VPN classification to reduce usage costs while retaining responsiveness
AssigneeHughes Network Systems, LLC
InventorDouglas Merrill Dillon
Life of this patent
Estimating the term…
Abstract
Systems and methods for estimating the kind of traffic a VPN is carrying and determining which WAN connection to use for VPN network traffic to reduce usage costs while maintaining responsiveness in a VPN router or gateway. A VPN classifier examines VPN packets and estimates the type of traffic they are carrying and selects a policy for upstream or downstream traffic to determine which tunnel or tunnels to send network traffic. Further, policies may be applied to VPN packets as a function of usage knob.
Claims19
A software defined wide area network (SD-WAN) device comprising:
- a first wide area network (WAN) connection with a first SD-WAN tunnel connected to the SD-WAN device;
- a second WAN connection with a second SD-WAN tunnel connected to the SD-WAN device;
- and
- a VPN classifier that examines encrypted packets of a virtual private network (VPN) connection, in which the packets are to be carried by the SD-WAN tunnels, estimates a traffic type of the packets of the VPN connection and sets a tunnel selection policy based at least partly on the traffic type for which tunnel of the first and second SD-WAN tunnels the packets of the VPN connection should be carried by;
- wherein:
- the VPN classifier uses recent measurements of packets of the VPN connection to estimate the traffic type based on a distribution of packets size ranges for packets transferred upstream and downstream;
- and
- the SD-WAN device selects from the first SD-WAN tunnel and second SD-WAN tunnel based on the tunnel selection policy.
A software defined wide area network (SD-WAN) gateway that supports operation of one or more SD-WAN routers comprising:
- a first wide area network (WAN) connection with a first SD-WAN tunnel connected to the SD-WAN gateway;
- a second WAN connection with a second SD-WAN tunnel connected to the SD-WAN gateway;
- and
- a VPN classifier that examines encrypted packets of a virtual private network (VPN) connection, in which the packets are to be carried by the SD-WAN tunnels, estimates a traffic type of the packets of the VPN connection and sets a tunnel selection policy based at least partly on the traffic type for which tunnel of the first and second SD-WAN tunnels the packets of the VPN connection should be carried by;
- wherein:
- the VPN classifier uses recent measurements of packets of the VPN connection to estimate the traffic type, wherein the tunnel selection policy is updated on an on-going basis using rules with factors based on VPN connection upstream and downstream packet size and measurements of upstream and downstream packets, wherein the measurements by the VPN classifier include distribution of packets in packet size ranges determined by counting sizes of upstream packets and downstream packets in a measurement period;
- and
- the factors include a knob range of a usage knob, wherein the usage knob represents an urgency for reducing usage of the second WAN connection, wherein the second WAN connection has a higher-cost per GB and lower-latency compared to the first WAN connection.
A method for assigning VPN network flow on a software defined wide area network (SD-WAN) device comprising:
- monitoring an encrypted VPN flow for a specified period of time,
- calculating traffic statistics of the VPN flow in the specified period of time;
- applying classification rules to the traffic statistics wherein the classification rules estimate a traffic type in the VPN flow;
- determining a tunnel selection policy based on matched classification rules with a highest score, wherein the tunnel selection policy depends on distribution of packets in packet size ranges for packets transferred upstream and downstream;
- and
- assigning VPN flow to a WAN interface based on the traffic type and the tunnel selection policy.
Dependencies are inferred from the claim text.