US 10,567,347 B2Granted

Distributed tunneling for VPN

AssigneeNicira, Inc.

InventorsSandesh Sawant, Amit Chopra, Vinayak Shashikant Naik, Jayant Jain, Anirban Sengupta, Uday Masurekar

Life of this patent

Estimating the term…

Loading patent…

Abstract

A novel method of providing virtual private access to a software defined data center (SDDC) is provided. The SDDC uses distributed VPN tunneling to allow external access to application services hosted in the SDDC. The SDDC includes host machines for providing computing and networking resources and a VPN gateway for providing external access to those resources. The host machines that host the VMs running the applications that VPN clients are interested in connecting performs the VPN encryption and decryption. The VPN gateway does not perform any encryption and decryption operations. The packet structure is such that the VPN gateway can read the IP address of the VM without decrypting the packet.

Claims17

Dependent claims

A method comprising:

at an edge node of a datacenter serving as (i) a virtual private network (VPN) gateway between a VPN client external to the datacenter and a particular machine executing on a host computer inside the datacenter and (ii) a virtual tunnel endpoint (VTEP) for a plurality of logical networks implemented over a plurality of host computers executing a plurality of machines in the datacenter:
from the VPN client, receiving a VPN packet through a VPN connection for delivery to the particular machine, said VPN packet comprising (i) a first portion encrypted by the VPN client for the VPN connection, (ii) an unencrypted second portion comprising a destination address associated with the particular machine, and (iii) an unencrypted VPN header;
from the unencrypted second portion of the VPN packet, identifying (i) a particular logical network based on the destination address associated with the particular machine and (ii) a host computer that executes the particular machine;
removing the unencrypted VPN header and encapsulating the VPN packet for the identified logical network, said encapsulated VPN packet comprising (i) the encrypted first portion that was encrypted by the VPN client for the VPN connection, (ii) the unencrypted second portion comprising the destination address, and (iii) an unencrypted overlay network header for tunneling the encapsulated packet between the edge node and the identified host computer;
and
forwarding the encapsulated VPN packet to the identified host computer, wherein the identified host computer decapsulates the packet, decrypts the encrypted first portion using a key negotiated between the edge node and the VPN client, and provides the decrypted packet to the particular machine associated with the destination address.

3 more elements

A non-transitory machine readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:

at an edge node of a datacenter serving as (i) a virtual private network (VPN) gateway between a VPN client external to the datacenter and a particular machine executing on a host computer inside the data center and (ii) a virtual tunnel endpoint (VTEP) for a plurality of logical networks implemented over a plurality of host computers executing a plurality of machines in the data center:
from the VPN client, receiving a VPN packet through a VPN connection for delivery to the particular machine, said VPN packet comprising (i) a first portion encrypted by the VPN client for the VPN connection, (ii) an unencrypted second portion comprising a destination address associated with the particular machine, and (iii) an unencrypted VPN header;
from the unencrypted second portion of the VPN packet, identifying (i) a particular logical network based on the destination address associated with the particular machine and (ii) a host computer that executes the particular machine;
removing the unencrypted VPN header and encapsulating the VPN packet for the identified logical network, said encapsulated VPN packet comprising (i) the encrypted first portion that was encrypted by the VPN client for the VPN connection, (ii) the unencrypted second portion comprising the destination address, and (iii) an unencrypted overlay network header for tunneling the encapsulated packet between the edge node and the identified host computer;
and
forwarding the encapsulated VPN packet to the identified host computer, wherein the identified host computer decapsulates the packet, decrypts the encrypted first portion using a key negotiated between the edge node and the VPN client, and provides the decrypted packet to the particular machine associated with the destination address.

3 more elements

An electronic device comprising:

a set of processing units;
and
a non-transitory machine readable medium storing a program for execution by at least one of the processing units, the program comprising sets of instructions for:
at an edge node of a datacenter serving as (i) a virtual private network (VPN) gateway between a VPN client external to the datacenter and a particular machine executing on a host computer inside the data center and (ii) a virtual tunnel endpoint (VTEP) for a plurality of logical networks implemented over a plurality of host computers executing a plurality of machines in the data center:
from the VPN client, receiving a VPN packet through a VPN connection for delivery to the particular machine, said VPN packet comprising (i) a first portion encrypted by the VPN client for the VPN connection, (ii) an unencrypted second portion comprising a destination address associated with the particular machine, and (iii) an unencrypted VPN header;
from the unencrypted second portion of the VPN packet, identifying (i) a particular logical network based on the destination address associated with the particular machine and (ii) a host computer that executes the particular machine;
removing the unencrypted VPN header and encapsulating the VPN packet for the identified logical network, said encapsulated VPN packet comprising (i) the encrypted first portion that was encrypted by the VPN client for the VPN connection, (ii) the unencrypted second portion comprising the destination address, and (iii) an unencrypted overlay network header for tunneling the encapsulated packet between the edge node and the identified host computer;
and
forwarding the encapsulated VPN packet to the identified host computer, wherein the identified host computer decapsulates the packet, decrypts the encrypted first portion using a key negotiated between the edge node and the VPN client, and provides the decrypted packet to the particular machine associated with the destination address.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/140,027Filed 27 Apr 2016 · continuation in part
Priority: IN 20164100507312 Feb 2016
Published: US 2017/0033924 A12 Feb 2017
Granted: 18 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
H04L 9/083
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…:…
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling

Family

Application14/815,074Parent of this continuation-in-part · filed 31 Jul 2015
US 2017/0034129 A1Pre-grant publication · published 2 Feb 2017
US 10,044,502 B2Parent of this continuation-in-part
US 2017/0033924 A1Published application
US 10,567,347 B2This patent

From the US filing history. Foreign family members aren’t listed.