Adaptive transition between layer three and layer four network tunnels
View Patent ↗Adaptive failover occurs between a Layer Three (L3) based network tunnel and a Layer Four (L4) based network tunnel. An example of a L4 based network tunnel is a Secure Sockets Layer (SSL) tunnel and an example of a L3 based network tunnel is an Internet Protocol Security (IPSec) tunnel. SSL tunnels work through most firewalls and proxies, but may introduce latency and other performance problems. IPSec tunnels provide a more efficient performance, but may not work through some firewalls and proxies. The techniques include dynamically selecting a tunneling protocol in order to achieve a more efficient network tunnel performance when possible while maintaining consistent L3 connectivity from a variety of remote network environments.
1. A method for controlling an active data channel of a user device for a virtual private network (VPN), the method comprising:
executing a virtual private network (VPN) software client within an operating system of a user device;
authenticating a user of the user device to a remote private network with the VPN software client;
after authenticating the user, establishing, with the VPN software client, both a layer three (L3) based tunnel and a layer four (L4) based tunnel over a network from the user device to the remote private network, wherein establishing both the L3 based and L4 based tunnels comprises creating a respective adapter for each of the tunnels on the user device;
using the L4 based tunnel as an active data channel for the VPN by transmitting data packets to the remote private network over the L4 based tunnel;
while using the L4 based tunnel as the active data channel for the VPN by transmitting data packets to the remote private network over the L4 based tunnel, transmitting a test message with the VPN software client with the L3 based tunnel using the respective adapter of the L3 based tunnel and setting the L3 based tunnel as the active data channel for the VPN when a reply to the test message is received from the remote private network; and
after setting the L3 based tunnel as the active data channel, transmitting data packets to the remote private network with the VPN software client with the L3 based tunnel using the respective adapter of the L3 based tunnel and setting the L4 based tunnel as a non-active data channel.
2. The method of claim 1 , wherein the L3 based tunnel comprises an Internet Protocol Security (IPSec) tunnel.
3. The method of claim 2 , wherein transmitting an encapsulated communication with the L3 based tunnel comprises:
encapsulating data packets within an Encapsulation Security Protocol (ESP) encrypted packet stream; and
tunneling the ESP packet stream using the Internet Protocol (IP) or the User Datagram Protocol (UDP).
4. The method of claim 1 , wherein the L4 based tunnel comprises a Secure Sockets Layer (SSL) tunnel.
5. The method of claim 4 , further comprising:
encapsulating data packets within a SSL encrypted packet stream; and
tunneling the SSL packet stream using the Transport Control Protocol (TCP).
6. The method of claim 1 , wherein determining whether communication with the L3 based tunnel through the network is successful comprises sending test messages on the L3 based tunnel with the VPN software client of the user device.
7. The method of claim 1 , further comprising:
authenticating user login information; and
sending data packets from the authenticated user across the network on one of the L3 based tunnel or the L4 based tunnel.
8. The method of claim 7 , wherein the data packets comprise L3 data packets.
9. The method of claim 8 , wherein the L3 data packets comprise Internet Protocol (IP) data packets.
10. A non-transitory computer-readable storage medium comprising instructions that cause a programmable processor to:
execute a virtual private network (VPN) software client within an operating system of a user device;
authenticate a user of the user device to a remote private network with the VPN software client;
after authenticating the user, establish a layer three (L3) based tunnel and a layer four (L4) based tunnel over a network from the user device to the remote private network;
use the L4 based tunnel as an active data channel for the VPN by transmitting data packets to the remote private network over the L4 based tunnel;
while using the L4 based tunnel as the active data channel for the VPN by transmitting data packets to the remote private network over the L4 based tunnel, transmit a test message with the VPN software client with the L3 based tunnel and set the L3 based tunnel as the active data channel when a reply to the test message is received from the remote private network prior to failure of the L4 based tunnel; and
after setting the L3 based tunnel as the active data channel, transmit data packets to the remote private network with the VPN software client with the L3 based tunnel using the L3 based tunnel and setting the L4 based tunnel as a non-active data channel.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the L3 based tunnel comprises an Internet Protocol Security (IPSec) tunnel.
12. The non-transitory computer-readable storage medium of claim 11 , further comprising instructions that cause the programmable processor to:
encapsulate data packets within an Encapsulation Security Protocol (ESP) encrypted packet stream; and
tunnel the ESP packet stream using the Internet Protocol (IP) or the User Datagram Protocol (UDP).
13. The non-transitory computer-readable storage medium of claim 10 , wherein the L4 based tunnel comprises a Secure Sockets Layer (SSL) tunnel.
14. The non-transitory computer-readable storage medium of claim 13 , further comprising instructions that cause the programmable processor to:
encapsulate data packets within a SSL encrypted packet stream; and
tunnel the SSL packet stream using the transport Control Protocol (TCP).
15. The non-transitory computer-readable storage medium of claim 10 , further comprising instructions that cause the programmable processor to:
authenticate user login information; and
send data packets from the authenticated user across the network on one of the L3 based tunnel and the L4 based tunnel.
16. A device comprising:
a processor;
an operating system executing on the processor;
a virtual private network (VPN) software client integrated with the operating system that establishes both a layer three (L3) based VPN tunnel and a layer four (L4) based VPN tunnel over a network from the device to a remote private network,
wherein the VPN software client integrated with the operating system uses the L4 based VPN tunnel as an active data channel to send initial data packets by transmitting data packets to the remote private network over the L4 tunnel,
wherein, while using the L4 based VPN tunnel as the active data channel by transmitting data packets to the remote private network over the L4 based VPN tunnel, the VPN software client sends a test message on the L3 based VPN tunnel,
wherein, while using the L4 based VPN tunnel as the active data channel by transmitting data packets to the remote private network over the L4 based VPN tunnel, the VPN software client sets the L34 based VPN tunnel as the active data channel for the VPN when a reply to the test message is received from the remote private network, and
wherein, after setting the L3 based tunnel as the active data channel, the VPN software client transmits data packets from the device to the remote private network using the respective adapter for the L3 based VPN tunnel and sets the L4 based tunnel as a non-active data channel.
17. The device of claim 16 , wherein the VPN software client includes a control channel that establishes the L3 based VPN tunnel and the L4 based VPN tunnel between the device and the remote private network.
18. The device of claim 16 , wherein the VPN software client includes a single control channel for both a L3 based tunneling protocol and a L4 based tunneling protocol, and a single data channel for both the L3 based tunneling protocol and the L4 based tunneling protocol.
19. The device of claim 18 , further comprising a signaling mechanism between the L3 based tunneling protocol and the L4 based tunneling protocol within the control channel.
20. The device of claim 16 , wherein the client includes a L3 based control channel, a L4 based control channel, a L3 based data channel, and a L4 based data channel.
21. The device of claim 20 , wherein the L3 based control channel and the L4 based control channel negotiate to decide on which of the L3 based tunnel and the L4 based tunnel to send data packets, and the control channel associated with the selected tunnel notifies the data channel of the selected tunnel that it is the active data channel.
22. The device of claim 20 , wherein the L3 based control channel and the L4 based control channel negotiate to decide on which of the L3 based tunnel and the L4 based tunnel to send data packets, and the control channel associated with the selected tunnel notifies the associated data channel that it is the active data channel.
23. The device of claim 16 , wherein the device includes:
a control channel that authenticates login information from a user; and
a data channel that sends data packets from the authenticated user across the network on one of the L3 based tunnel and the L4 based tunnel.
24. The device of claim 23 , wherein the data packets comprise L3 data packets.
25. The device of claim 24 , wherein the L3 data packets comprises Internet Protocol (IP) data packets.
26. The device of claim 16 , wherein the device comprises one of a desktop computer, a laptop, a workstation, a personal digital assistant (PDA), a wireless device, a network-ready appliance, a file server, or a print server.
27. The method of claim 1 , further comprising allocating a separate IP address to each adapter on the user device.
28. A method for controlling an active data channel of a user device for a virtual private network (VPN), the method comprising:
executing a virtual private network (VPN) software client within an operating system of a user device;
authenticating a user of the user device to a remote private network with the VPN software client;
after authenticating the user, establishing, with the VPN software client, a first tunnel and a second tunnel over a network from the user device to the remote private network, wherein the first tunnel of the VPN uses a Transmission Control Protocol (TCP) as a connection oriented transport protocol to communicate tunneled packets to the remote private network, and wherein the second tunnel of the VPN uses a User Datagram Protocol as a connectionless transport protocol to communicate tunneled packets to the remote private network;
using the first tunnel as an active data channel for the VPN for transmitting data packets to the remote private network using the connection oriented transport protocol;
while using the first tunnel as the active data channel for the VPN by transmitting data packets to the remote private network over the first tunnel, transmitting a test message with the VPN software client with the second tunnel and setting the second tunnel as the active data channel for the VPN when a reply to the test message is received from the remote private network; and
after setting the second tunnel as the active data channel, transmitting data packets to the remote private network with the VPN software client with the second tunnel using the connectionless transport protocol and setting the first tunnel as a non-active data channel.