Peer-to-peer network over a virtual private network
The present invention provides a new network topology. More specifically, a peer-to-peer network is defined on a virtual private network. The peer-to-peer network comprises a set of specified users within a virtual private network that are allowed to communicate according to predetermined rules enforced by the peer-to-peer network itself. This affords secure communication between the specified users of the peer-to-peer network independent of the virtual private network.
1. A method, comprising:
providing a Virtual Private Network (VPN) overlay network for a first set of communication devices; and
defining a first and second peer-to-peer network over the VPN, the first peer-to-peer network being defined for a second set of communication devices over the VPN overlay network and the second peer-to-peer network being defined for at least one of a third set of communication devices and third set of users over the VPN overlay network, wherein the at least one of a second set of communication devices and second set of users are in at least one of a first set of communication devices and first set of users, wherein the at least one of a third set of communication devices and third set of users are in the at least one of a first set of communication devices and first set of users.
2. The method of claim 1 , wherein the first set of communication devices comprises all of the communication devices in the second and third set of communication devices and wherein the second and third set of communication devices do not comprise all of the communication devices in the first set of communication devices.
3. The method of claim 1 , further comprising:
defining communication policies for the second set of communication devices;
defining communication polices for the third set of communication devices, the communication policies for the third set of communication devices being different from the communication policies for the second set of communication devices; and
enforcing the communication policies for the second and third sets of communication devices in the peer-to-peer network and from the peer-to-peer network to the rest of the communication devices in the first set of communication devices.
4. The method of claim 3 , wherein communication policies for the second and third communication devices comprise at least one of security policies, permissions, routing policies, permissible applications, and encryption policies.
5. The method of claim 3 , further comprising:
determining at least one of a name and variety for each communication device in the peer-to-peer network;
assigning a key to each communication device in the peer-to-peer network; a receiving communication device belonging to the peer-to-peer network receiving a key from a sending communication device;
determining, by the receiving communication device, that the received key corresponds to at least one of a name and variety for a communication device in the peer-to-peer network; and
permitting a communication session between the receiving communication device and the sending communication device in accordance with the communication policies.
6. The method of claim 3 , further comprising:
determining at least one of an identifier and key;
assigning the at least one of an identifier and key to each communication device in the peer-to-peer network;
a receiving communication device belonging to the peer-to-peer network receiving at least one of an identifier and key from a sending communication device;
determining, by the receiving communication device, that the received at least one of an identifier and key corresponds to the assigned at least one of an identifier and key; and
permitting a communication session between the receiving communication device and the sending communication device in accordance with the communication policies.
7. The method of claim 1 , further comprising:
determining that a communication device in the peer-to-peer network wants to establish communications with a communication device not in the peer-to-peer network;
the communication device in the peer-to-peer network generating a message for transmission to the communication device not in the peer-to-peer network; and
transmitting the message to the communication device not in the peer-to-peer network by routing the message through a predetermined communication device belonging to the peer-to-peer network.
8. The method of claim 1 , further comprising the second set of communication devices utilizing packets comprising at least an outer IP tunnel header, an IPsec header, and an inner IP header.
9. In an overlay network established on top of a public communication network, the overlay network having a first set of users capable of communicating with one another, an apparatus, comprising:
a management console adapted to define a plurality of peer-to-peer networks over the overlay network, wherein each peer-to-peer network in the plurality of peer-to-peer networks defined over the overlay network comprise different user groups and different communication policies associated therewith, and wherein users in each peer-to-peer network defined over the overlay network are also in the first set of users.
10. The apparatus of claim 9 , wherein at least some users in the first set of users are not in a peer-to-peer network.
11. The apparatus of claim 9 , wherein the management console is further adapted to define the communication policies for each of the peer-to-peer networks, wherein the communication policies for users in the peer-to-peer networks differ from policies for the first set of users that are not in a peer-to-peer network, and wherein the management console is further adapted to control communications between users in the peer-to-peer network and users not in the peer-to-peer network.
12. The apparatus of claim 11 , wherein the communication policies for each of the peer-to-peer networks comprise one of restrictions and permissions related to at least one of TCP/IP application layer protocols, transport layer protocols, and network layer protocols.
13. The apparatus of claim 9 , wherein at least one peer-to-peer network defined over the overlay network comprises a mesh topology.
14. The apparatus of claim 9 , wherein the overlay network comprises at least one of an IPsec, an L2, and an L3 VPN overlay network configured in at least one of a mesh and hub-and-spoke topology.
15. The apparatus of claim 9 , wherein each user in the first set of users is associated with at least one communication device and wherein each communication device in a first peer-to-peer network is adapted to establish communications with one another using a predetermined TCP/IP application layer protocol.
16. The apparatus of claim 9 , wherein the management console is further adapted to determine and assign a key to each user in a first peer-to-peer network defined over the overlay network such that the use of the assigned key in communications indicates that the user providing the assigned key belongs to the first peer-to-peer network defined over the overlay network.
17. The apparatus of claim 16 , wherein the key assigned to each user in the first peer-to-peer network comprises a common key.
18. The apparatus of claim 16 , wherein each user in the first peer-to-peer network is assigned a unique key.
19. The apparatus of claim 16 , wherein the key comprises at least one of an authentication key, an encryption key, and an identifier.
20. The apparatus of claim 16 , wherein users in the first peer-to-peer network communicate with one another using packets comprising an outer IP tunnel header, an IPsec header, and an inner IP header, a TCP/UDP header, an application specific header, and data payload.
21. A communication device, comprising:
a management console adapted to define a plurality of peer-to-peer networks of users over an overlay network and a set of policies for controlling communication capabilities between the users in each peer-to-peer network, wherein each peer-to-peer network in the plurality of peer-to-peer networks defined over the overlay network comprise different user groups and different communication policies associated therewith.
22. The device of claim 21 , wherein the management console resides on a communication device associated with a user belonging to a peer-to-peer network defined over the overlay network.
23. The device of claim 21 , wherein the management console resides on a server adapted to at least partially facilitate the overlay network.
24. The device of claim 21 , wherein the overlay network comprises at least one of an IPsec, an L2, and an L3 VPN overlay network, and wherein at least one peer-to-peer network defined over the overlay network is configured in a mesh topology.
25. A non-transitory computer readable medium having stored thereon instructions that cause a computing system to execute a method, the instructions comprising:
instructions configured to provide a Virtual Private Network (VPN) overlay network for a first set of communication devices and first set of users; and
instructions configured to define a first and second peer-to-peer network over the VPN, the first peer-to-peer network being defined for a second set of communication devices over the VPN overlay network and the second peer-to-peer network being defined for at least one of a third set of communication devices and third set of users over the VPN overlay network, wherein at least one of a second set of communication devices and second set of users are in at least one of a first set of communication devices and first set of users, wherein the at least one of a third set of communication devices and third set of users are in the at least one of a first set of communication devices and first set of users.