Intelligent sorting for N-way secure split tunnel
View Patent ↗A method of intelligently sorting packets/datagrams for sending through appropriate branches of a N-way split VPN tunnel according to embodiments of the present invention allow for efficient movement of network traffic to and from a remote network location. Intelligent sorting may be based on a wide range of criteria in order to implement different policies. For example, datagrams may be sorted for sending through the branches of a 3-way split tunnel so that all traffic from a remote network location ultimately destined to servers at a central location may be sent via a secure VPN tunnel, all traffic that matches a “white-list” of trusted external sites may be sent directly to and from these sites to the remote network location, and all other traffic may be redirected through a Web service that scrubs and filters the traffic to/from questionable sites. Furthermore, the VPN tunnel may be chosen to minimize latency, to detour around network failures, or to conserve energy by minimizing the number of routers a datagram passes through.
1. A method of managing computer network traffic from a remote network location to at least three destinations, said destinations including a central network location, a scanning service website and websites with approved Internet protocol addresses, wherein said computer network traffic travels to said destinations along a split virtual private network tunnel originating at said remote network location, said method comprising:
sorting outgoing datagrams into one of at least three categories using a computer processor at said remote location, wherein a first category is datagrams addressed to said central network location, a second category is datagrams addressed to any of said approved Internet protocol addresses, and a third category is datagrams addressed to any other Internet protocol addresses;
sending datagrams in said first category directly to said central network location along said split virtual private network tunnel, using said computer processor;
sending datagrams in said second category directly to said approved Internet protocol addresses along said split virtual private network tunnel, using said computer processor; and
sending datagrams in said third category to said scanning service website along said split virtual private network tunnel, using said computer processor.
2. A method as in claim 1 , wherein said sorting includes said processor comparing an Internet protocol destination address in one of said datagrams with said approved Internet protocol addresses in a look-up table in a memory device at said remote network location.
3. A method as in claim 1 , further comprising generating a look-up table of said approved Internet protocol addresses using said processor, said generating including:
comparing a web destination address in one of said datagrams with a list of approved fully-qualified domain names in a memory device at said remote network location;
resolving an Internet protocol address for said destination web address; and
if said web destination address is on said list of approved fully-qualified domain names, adding said Internet protocol address to said look-up table.
4. A method as in claim 3 , wherein said list of fully-qualified domain names is updated automatically from a web service provider over the Internet.
5. A method as in claim 1 , wherein said split virtual private network tunnel is a secure virtual private network tunnel.
6. A method as in claim 1 , wherein said sending datagrams in said third category includes sending credentials with said datagrams, said credentials providing account information to said scanning service web site.
7. A method as in claim 1 , wherein said scanning service website blocks datagrams addressed to a predetermined category of websites.
8. A method as in claim 1 , wherein said scanning service website scrubs datagrams sent from an un-trusted website before forwarding to a user at said remote network location.
9. A method as in claim 8 , wherein said scanning service website provides the service of detection and/or removal of computer viruses, Trojan horses, worms and other malware.
10. A method as in claim 1 , further comprising selecting said split virtual private network tunnel according to a first measured criteria using the computer processor at said remote location.
11. A method as in claim 10 , wherein said first measured criteria is selected from a group consisting of latency, network failure, hop count and energy usage.
12. A method as in claim 10 , wherein said first measured criteria is measured at least once every time interval, said time interval being within the range of five seconds to one hour.
13. A method as in claim 10 , wherein said selecting includes accounting for long term trends in said first measured criteria.
14. A method as in claim 10 , wherein said selecting includes accounting for a second measured criteria, said second measured criteria being a measure of an efficacy of previous selections of said split virtual private network tunnel.
15. A non-transitory computer-readable medium storing a program for managing computer network traffic from a remote network location to at least three destinations, said destinations including a central network location, a scanning service website and websites with approved Internet protocol addresses, wherein said computer network traffic travels to said destinations along a split virtual private network tunnel originating at said remote network location, said program causing a computer processor at said remote network location to perform:
sorting outgoing datagrams into one of at least three categories using a computer processor at said remote location, wherein a first category is datagrams addressed to said central network location, a second category is datagrams addressed to any of said approved Internet protocol addresses, and a third category is datagrams addressed to any other Internet protocol addresses;
sending datagrams in said first category directly to said central network location along said split virtual private network tunnel;
sending datagrams in said second category directly to said approved Internet protocol addresses along said split virtual private network tunnel; and
sending datagrams in said third category to the scanning service web site along said split virtual private network tunnel.
16. A networking device at a remote network location for managing computer network traffic from the remote network location to at least three destinations, said destinations including a central network location, a scanning service website and websites with approved Internet protocol addresses, wherein said computer network traffic travels to said destinations along a split virtual private network tunnel originating at said remote network location, said networking device comprising:
a memory device, a computer program being stored in said memory device; and
a processor, said computer program causing said processor to perform:
sorting outgoing datagrams into one of at least three categories, wherein a first category is datagrams addressed to said central network location, a second category is datagrams addressed to any of said approved Internet protocol addresses, and a third category is datagrams addressed to any other Internet protocol addresses;
sending datagrams in said first category directly to said central network location along said split virtual private network tunnel;
sending datagrams in said second category directly to said approved Internet protocol addresses along said split virtual private network tunnel; and
sending datagrams in said third category to said scanning service web site along said split virtual private network tunnel.
17. A networking device as in claim 16 , wherein said networking device is integrated in an end-user computer.
18. A networking device as in claim 17 , wherein said networking device is a virtual machine hypervisor in said end-user computer.
19. A networking device as in claim 16 , wherein said sorting includes said processor comparing an Internet protocol destination address in one of said datagrams with said approved Internet protocol addresses in a look-up table in said memory device.
20. A networking device as in claim 16 , further comprising generating in said memory device a look-up table of said approved Internet protocol addresses using said processor, said generating including:
comparing a web destination address in one of said datagrams with a list of approved fully-qualified domain names in said memory device;
resolving an Internet protocol address for said destination web address; and
if said web destination address is on said list of approved fully-qualified domain names, adding said Internet protocol address to said look-up table.