Techniques for packet processing with removal of ip layer routing dependencies
AssigneeNovell, Inc.
InventorK. Sarath Chandrika
Life of this patent
Estimating the term…
Abstract
Techniques for packet processing with removal of Internet Protocol (IP) layer routing dependencies are presented. Encrypted packets associated with network communications occurring via a VPN and IP tunnel are grabbed off the network stack before being processed by an IP layer of the network stack. Next, an IP header is generated for the encrypted packets and the encrypted packets are sent to a socket application. The socket application provides the encrypted packets back to the network stack at the data link layer for delivery to the VPN over the IP tunnel.
Claims24
A method implemented and residing in a computer-readable storage medium to process on a processor that is configured to execute the method and the method, comprising:
- intercepting, by the processor, an encrypted packet before the encrypted packet is processed by an Internet Protocol (IP) layer of a network communication stack, the encrypted packet was being directed through the network communication stack to a Virtual Private Network (VPN) that is using an IP tunnel at the data link layer of the network communication stack;
- generating, by the processor, an IP header for the encrypted packet outside the IP layer of the network communication stack;
- and
- sending, by the processor, the encrypted packet with the generated IP header to a socket application for direct delivery to the data link layer of the network communication stack and for injection into the VPN via the IP tunnel.
A method implemented and residing in a computer-readable storage medium to process on a processor that is configured to execute the method and the method, comprising:
- receiving, by the processor, an encrypted packet destined for a Virtual Private Network (VPN) via an Internet Protocol (IP) tunnel at a data link layer of a network communication stack, the encrypted packet bypassed the IP layer of the network communication stack but still includes an IP header;
- verifying, by the processor, a source IP address and a destination IP address for the encrypted packet;
- and
- sending, by the processor, the encrypted packet to the data link layer for delivery to the VPN over the IP tunnel when the source IP address and the destination IP address are verified and when the source IP address or the destination IP address are not validated terminating processing of the encrypted packet without deliver to the data link layer.
A processor-implemented system residing in a computer-readable storage medium and adapted to be executed by a processor of a network, comprising:
- a stack intercepting service residing in a computer-readable medium and executed by the processor;
- and
- a socket application residing in a computer-readable medium and executed by the processor;
- wherein the stack intercepting service is to intercept a packet being sent through a network stack after the packet exits a Transmission Control Protocol (TCP) layer of the network stack and before the packet is processed by an Internet Protocol (IP) layer of the network stack, and the stack intercepting service is to add an IP header to the packet and provide the packet with the IP header to the socket application, the socket application is to deliver the packet with the IP header directly back to the network stack at the data link layer where the packet is injected into an IP tunnel for delivery over a Virtual Private Network (VPN).
A processor-implemented system residing in a computer-readable storage medium and adapted to be executed by a processor of a network, comprising:
- an Internet Protocol (IP) tunnel packet residing in a computer-readable storage medium and being processed by the processor as the IP tunnel packet traverses a network stack for delivery to a Virtual Private Network (VPN) over an IP tunnel at a data link layer of the network stack;
- and
- a socket application implemented and residing in a computer-readable storage medium and being processed by the processor;
- wherein the IP tunnel packet bypasses an IP layer of the network stack as it is being processed through the network stack and delivered to the socket application, the socket application directly supplies the IP tunnel packet to the data link layer for delivery to the VPN over the IP tunnel.
Dependencies are inferred from the claim text.