VPN classification to reduce usage costs while retaining responsiveness
AssigneeHughes Network Systems, LLC
InventorDouglas Merrill Dillon
Life of this patent
Estimating the term…
Abstract
Systems and methods for estimating the kind of traffic a VPN is carrying and determining which WAN connection to use for VPN network traffic to reduce usage costs while maintaining responsiveness in a VPN router or gateway. A VPN classifier examines VPN packets and estimates the type of traffic they are carrying and selects a policy for upstream or downstream traffic to determine which tunnel or tunnels to send network traffic. Further, policies may be applied to VPN packets as a function of usage knob.
Claims20
A software defined wide area network (SD-WAN) gateway that supports operation of one or more SD-WAN routers comprising:
- a classifier that examines encrypted packets of a virtual private network (VPN) connection in which the packets are to be carried by SD-WAN tunnels, estimates a traffic type of the packets of the VPN connection, and sets a tunnel selection policy based at least partly on the traffic type for which tunnel of a first SD-WAN tunnel and second SD-WAN tunnel the packets of the VPN connection should be carried by;
- wherein:
- the VPN classifier uses recent measurements of packets of the VPN connection to estimate the traffic type based on a distribution of packets size for packets transferred;
- and
- the SD-WAN gateway sends packets of data based on the tunnel selection policy on the first SD-WAN tunnel or the second SD-WAN tunnel.
A software defined wide area network (SD-WAN) gateway that supports operation of one or more SD-WAN routers comprising:
- a classifier that examines encrypted packets of a virtual private network (VPN) connection, in which the packets are to be carried by SD-WAN tunnels, estimates a traffic type of the packets of the VPN connection and sets a tunnel selection policy based at least partly on the traffic type for which tunnel of a first SD-WAN tunnel and second SD-WAN tunnel the packets of the VPN connection should be carried by;
- wherein:
- the VPN classifier uses recent measurements of packets of the VPN connection to estimate the traffic type based on a distribution of packets size ranges for packets transferred upstream and downstream;
- the SD-WAN gateway sends packets of data based on the tunnel selection policy on the first SD-WAN tunnel or the second SD-WAN tunnel;
- and wherein:
- the tunnel selection policy is determined using factors based on VPN connection upstream and downstream packet size and measurements of upstream and downstream packets;
- the factors include a knob range of a usage knob, wherein the usage knob represents an urgency for reducing usage of the second SD-WAN tunnel;
- the second SD-WAN tunnel has a higher-cost per GB and lower-latency compared to the first WAN connection;
- and
- the factors include maximum packet inter-arrival time within a measurement period.
A method for assigning VPN network flow on a software defined wide area network (SD-WAN) gateway comprising:
- monitoring an encrypted VPN flow for a specified period of time;
- calculating traffic statistics of the VPN flow in the specified period of time;
- applying classification rules to the traffic statistics wherein the classification rules estimate a traffic type in the VPN flow based on a distribution of packet size ranges for packets transferred upstream and downstream;
- determining a tunnel selection policy based on matched classification rules with a highest score, wherein the tunnel selection policy depends on distribution of packets in packet size ranges for packets transferred upstream and downstream;
- and
- assigning VPN flow to a WAN interface based on the traffic type and the tunnel selection policy.
Dependencies are inferred from the claim text.