Hierarchical-context area network as a virtual private network infrastructure system
A hierarchical-context area network includes a first virtual private network infrastructure context area network for a first virtual private network infrastructure context area in a first virtual private network infrastructure context level that includes a first virtual private network server, a second virtual private network infrastructure context area network for a second virtual private network infrastructure context area in the second virtual private network infrastructure context level that includes a second virtual private network server, wherein the first virtual private network server receives a protocol data unit from a client device and identifies the second virtual private network server, in accordance with a routing control policy defined by the hierarchical-context area network, as a current point of egress for transporting the protocol data unit through the hierarchical-context area network to send to an external device.
1. A virtual private network infrastructure (VPNI) system operating a hierarchical-context area network as a VPNI network, wherein the hierarchical-context area network includes a hierarchy of context areas, the VPNI system comprising:
a first virtual private network (VPN) server; and
a second VPN server, wherein:
the hierarchical-context area network includes:
a first VPNI context area network (CAN) for a first VPNI context area in a first VPNI context level of the hierarchy of VPNI context levels;
a second VPNI CAN for a second VPNI context area in a second VPNI context level of the hierarchy of VPNI context levels, wherein the second VPNI context level includes the first VPNI context level; and
a third VPNI CAN for a third VPNI context area in the first VPNI context level, wherein the third VPNI CAN is allocated a shared IP address;
the first VPN server:
receives, from an end user device, via a VPN tunnel between the first VPN server and the end user device, a first protocol data unit addressed to an external device;
in response to the first protocol data unit, identifies, in accordance with a routing control policy defined for the hierarchical-context area network, the second VPN server as a current point of egress for transporting the first protocol data unit through the hierarchical-context area network; and
sends the first protocol data unit from the first VPN server to the current point of egress; and
the second VPN server, as the current point of egress, sends, to the external device, via the Internet, the first protocol data unit.
2. The VPNI system of claim 1 , wherein:
the routing control policy is an account type-based routing control policy; and
identifying the current point of egress includes:
identifying an account type associated with the VPN tunnel; and
identifying the current point of egress in accordance with the account type,
wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a limited-tier account type:
identifying a defined geographic range from a geographic location of the end user device; and
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is within the defined geographic range;
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is a high load server;
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is allocated for the limited-tier account type;
in response to a determination that the account type is a basic-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is an optimal available VPN server based on a geographic location of the end user device;
in response to a determination that the account type is a premium-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server implements a service associated with the premium-tier account type; and
in response to a determination that the account type is an enterprise-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is designated as available for the enterprise-tier account type.
3. The VPNI system of claim 1 , wherein:
the routing control policy is an organization structure-based routing control policy; and
identifying the current point of egress includes:
identifying an organizational tier associated with an account associated with the VPN tunnel; and
identifying the current point of egress in accordance with the organizational tier.
4. The VPNI system of claim 1 , wherein:
the routing control policy is an organization service-based routing control policy; and
identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service.
5. The VPNI system of claim 1 , wherein:
the routing control policy is an organization service-based routing control policy; and
identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service.
6. The VPNI system of claim 1 , wherein:
the routing control policy is an organization functionality-based routing control policy; and
identifying the current point of egress includes:
identifying the current point of egress based on functionality available from the current point of egress.
7. The VPNI system of claim 1 , wherein:
the first VPN server is an ingress node with respect to the VPN tunnel between the first VPN server and the end user device; or
the first VPN server receives the first protocol data unit via a fourth VPN server that is the ingress node with respect to the VPN tunnel between the first VPN server and the end user device.
8. The VPNI system of claim 1 , wherein:
the first VPN server receives the first protocol data unit from a component of the VPNI system such that the first protocol data unit is associated with the VPN tunnel.
9. A method comprising:
operating a hierarchical-context area network as a virtual private network infrastructure (VPNI) network of a virtual private network (VPN) system, wherein the hierarchical-context area network includes a hierarchy of VPNI context levels, wherein:
the hierarchical-context area network includes:
a first VPNI context area network (CAN) for a first VPNI context area in a first VPNI context level of the hierarchy of VPNI context levels;
a second VPNI CAN for a second VPNI context area in a second VPNI context level of the hierarchy of VPNI context levels, wherein the second VPNI context level includes the first VPNI context level; and
a third VPNI CAN for a third VPNI context area in the first VPNI context level, wherein the third VPNI CAN is allocated a shared IP address;
the VPNI network includes:
a first VPN server, wherein the first VPN server is allocated a first private IP address from a range of available IP addresses defined for the first VPNI CAN; and
a second VPN server, wherein the second VPN server is allocated a second private IP address from a range of available IP addresses defined for the third VPNI CAN; and
operating the hierarchical-context area network includes:
receiving, by the first VPN server, from an end user device, via a VPN tunnel between the first VPN server and the end user device, a first protocol data unit addressed to an external device;
in response to receiving the first protocol data unit, identifying, by the first VPN server, in accordance with a routing control policy defined for the hierarchical-context area network, a current point of egress for transporting the first protocol data unit through the hierarchical-context area network, wherein identifying the current point of egress includes identifying the second VPN server as the current point of egress;
sending the first protocol data unit from the first VPN server to the current point of egress; and
sending, by the current point of egress, to the external device, via the Internet, the first protocol data unit.
10. The method of claim 9 , wherein:
the routing control policy is an account type-based routing control policy; and
identifying the current point of egress includes:
identifying an account type associated with the VPN tunnel; and
identifying the current point of egress in accordance with the account type.
11. The method of claim 10 , wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a limited-tier account type:
identifying a defined geographic range from a geographic location of the end user device; and
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is within the defined geographic range.
12. The method of claim 10 , wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is a high load server.
13. The method of claim 10 , wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is allocated for the limited-tier account type.
14. The method of claim 10 , wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a basic-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is an optimal available VPN server based on a geographic location of the end user device;
in response to a determination that the account type is a premium-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server implements a service associated with the premium-tier account type; and
in response to a determination that the account type is an enterprise-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is designated as available for the enterprise-tier account type.
15. The method of claim 9 , wherein:
the routing control policy is an organization structure-based routing control policy; and
identifying the current point of egress includes:
identifying an organizational tier associated with an account associated with the VPN tunnel; and
identifying the current point of egress in accordance with the organizational tier.
16. The method of claim 9 , wherein:
the routing control policy is an organization service-based routing control policy; and
identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service.
17. The method of claim 9 , wherein:
the routing control policy is an organization service-based routing control policy; and
identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service.
18. The method of claim 9 , wherein:
the routing control policy is an organization functionality-based routing control policy; and
identifying the current point of egress includes:
identifying the current point of egress based on functionality available from the current point of egress.
19. A non-transitory computer-readable storage medium, comprising processor-executable instructions for operating, in response to the instructions, a hierarchical-context area network as a virtual private network infrastructure (VPNI) network, wherein the hierarchical-context area network includes a hierarchy of context areas, wherein:
the hierarchical-context area network includes:
a first VPNI context area network (CAN) for a first VPNI context area in a first VPNI context level of the hierarchy of VPNI context levels;
a second VPNI CAN for a second VPNI context area in a second VPNI context level of the hierarchy of VPNI context levels, wherein the second VPNI context level includes the first VPNI context level; and
a third VPNI CAN for a third VPNI context area in the first VPNI context level, wherein the third VPNI CAN is allocated a shared IP address;
the VPNI network includes:
a first VPN server, wherein the first VPN server is allocated a first private IP address from a range of available IP addresses defined for the first VPNI CAN; and
a second VPN server, wherein the second VPN server is allocated a second private IP address from a range of available IP addresses defined for the third VPNI CAN; and
operating the hierarchical-context area network includes:
receiving, by the first VPN server, from an end user device, via a VPN tunnel between the first VPN server and the end user device, a first protocol data unit addressed to an external device;
in response to receiving the first protocol data unit, identifying, by the first VPN server, in accordance with a routing control policy defined for the hierarchical-context area network, a current point of egress for transporting the first protocol data unit through the hierarchical-context area network, wherein identifying the current point of egress includes identifying the second VPN server as the current point of egress;
sending the first protocol data unit from the first VPN server to the current point of egress; and
sending, by the current point of egress, to the external device, via the Internet, the first protocol data unit.
20. The non-transitory computer-readable storage medium of claim 19 , wherein:
the routing control policy is an account type-based routing control policy; and
identifying the current point of egress includes:
identifying an account type associated with the VPN tunnel; and
identifying the current point of egress in accordance with the account type, wherein identifying the current point of egress in accordance with the account type includes:
in response to a determination that the account type is a limited-tier account type:
identifying a defined geographic range from a geographic location of the end user device; and
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is within the defined geographic range;
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is a high load server;
in response to a determination that the account type is a limited-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is allocated for the limited-tier account type;
in response to a determination that the account type is a basic-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is an optimal available VPN server based on a geographic location of the end user device;
in response to a determination that the account type is a premium-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server implements a service associated with the premium-tier account type; and
in response to a determination that the account type is an enterprise-tier account type:
identifying the second VPN server as the current point of egress in response to a determination that the second VPN server is designated as available for the enterprise-tier account type.
21. The non-transitory computer-readable storage medium of claim 19 , wherein:
the routing control policy is an organization structure-based routing control policy, wherein identifying the current point of egress includes:
identifying an organizational tier associated with an account associated with the VPN tunnel; and
identifying the current point of egress in accordance with the organizational tier;
the routing control policy is an organization service-based routing control policy, wherein identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service;
the routing control policy is an organization service-based routing control policy, wherein identifying the current point of egress includes:
identifying a type of service corresponding to the first protocol data unit; and
identifying the current point of egress in accordance with the type of service; or
the routing control policy is an organization functionality-based routing control policy, wherein identifying the current point of egress includes:
identifying the current point of egress based on functionality available from the current point of egress.