums are calculated for each zone. The checksums are recorded on a checksum array. A data pointer containing an address for the data stored in memory, a description of the data and an address for the checksum array is transferred through data transfer protocol to network and transmission layers. The network and transmission layers are then able to access and send the data without having to either copy the data through data transfer protocol to network and transfer layers or read all of the data to calculate the checksums. This method and process uses fewer CPU cycles and memory accesses to transmit data and is, therefore, more efficient than the prior art.

System to limit memory access when calculating network data checksums

The present invention provides a method and an apparatus for establishing a virtual private network that operates over a public data network. One embodiment of the present invention includes a system that selects a plurality of entities coupled to the public data network to include in the virtual private network. The system next assembles a plurality of identifiers for the plurality of entities. These identifiers are used to identify communications between the plurality of entities, so that these communications can be transferred securely over the public data network. A variation on this embodiment includes defining encryption, authentication and compression parameters for the virtual private network. In another variation, selecting the plurality of entities includes, assembling entities coupled to the public data network into groups, and selecting groups of entities to include in the virtual private network. Another variation includes defining access control rules specifying types of communications that are allowed to pass through virtual private network units. These virtual private network units are typically used to couple local area networks to the public network so that secure communications on the public network pass through the virtual private network units. Yet another variation on this embodiment includes defining address translation rules for virtual private network units coupled to the public data network. These address translation rules are used to translate local network addresses to public network addresses.

Method and apparatus for configuring a virtual private network

One embodiment of the present invention provides a computer system with a plurality of storage memories, each storage memory storing an operating system program, and an identifier for identifying a storage memory containing an operating system program to be loaded when the unit is booted. The identifier is selectively switchable between storage memories so that the computer system may be selectively booted with an alternate operating system program. This facilitates loading a new version of an operating system, and then rapidly switching back to an old version of the operating system if the new version fails to function properly.

Method and apparatus for swapping a computer operating system

One embodiment of the present invention includes a system that translates addresses in a data packet based upon a user identifier in the data packet. The system receives the data packet sent from a source node to a destination node by a user. This data packet includes a source address of the source node, a destination address of the destination node and the user identifier that identifies the user. The system uses the user identifier to look up communication privileges associated with the user. If the communication privileges allow the user to communicate with the destination node, the system replaces the source address in the data packet with a privileged address, and forwards the data packet to the destination node. In a variation on this embodiment, the privileged address is recognized by a system firewall so that it facilitates passage of the packet through firewall. In another variation, the privileged address specifies a return address of a given address translation unit and thereby facilitates load balancing across multiple address translation units. In a further variation, the system receives a reply packet from the destination node directed to the privileged address, and replaces the privileged address in the reply packet with the source address so that the reply packet is directed to the source node, before forwarding the reply packet to the source node. In another variation, receiving the reply packet includes acting as a proxy for the privileged address under the address resolution protocol. Another variation further includes authenticating, encrypting and optionally compressing the data packet.

Growing community of inventors

Hollister, CA, United States of America

Henk J Bots