System and method for central management of connections in a virtual private network

Method for requesting information about an existing set of VPN connections in a virtual private network, comprising the steps of:

• issuing to a connection control API a connection mask defining a set of instantiated connections;
• operating said connection control API to create a query command and place said query command on an input queue for a connection manager;
• creating a query command object;
• receiving and sending said query command object to said connection manager;
• operating said connection manager responsive to said query command object to identify matching connections matching said connection mask within a list of instantiated connections;
• and,
• returning to said connection control API information describing said matching connections.

Method for executing a start VPN connection command in a virtual private network responsive to the start of a physical communication device, comprising:

• detecting said start of a physical communication device;
• creating a start VPN connection command object;
• sending said command object to said connection manager;
• and
• operating said connection manager to identify all user client pairs for said physical interface which are autostartable.

Method for starting an active VPN connection responsive to a started command which includes security association information for this connection, comprising the steps of:

• building a started command object;
• sending said object to a connection manager;
• operating said connection manager to determine if it has a connection object to receive said started command;
• and, if not, creating said connection object;
• passing said started command object to said connection object;
• operating said connection object to pass said started command object to a current state object;
• obtaining from a policy database associated connection definition information for said this connection;
• and
• transferring said connection object and said associated connection definition information to a IP security module and, if the transfer is successful, transitioning a current associated state object to running state and setting a connection alarm.

Method for refreshing keying material in an active VPN connection, comprising the steps of:

• operating a connection alarm object to place an expire command on a connection manager queue;
• creating an expire command object;
• passing said expire command object to said connection manager;
• operating said connection manager to identify a corresponding connection;
• passing said expire command to a current state object;
• and
• said current state object obtaining a new security association from an IKE server, transferring information to an IP security module and, if successful, transitioning to running state and setting a timing alarm and, if not successful, transitioning to error state.

Method for managing connections in a virtual private network, comprising the steps of:

• receiving from an application a request selectively to start or stop a VPN connection;
• determining if said application has first authority to use a start or stop connection manager command;
• determining if said application has second authority to use a connection control limited application program interface (API);
• and
• responsive to determining that said application has both said first authority and said second authority, enabling said request to execute.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by a machine to perform method steps for managing within a single node a VPN connection in a virtual private network, said method steps comprising:

• issuing a call to a connection control API, said call including a connection name, said connection name including connection definition;
• operating said connection control API to create a command and place said command on an input queue for a connection manager;
• creating a command object;
• receiving and sending said command object to said connection manager;
• operating said connection manager to search for said connection name within a list of connections;
• and,
• if said connection name is found within said list, passing said command to the current state object of an existing instance of a connection object;
• and
• if said connection name is not found within said list, creating, if possible, a new instance of a connection object and passing said command to the current state object of said new instance;
• else, if not possible, rejecting said command.

An article of manufacture comprising:

• a computer useable medium having computer readable program code means embodied therein for managing within a single node a VPN connection in a virtual private network, the computer readable program means in said article of manufacture comprising:
• computer readable program code means for causing a computer to effect issuing a call to a connection control API, said call including a connection names, said connection name including connection definition;
• computer readable program code means for causing a computer to effect operating said connection control API to create a command and place said command on an input queue for a connection manager;
• computer readable program code means for causing a computer to effect creating a command object;
• computer readable program code means for causing a computer to effect receiving and sending said command object to said connection manager;
• computer readable program code means for causing a computer to effect operating said connection manager to search for said connection name within a list of connections;
• and,
• computer readable program code means for causing a computer to effect if said connection name is found within said list, passing said command to the current state object of an existing instance of a connection object;
• and
• computer readable program code means for causing a computer to effect if said connection name is not found within said list, creating, if possible, a new instance of a connection object and passing said command to the current state object of said new instance;
• else, if not possible, rejecting said command.

System for managing connections in a virtual private network, comprising:

• means for receiving from an application a request selectively to start or stop a VPN connection;
• means for determining if said application has first authority to use a start connection manager command;
• means for determining if said application has second authority to use a connection control limited application program interface (API);
• and
• means responsive to determining that said application has both said first authority and said second authority, for enabling said request to execute.

Method for managing a VPN connection in a virtual private network, comprising the steps of:

• issuing a call to a connection control API, said call including a connection name;
• operating said connection control API to create a start VPN connection command and place said start VPN connection command on an input queue for a connection manager;
• creating a command object;
• receiving and sending said command object to said connection manager;
• operating said connection manager to search for said connection name within a list of connections;
• and,
• if said connection name is found within said list, passing said start VPN connection command to the current state object of an existing instance of a connection object;
• if said connection name is not found within said list, creating, if possible, a new instance of a connection object and passing said start VPN connection command to the current state object of said new instance;
• else, if not possible, rejecting said start VPN connection command;
• realizing from said connection object an active VPN connection responsive to said start VPN connection command by:
• obtaining for this connection object an associated user client pair;
• obtaining connection mode indicia from a connection definition information for this connection object;
• responsive to said connection mode indicia being manual,
• obtaining first associated indicia including static security association information, local and remote connection endpoints, and local and remote data endpoints from a VPN policy database at this node;
• transferring said first associated indicia to an IPSec component;
• and if successful,
• transitioning a current associated state object to running state;
• and
• setting a timing alarm;
• and
• responsive to said connection mode indicia being dynamic,
• obtaining second associated indicia including remote connection endpoints, local and remote data endpoints, and associated phase II negotiation policy from said VPN policy database;
• obtaining a security association from an IKE server;
• transferring said second associated indicia and said security association to said IPSec component;
• and if successful,
• transitioning a current associated state object to running state;
• and
• setting said timing alarm.