Automatic virtual private network internet snoop avoider
AssigneeInternational Business Machines Corporation
InventorsDenise Marie Genty, Gerald Francis McBrearty, Shawn Patrick Mullen, Johnny Meng-Han Shieh, Ramachandran Unnikrishnan
Life of this patent
Estimating the term…
Abstract
Disclosed is a system and method for enhancing the security of virtual private network (VPN) connections by automatic pre-negotiation of a secondary configuration. If snooping or other security breaches are detected, the VPN tunnel is modified automatically to the secondary pre-arranged configuration, stymieing attempted security violations.
Claims35
A tunneled networking system comprising:
- a first tunneled node having a first set of tunneling configuration data and at least one first backup configuration element associated therewith;
- a second tunneled node having a second set of tunneling configuration data and at least one second backup configuration element associated therewith;
- and
- a tunneled network between the first tunneled node and the second tunneled node,
- wherein the first tunneled node is operable to select a selected first backup configuration element from the set of first backup configuration elements, send a change code to the second tunneled node, and begin using the selected first backup configuration element to negotiate a backup tunneled network with the second tunneled node, and
- the second tunneled node is operable to receive the change code and interpret the change code to select a selected second backup configuration element from the set of second backup configuration elements, and begin using the selected second backup configuration element to negotiate the backup tunneled network with the first tunneled node.
In a tunneled network system having a first tunneled node and a second tunneled node, a method comprising the steps of:
- associating a first set of tunneling configuration data and at least one first backup configuration element with the first tunneled node;
- associating a second set of tunneling configuration data and at least one second backup configuration element with the second tunneled node;
- the first tunneled node selecting at least one selected first backup element from the at least one first backup configuration element;
- the second tunneled node selecting at least one selected second backup element from the at least one second backup configuration element;
- and
- the first tunneled node and the second tunneled node negotiating a second tunneled network system using the at least one selected first backup element and the at least one selected second backup element.
A tunneled networking system comprising:
- a first tunneled node having a first set of tunneling configuration data and at least one first backup configuration element associated therewith;
- a second tunneled node having a second set of tunneling configuration data and at least one second backup configuration element associated therewith;
- a main network tunnel between the first tunneled node and the second tunneled node associated with the first set of tunneling configuration data and the second set of tunneling configuration data;
- and
- at least one backup tunnel between the first tunnel node and the second tunneled node associated with the at least one first backup configuration element and the at least one second backup configuration element,
- wherein the first tunneled node is operable to send a change code to the second tunneled node and begin using the backup network tunnel to communicate with the second tunneled node, and
- the second tunneled node is operable to receive the change code and begin using the backup network tunnel to communicate with the first tunneled node.
A node to a tunneled networking system comprising:
- a set of tunneling configuration data;
- at least one set of backup configuration data;
- and
- a tunneled network endpoint,
- wherein the node is operable to begin using the set of backup configuration data to create a backup tunneled network endpoint.
A computer-readable medium having stored thereon a computer program comprising:
- a configuration storage code comprising a set of codes operable to direct a node to store a set of tunneling configuration data;
- a backup configuration storage code comprising a set of codes operable to direct the node to store a set of backup tunneling configuration data;
- a tunneled network endpoint code comprising a set of codes operable to direct the node to set up a tunneled network endpoint using the set of tunneling configuration data;
- and
- a switching code comprising a set of codes operable to direct the node to set up a backup tunneled network endpoint using the set of backup tunneling configuration data.
Dependencies are inferred from the claim text.