IP security with seamless roaming and load balancing
View Patent ↗Described are a method and system for seamless roaming of a mobile node during a VPN session. A VPN session between the mobile node and a current VPN server in a network is established and synchronized with at least one fail-over VPN server in the network. An address change message is sent to the current VPN server and the fail-over VPN servers upon roaming of the mobile node. A fail-over VPN server responds with a reply message and is registered as a current VPN server for continuation of the VPN session. To load balance, a load query message is sent to the current VPN server and the fail-over VPN servers. Reply messages include server performance characteristics of the VPN servers. The VPN session can be transferred from the current VPN server to a fail-over VPN server in response to the server performance characteristics.
1. A method for seamless roaming of a mobile node during a Virtual Private Network (VPN) session, the method comprising:
synchronizing a VPN session between a gateway VPN server situated as an intermediary between a public network and a private network and an internal VPN server of the private network, the VPN session currently established between the mobile node and the internal VPN server;
receiving a message from the mobile node at the gateway VPN server upon the mobile node determining the internal VPN server is unreachable as the mobile node roams from the private network to the public network, wherein the message indicates a change in the mobile node's IP Address, wherein the message is one of a plurality of messages sent from the mobile node to a plurality of respective VPN servers;
sending a reply message from the gateway VPN server to the mobile node, the reply message comprising server performance characteristics information for the respective VPN server;
receiving a registration from the mobile node at the gateway VPN server, wherein the registration signifies the gateway VPN server as the mobile node's current VPN server for the VPN session, the registration sent from the mobile node based on the server performance characteristics information in the reply message and due to the gateway VPN server's reply being a first reply message received by the mobile node;
receiving traffic from the VPN session at the gateway VPN server; and
sending a request from the gateway VPN server to the internal VPN server to terminate the internal VPN server's participation in the VPN session.
2. The method of claim 1 wherein the VPN session is an IPSec session.
3. A non-transitory computer readable storage medium comprising executable instructions encoded thereon operable on a computerized device to perform processing comprising:
synchronizing a VPN session between a gateway VPN server situated as an intermediary between a public network and a private network and an internal VPN server of the private network, the VPN session currently established between the mobile node and the internal VPN server;
receiving a message from the mobile node at the gateway VPN server upon the mobile node determining the internal VPN server is unreachable as the mobile node roams from the private network to the public network, wherein the message indicates a change in the mobile node's IP Address, wherein the message is one of a plurality of messages sent from the mobile node to a plurality of respective VPN servers;
sending a reply message from the gateway VPN server to the mobile node, the reply message comprising server performance characteristics information for the respective VPN server;
receiving a registration from the mobile node at the gateway VPN server, wherein the registration signifies the gateway VPN server as the mobile node's current VPN server for the VPN session, the registration sent from the mobile node based on the server performance characteristics information in the reply message and due to the gateway VPN server's reply being a first reply message received by the mobile node;
receiving traffic from the VPN session at the gateway VPN server; and
sending a request from the gateway VPN server to the internal VPN server to terminate the internal VPN server's participation in the VPN session.
4. The non-transitory computer readable storage medium of claim 3 wherein the VPN session is an IPSec session.
5. A computer system comprising:
a processor;
a memory unit that stores instructions associated with an application executed by the processor; and
an interconnect coupling the processor and the memory unit, enabling the computer system to execute the application and perform operations of:
synchronizing a VPN session between a gateway VPN server situated as an intermediary between a public network and a private network and an internal VPN server of the private network, the VPN session currently established between the mobile node and the internal VPN server;
receiving a message from the mobile node at the gateway VPN server upon the mobile node determining the internal VPN server is unreachable as the mobile node roams from the private network to the public network, wherein the message indicates a change in the mobile node's IP Address, wherein the message is one of a plurality of messages sent from the mobile node to a plurality of respective VPN servers;
sending a reply message from the gateway VPN server to the mobile node, the reply message comprising server performance characteristics information for the respective VPN server;
receiving a registration from the mobile node at the gateway VPN server, wherein the registration signifies the gateway VPN server as the mobile node's current VPN server for the VPN session, the registration sent from the mobile node based on the server performance characteristics information in the reply message and due to the gateway VPN server's reply being a first reply message received by the mobile node;
receiving traffic from the VPN session at the gateway VPN server; and
sending a request from the gateway VPN server to the internal VPN server to terminate the internal VPN server's participation in the VPN session.