Intelligent sorting for N-way secure split tunnel
A method of intelligently sorting packets/datagrams for sending through appropriate branches of a N-way split VPN tunnel according to embodiments of the present invention allow for efficient movement of network traffic to and from a remote network location. Intelligent sorting may be based on a wide range of criteria in order to implement different policies. For example, datagrams may be sorted for sending through the branches of a 3-way split tunnel so that all traffic from a remote network location ultimately destined to servers at a central location may be sent via a secure VPN tunnel, all traffic that matches a “white-list” of trusted external sites may be sent directly to and from these sites to the remote network location, and all other traffic may be redirected through a Web service that scrubs and filters the traffic to/from questionable sites. Furthermore, the VPN tunnel may be chosen to minimize latency, to detour around network failures, or to conserve energy by minimizing the number of routers a datagram passes through.
1. A method comprising:
sorting outgoing datagrams into one of at least three categories, wherein the at least three categories include a first category of datagrams addressed to a central network location, a second category of datagrams addressed to destinations on a white list, and a third category of datagrams addressed to other destinations absent from the white list;
sending datagrams in the first category to the central network location along an N-way split virtual private network tunnel, wherein N is an integer greater than or equal to three;
sending datagrams in the second category to the destinations on the white list along the N-way split virtual private network tunnel;
sending datagrams in the third category to a scanning service website along the N-way split virtual private network tunnel, the scanning service website configured to provide a first scrubbing service for HTTP datagrams and a second scrubbing service for SMTP, POP, and IMAP datagrams.
2. The method of claim 1 , comprising:
determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category;
sending the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category along the corresponding branches.
3. The method of claim 1 , comprising determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using network latency of splits of the N-way split virtual private network tunnel.
4. The method of claim 1 , comprising determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using an end-user.
5. The method of claim 1 , comprising determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein an end-user is identified using an authentication datagram transmitted from an end-user device of the end-user.
6. The method of claim 1 , comprising determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using hop count.
7. The method of claim 1 , comprising determining corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using a device type of an end-user device.
8. The method of claim 1 , wherein the white list includes fully-qualified domain names of the destinations on the white list.
9. The method of claim 1 , wherein the white list includes IP addresses mapped to fully-qualified domain names of the destinations on the white list.
10. The method of claim 1 , further comprising sending credentials identifying an end-user's username and a MAC address of an end-user device along with the datagrams in the third category to the scanning service website.
11. A system comprising:
one or more processors;
memory storing a computer program, when executed by the one or more processors, configured to cause the one or more processors to:
sort outgoing datagrams into one of at least three categories, wherein the at least three categories include a first category of datagrams addressed to a central network location, a second category of datagrams addressed to destinations on a white list, and a third category of datagrams addressed to other destinations absent from the white list;
send datagrams in the first category to the central network location along an N-way split virtual private network tunnel, wherein N is an integer greater than or equal to three;
send datagrams in the second category to the destinations on the white list along the N-way split virtual private network tunnel;
send datagrams in the third category to a scanning service website along the N-way split virtual private network tunnel, the scanning service website configured to provide a first scrubbing service for HTTP datagrams and a second scrubbing service for SMTP, POP, and IMAP datagrams.
12. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to:
determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category;
send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category along the corresponding branches.
13. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using network latency of splits of the N-way split virtual private network tunnel.
14. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using an end-user.
15. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein an end-user is identified using an authentication datagram transmitted from an end-user device of the end-user.
16. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using hop count.
17. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to determine corresponding branches of the N-way split virtual private network tunnel to send the datagrams in the first category, the datagrams in the second category, and the datagrams in the third category, wherein the corresponding branches are determined using a device type of an end-user device.
18. The system of claim 11 , wherein the white list includes fully-qualified domain names of the destinations on the white list.
19. The system of claim 11 , wherein the white list includes IP addresses mapped to fully-qualified domain names of the destinations on the white list.
20. The system of claim 11 , wherein the computer program is further configured to cause the one or more processors to send credentials identifying an end-user's username and a MAC address of an end-user device along with the datagrams in the third category to the scanning service website.