Cisco Technology, Inc.

Mocana Corporation

Blue Cedar Networks, Inc.

Kenneth John Wante

Timothy Steven Champagne

Peter Scott Davis

John Bazzinotti

Brian H Pescatore

Dany J Rochefort

Richard C Wade

Kevin P Fox

Daniel Murphy

Computational complexity, specifically, cryptographic operations, is removed from the IKE(Internet Key Exchange) process in a VPN gateway appliance, thereby enabling scaling of the number of datapaths that can be managed by a single IKE process. A two-tier cache configuration enables necessary cryptographic operations on packets in the gateway but does so without placing additional computational burdens on the IKE process. One cache containing security association data is local to the IPSec component of the datapath instance. The second cache is higher level and is populated by IKE with security association data upon completion of IKE Phase 2 negotiations. The local cache is searched first for security policy data and if found is used to encrypt/decrypt the data packet. If not found locally, the IKE centralized cache is searched and if found, the local cache is updated with the security association data.

Simplifying IKE process in a gateway to enable datapath scaling using a two tier cache configuration

A VPN gateway device is able to assign, manage, and terminate a large volume of connections from apps executing on devices, enabling a large scale per-app VPN mobile environment. When a mobile device user opens an app on a mobile device, a VPN gateway transmits a unique IP address to the app. The gateway also transmits an app federation cookie to the app. The app shares the app federation cookie with a second app. The VPN gateway then assigns the second app the same unique IP address. The gateway then transmits a range of ports to the first app. The app uses a port in the range of ports for data transmission from the device to the VPN gateway. The gateway receives a data transmission from the first app via a VPN and determines that the data transmission originated from the first app based on the source port.

Gateway device for terminating a large volume of VPN connections

In a virtual private network, a plurality of concentrators form an interface to provide client/remote site access to a private network over a public network. The plurality of concentrators are grouped into a virtual cluster. Each concentrator in the virtual cluster has an IP address and the virtual cluster has a virtual IP address. In operation, one of the plurality of concentrators assumes the virtual IP address and acts as the master device in the cluster. When a client attempts a connection to the private network, the client addresses an initial request to the virtual IP address. The master device responds to the client request by transmitting to the client the IP address of a concentrator in the cluster selected to handle the connection.

Method and apparatus for load balancing in a virtual private network

A client device establishes a virtual private network connection with a central site or network through a master concentrator. The master concentrator transmits state information, relating to the virtual private network connection, to a backup concentrator. In the event the master concentrator fails during a communications session between the client device and the network, the backup concentrator maintains the communication session between the client device and the network over the virtual private network connection using the connection state information received from the master concentrator. Such a configuration allows for failover of a virtual private network connection from the master concentrator to the backup concentrator without requiring the client device to re-establish the virtual private network connection with the central site or network. The configuration also allows the client device to maintain an existing communications session with the network.

Methods and apparatus for maintaining a virtual private network connection

A packet quarantine device receives a data packet over a secure connection having a connection-specific set of security parameters such as an IPsec connection in a virtual private network (VPN) using security associations. The packet quarantine device tests the data packet and if the data packet fails to validate, the packet quarantine device saves the data packet to a storage area along with the set of security parameters used to transmit the data packet. The stored information of the failed packet along with the set of security parameters enables later analysis of the failed packet in order to determine the network condition that produced the failed data packet. The packet quarantine device also generates alerts in response to receiving data packets that fail to validate. The alerts include information obtained from packet analysis.

Growing community of inventors

Bellingham, MA, United States of America

Kenneth John Wante