Intelligent virtual private network (VPN) client configured to manage common VPN sessions with distributed VPN service
AssigneeAmazon Technologies, Inc.
InventorsNicholas Channing Matthews, Bashuman Deb
Life of this patent
Estimating the term…
Abstract
Embodiments presented herein disclose a VPN service which includes a cluster of VPN appliances that requires only an eventually consistent database to share VPN session data among cluster nodes. Doing so provides a VPN service that can scale both horizontally (i.e., the VPN service can support large numbers of VPN appliances) as well as geographically (i.e., nodes of the cluster do not need to be physically proximate to one another in order to satisfy latency requirements). Thus, the VPN service can provide regional endpoints to VPN clients that do not share common points of failure or administrative burdens.
Claims20
A system, comprising:
- a processor;
- and
- a memory containing one or more application programs providing a virtual private network (VPN) client, wherein the one or more application programs, when executed on the processor, perform an operation for managing a plurality of VPN tunnels associated with a VPN session, the operation comprising:
- receiving an indication of a plurality VPN appliances which are available to establish a VPN session with the VPN client,
- selecting a first one of the plurality of VPN appliances,
- negotiating with the first VPN appliance to generate a set of parameters to use for the VPN session, and
- establishing the VPN session between the VPN client and the first VPN appliance, wherein the VPN session includes at least a first VPN tunnel connecting the first VPN appliance and the VPN client, wherein the first VPN tunnel provides a network tunnel for exchanging encrypted packets between the first VPN appliance and the VPN client as part of the VPN session, wherein the first VPN appliance pushes VPN session data associated with the VPN session to a backend database, wherein the backend database provides each of the plurality of VPN appliances with access to the VPN session data pushed to the backend database by the first VPN appliance using an eventual consistency data model, and wherein one or more other VPN appliances in the plurality of VPN appliances are configured to restore the VPN session between the VPN client and the first VPN appliance using the VPN session data in the backend database.
A computer-implemented method for managing a virtual private network (VPN) session, the computer-implemented method comprising:
- identifying at least a first VPN appliance and a second VPN appliance available to a VPN client for establishing a VPN session;
- establishing a VPN session between the VPN client and the first VPN appliance, wherein the VPN session includes at least a first VPN tunnel connecting the first VPN appliance and the VPN client;
- and
- establishing, with the second VPN appliance, a second VPN tunnel, wherein the second VPN tunnel connects the second VPN appliance and the VPN client, wherein the first VPN tunnel and the second VPN tunnel are established using VPN session data negotiated between the first VPN appliance and the VPN client, and wherein the second VPN appliance is configured to retrieve the VPN session data from a backend data store and restore the VPN session created between the VPN client and the first VPN appliance using the retrieved VPN session data.
A non-transitory computer-readable medium storing instructions which, when executed on a processor, perform an operation to manage a virtual private network (VPN) session, the operation comprising:
- establishing, by operation of a processor executing a VPN client, a plurality of VPN tunnels with a corresponding plurality of VPN endpoints exposed by a distributed VPN service, wherein each VPN endpoint is associated with a respective VPN appliance of a plurality of VPN appliances, and wherein each VPN tunnel provides a network tunnel for exchanging encrypted packets between the VPN client and the corresponding VPN endpoint as part of the VPN session;
- and
- selectively using one or more of the plurality of VPN tunnels to send encrypted packets to the corresponding one or more VPN endpoints, wherein the VPN client establishes the VPN session with a first one of the plurality of VPN appliances by negotiating with the first VPN appliance to generate VPN session data, wherein the first VPN appliance pushes the VPN session data to a backend database, wherein the backend database provides the remaining plurality of VPN appliances access to the VPN session data using an eventual consistency data model, and wherein one or more of the remaining plurality of VPN appliances are configured to restore the VPN session between the VPN client and the first VPN appliance using the VPN session data retrieved by the one or more VPN appliances from the backend database.
Dependencies are inferred from the claim text.