# US 7,613,131 B2 · Overlay network infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,131 B2 - Document ID: US7613131B2 - Status: Granted - Kind: B2 - Application number: 11/271,077 - Filed: 2005-11-10 - Published: 2007-05-10 - Granted: 2009-11-03 - Earliest claimed: 2005-11-10 - Assignees: Citrix Systems, Inc. - Inventors: Dan Decasper; Zubin Dittia; Prashanth Mundkur; Rajib Ghosh - Web page: https://patentgrep.com/patent/US7613131B2 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0272: {Virtual private networks} - H04L 63/0457: {wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for processing an overlay network infrastructure. In one embodiment, the method comprises a plurality of transparent access points (TAPs). Each TAP is communicably coupled between one or more clients and servers and a wide area network (WAN) to enable the one or more clients to communicate with the one or more servers, and is coupled to other of the TAPs via permanently, established secure links. The overlay network also comprises a controller coupled to each of the TAPs via a secure connection to configure the TAPs with information to enable each TAP to know what services are available and from which of the TAPs each of the services can be accessed. ## Claims ### Claim 1 An overlay network comprising: a plurality of transparent access points (TAPs), wherein each TAP is communicably coupled between one or more clients and servers and a wide area network (WAN) to enable the one or more clients to communicate with the one or more servers, and is coupled to other of the plurality of TAPs via permanently, established secure links; a controller coupled to each of the plurality of TAPs via a secure connection to configure the plurality of TAPs with information to enable said each TAP to know what services are available and from which of the plurality of TAPs each of the services can be accessed, wherein the controller provides each TAP with routing and forwarding tables to indicate where one or more services are available, to specify one or more TAPs to which a service will be forwarded, and to indicate how to reach TAPs wherein the service is available. ### Claim 2 (depends on 1) The overlay network defined in claim 1 wherein the permanently, established secure links comprises virtual private networks (VPNs), such that a client communicates with a server over a VPN. ### Claim 3 (depends on 1) The overlay network defined in claim 1 wherein plurality of TAPs consists of one TAP per network segment. ### Claim 4 (depends on 1) The overlay network defined in claim 1 wherein the secure connection comprises an SSL/TLS connection. ### Claim 5 (depends on 1) The overlay network defined in claim 1 wherein the secure connection comprises a TCP connection. ### Claim 6 (depends on 1) The overlay network defined in claim 1 wherein one of the plurality of TAPs is communicably coupled to one of the one or more servers and is communicably coupled to the WAN via a firewall, such that the TAP and the one server are only accessible to TAPs in the plurality of TAPs through the firewall. ### Claim 7 An overlay network comprising: a plurality of transparent access points (TAPs), wherein each TAP is communicably coupled between one or more clients and servers and a wide area network (WAN) to enable the one or more clients to communicate with the one or more servers, and is coupled to other of the plurality of TAPs via permanently, established secure links; a controller coupled to each of the plurality of TAPs via a secure connection to configure the plurality of TAPs with information to enable said each TAP to know what services are available and from which of the plurality of TAPs each of the services can be accessed, during configuration, the administrator of the TAP and the controller cross-verify each other using the fingerprint of the TAP'S and controller's certificate. ### Claim 8 An overlay network comprising: a plurality of transparent access points (TAPs), wherein each TAP is communicably coupled between one or more clients and servers and a wide area network (WAN) to enable the one or more clients to communicate with the one or more servers, and is coupled to other of the plurality of TAPs via permanently, established secure links; a controller coupled to each of the plurality of TAPs via a secure connection to configure the plurality of TAPs with information to enable said each TAP to know what services are available and from which of the plurality of TAPs each of the services can be accessed, wherein at least one of the plurality of TAPs performs dictionary-based compression on at least one request or response prior to sending the least one request or response over the WAN to a receiving TAP of the plurality of TAPs, the dictionary-based compression replacing at least a portion of the at least one request or response with an index. ### Claim 9 (depends on 8) The overlay network defined in claim 8 wherein the receiving TAP uses a dictionary to reconstruct the at least one request or response that underwent dictionary-based compression. ### Claim 10 (depends on 8) The overlay network defined in claim 8 wherein the at least one TAP sends information to enable reconstruction of the at least a portion of the at least one request or response to the receiving TAP when substituting the index for the portion for the first time. ### Claim 11 An overlay network comprising: a plurality of transparent access points (TAPs), wherein each TAP is communicably coupled between one or more clients and servers and a wide area network (WAN) to enable the one or more clients to communicate with the one or more servers, and is coupled to other of the plurality of TAPs via permanently, established secure links; a controller coupled to each of the plurality of TAPs via a secure connection to configure the plurality of TAPs with information to enable said each TAP to know what services are available and from which of the plurality of TAPs each of the services can be accessed, wherein one TAP of the plurality of TAPS receives a request for a designated server from one of the clients and checks a cache to determine whether a response to the request is already stored in the cache, the one TAP sending the response from the cache to satisfy the request, instead of sending the response over the WAN toward the designated server. ### Claim 12 (depends on 11) The overlay network defined in claim 11 wherein the cache stores the response for a period of time. ### Claim 13 (depends on 12) The overlay network defined in claim 12 wherein the period of time is set by the designated server. ### Claim 14 (depends on 12) The overlay network defined in claim 12 wherein the period of time is set by the controller. ### Claim 15 (depends on 14) The overlay network defined in claim 14 wherein the controller over-rides the period of time set by the designated server and sets the period of time. ### Claim 16 (depends on 11) The overlay network defined in claim 11 wherein the cache stores the response until an event occurs. ### Claim 17 A method comprising: configuring a plurality of transparent access points (TAPs), using a controller, to enable the one or more clients to communicate with the one or more servers over a wide area network (WAN), where each TAP is communicably coupled between the one or more clients and servers and is coupled to other of the plurality of TAPs via permanently, established secure links, and further wherein the controller is coupled to each of the plurality of TAPs via a secure connection, including providing information to enable said each TAP to know what services are available and from which of the plurality of TAPS each of the services can be accessed, and providing each TAP with routing and forwarding tables to indicate where one or more services are available, to specify one or more TAPs to which a service will be forwarded, and to indicate how to reach TAPs wherein the service is available. ### Claim 18 A method comprising: configuring a plurality of transparent access points (TAPs), using a controller, to enable the one or more clients to communicate with the one or more servers over a wide area network (WAN), where each TAP is communicably coupled between the one or more clients and servers and is coupled to other of the plurality of TAPs via permanently, established secure links, and further wherein the controller is coupled to each of the plurality of TAPs via a secure connection, including providing information to enable said each TAP to know what services are available and from which of the plurality of TAPS each of the services can be accessed, the administrator of the TAP and the controller cross-verifying each other using the fingerprint of the TAP's and controller's certificate during configuration. ### Claim 19 A method comprising: configuring a plurality of transparent access points (TAPs), using a controller, to enable the one or more clients to communicate with the one or more servers over a wide area network (WAN), where each TAP is communicably coupled between the one or more clients and servers and is coupled to other of the plurality of TAPs via permanently, established secure links, and further wherein the controller is coupled to each of the plurality of TAPs via a secure connection, including providing information to enable said each TAP to know what services are available and from which of the plurality of TAPS each of the services can be accessed, at least one of the plurality of TAPs performing dictionary-based compression on at least one request or response and then sending the least one request or response over the WAN to a receiving TAP of the plurality of TAPs, the dictionary-based compression replacing at least a portion of the at least one request or response with an index. ### Claim 20 (depends on 19) The method defined in claim 19 further comprising the receiving TAP using a dictionary to reconstruct the at least one request or response that underwent dictionary-based compression. ### Claim 21 (depends on 19) The method defined in claim 19 further comprising the at least one TAP sending information to enable reconstruction of the at least a portion of the at least one request or response to the receiving TAP when substituting the index for the portion for the first time. ### Claim 22 A method comprising: configuring a plurality of transparent access points (TAPs), using a controller, to enable the one or more clients to communicate with the one or more servers over a wide area network (WAN), where each TAP is communicably coupled between the one or more clients and servers and is coupled to other of the plurality of TAPs via permanently, established secure links, and further wherein the controller is coupled to each of the plurality of TAPs via a secure connection, including providing information to enable said each TAP to know what services are available and from which of the plurality of TAPS each of the services can be accessed, one TAP of the plurality of TAPs receiving a request for a designated server from one of the clients and checks a cache to determine whether a response to the request is already stored in the cache, the one TAP sending the response from the cache to satisfy the request, instead of sending the response over the WAN toward the designated server. ### Claim 23 (depends on 22) The method defined in claim 22 wherein the cache stores the response for a period of time. ### Claim 24 (depends on 23) The method defined in claim 23 wherein the period of time is set by the designated server. ### Claim 25 (depends on 23) The method defined in claim 23 wherein the period of time is set by the controller. ### Claim 26 (depends on 25) The method defined in claim 25 further comprising the controller over-riding the period of time set by the designated server and sets the period of time. ### Claim 27 (depends on 25) The method defined in claim 25 wherein the cache stores the response until an event occurs.