Method and an apparatus for establishing secure, low latency, optimized paths in a wide area network

A communication node for a wide area network (WAN) in a communications network, the WAN comprising a plurality of interconnected such nodes in the communications network, the communication node comprising:

• a VPN module configured to establish VPN tunnel connections on communication links between said communication node and some or all of the other such nodes comprising the WAN;
• a non-stream-oriented transport layer protocol module configured to establish a non-stream-oriented association for each VPN tunnel connection at said communication node;
• a stream-oriented transport layer protocol proxy module configured to, on receiving at said communication node a stream-oriented connection from a source device, encapsulate packets from said stream-oriented connection into one or more non-stream-oriented associations between said communication node and a destination node to thereby transport said packets from the source device to the destination node;
• a remote procedure call (RPC) module configured to receive from a WAN controller node a selection of links or routes for packet transport from said communication node to other such nodes comprising the WAN,
• wherein the stream-oriented transport layer protocol proxy module selects the one or more non-stream-oriented associations for encapsulating packets into a plurality of non-stream-oriented associations established on the links or routes communicated to said communication node by the WAN controller node;
• and
• wherein, when said communication node receives the stream-oriented packet connection from the source device, the communication node uses one of the one or more selected non-stream-oriented associations to signal one of the other such nodes to establish a local stream-oriented connection with a destination node or a destination device thereby forming a virtual stream-oriented connection across the WAN from the source device to the destination node or the destination device whilst avoiding a need for a three-way stream-oriented handshake across the WAN between the source device and the destination node or the destination device.

A method, comprising:

• pre-configuring a plurality of non-stream-oriented transport layer protocol associations between a plurality of interconnected communication nodes in a wide area network (WAN), the non-stream-oriented transport layer protocol comprising a message-oriented transport layer protocol or a Stream Control Transmission Protocol (SCTP);
• receiving stream-oriented transport layer protocol packets from a network device, the packets being intended for a destination node or a destination device;
• encapsulating the packets into non-stream-oriented transport layer protocol payloads for one or more selected non-stream-oriented transport layer protocol associations;
• and
• transmitting the non-stream-oriented transport layer protocol payloads across the WAN in one or more streams on the one or more selected non-stream-oriented transport layer protocol associations to the destination node or device;
• wherein the selected one or more non-stream-oriented transport layer protocol associations are selected based on one or more topological and/or one or more operational parameters of the WAN;
• and
• wherein, when the stream-oriented transport layer protocol packets are received from the network device, a first communication node of the plurality of interconnected communication nodes uses one of the one or more selected non-stream-oriented associations to signal a second communication node whereby the second communication node, on being signaled, establishes a local stream-oriented connection with the destination node or the destination device thereby forming a virtual stream-oriented connection across the WAN from the network device to the destination node or the destination device whilst avoiding a need for a three-way stream-oriented handshake across the WAN between the network device and the destination node or the destination device.

A method of transporting packets over a wide area network (WAN) in a communications network, the WAN comprising a plurality of interconnected communication nodes including at least a first communication node, a second communication node and a WAN controller node, the method comprising the steps of:

• establishing virtual private network (VPN) tunnel connections on communication links between some or all of the communication nodes comprising the WAN;
• using a non-stream-oriented transport layer protocol to establish a non-stream-oriented association for each VPN tunnel connection;
• and,
• on receiving a packet connection from a source device at said first communication node, encapsulating packets from said packet connection into one or more non-stream-oriented associations between the first communication node and the second communication node to thereby transport said packets from the source device to the second communication node;
• wherein the WAN controller node communicates to the first communication node a selection of links or routes for packet transport to the second communication node;
• wherein the first communication node selects the one or more non-stream-oriented associations for encapsulating packets into a plurality of non-stream-oriented associations established on the links or routes communicated to said first node by the WAN controller node;
• wherein the WAN controller node assists the communication nodes with establishing the VPN tunnel connections using an automatic VPN process based on predefined profiles;
• and
• wherein the WAN comprises at least two organization sites, each organization site comprising a plurality of communication nodes, the plurality of communication nodes at each organization site comprising a hub-site node connected to hub-site nodes at other organization sites and branch-site nodes, each branch-site node connected to a hub-site node and/or to another branch-site node at its organization site, wherein the predefined profiles comprise the connection relationships between the respective hub-site nodes and their branch-site nodes at said organization sites.

A communication node for a wide area network (WAN) in a communications network, the WAN comprising a plurality of interconnected nodes in the communications network, the communication node comprising:

• a VPN module configured to establish VPN tunnel connections on communication links between said communication node and some or all of the other communication nodes comprising the WAN;
• a non-stream-oriented transport layer protocol module configured to establish a non-stream-oriented association for each VPN tunnel connection at said communication node;
• a stream-oriented transport layer protocol proxy module configured to, on receiving at said communication node a stream-oriented connection from a source device, encapsulate packets from said stream-oriented connection into one or more non-stream-oriented associations between said communication node and a destination node to thereby transport said packets from the source device to the destination node;
• a remote procedure call (RPC) module configured to receive from a WAN controller node a selection of links or routes for packet transport from said communication node to other communication nodes comprising the WAN,
• wherein the stream-oriented transport layer protocol proxy module selects the one or more non-stream-oriented associations for encapsulating packets into a plurality of non-stream-oriented associations established on the links or routes communicated to said communication node by the WAN controller node;
• wherein the WAN controller node assists the communication nodes with establishing the VPN tunnel connections using an automatic VPN process based on predefined profiles;
• and
• wherein the WAN comprises at least two organization sites, each organization site comprising a plurality of communication nodes, the plurality of communication nodes at each organization site comprising a hub-site node connected to hub-site nodes at other organization sites and branch-site nodes, each branch-site node connected to a hub-site node and/or to another branch-site node at its organization site, wherein the predefined profiles comprise the connection relationships between the respective hub-site nodes and their branch-site nodes at said organization sites.

A method, comprising:

• pre-configuring a plurality of non-stream-oriented transport layer protocol associations between a plurality of interconnected communication nodes in a wide area network (WAN), the non-stream-oriented transport layer protocol comprising a message-oriented transport layer protocol or a Stream Control Transmission Protocol (SCTP);
• establishing virtual private network (VPN) tunnel connections on communication links between some or all of the communication nodes comprising the WAN;
• receiving stream-oriented transport layer protocol packets from a network device, the packets being intended for a destination node or a destination device;
• encapsulating the packets into non-stream-oriented transport layer protocol payloads for one or more selected non-stream-oriented transport layer protocol associations;
• and
• transmitting the non-stream-oriented transport layer protocol payloads across the WAN in one or more streams on the one or more selected non-stream-oriented transport layer protocol associations to the destination node or device;
• wherein the selected one or more non-stream-oriented transport layer protocol associations are selected based on one or more topological and/or one or more operational parameters of the WAN;
• wherein the WAN controller node assists the communication nodes with establishing the VPN tunnel connections using an automatic VPN process based on predefined profiles;
• and
• wherein the WAN comprises at least two organization sites, each organization site comprising a plurality of communication nodes, the plurality of communication nodes at each organization site comprising a hub-site node connected to hub-site nodes at other organization sites and branch-site nodes, each branch-site node connected to a hub-site node and/or to another branch-site node at its organization site, wherein the predefined profiles comprise the connection relationships between the respective hub-site nodes and their branch-site nodes at said organization sites.