IP security with seamless roaming and load balancing

[0001] The invention relates generally to telecommunications. More particularly, the invention relates to a method and system for seamless roaming and load balancing during a VPN session.

[0002] In recent years the number of wireless networks has increased significantly. Wireless connectivity enables users to have access to other users, local area networks (LANs) and wide area networks (WANs), including the Internet, without requiring the user to remain at a single location. Moreover, the user's mobility is generally not restricted within the coverage area of the wireless network.

[0003] Wireless connectivity is not without disadvantages. Information transmitted in a wireless network can be intercepted by anyone in the range of the user that has a wireless receiver. Various types of security solutions have been developed to address these security concerns. One solution, virtual private networks (VPNs), provides security to wired and wireless networks. A VPN connects network resources through a secure protocol tunnel so that resources on separate networks seem to share a common private backbone. VPNs can be used, for example, to enable an employee to connect to an office LAN via an insecure home Internet connection or to permit a salesperson to access a corporate LAN while on travel. Advantageously, users realize the same confidentiality provided by private networks although the tunnel may utilize a public network.

[0004] Security is achieved, for example, using Internet Protocol security (IPSec). IPSec is a security architecture for Internet protocol (IP) communication that is based on a set of protocols developed by the Internet Engineering Task Force (IETF) for the secure exchange of packets at the IP layer. IPSec provides security by enabling a system to select required security protocols, determine one or more algorithms to for implementing security, and manage the use of cryptographic keys. The sending and receiving devices typically share a public key which is handled through an Internet Security Association and Key Management Protocol (ISAKMP).

[0005] A security association (SA) is a security-protocol-specific set of parameters that defines the services and mechanisms used to protect traffic at a security protocol location. These parameters typically include algorithm identifiers, modes, cryptographic keys, and the like. SAs are generally referred to by their associated security protocols (e.g., ISAKMP SA).

[0006] Today, IPSec VPN users are “anchored” to a specific VPN server or VPN cluster. Consequently, the mobility of each user is limited according to the reachability of its VPN server/cluster. As the user roams, some networks may become unreachable while other networks may become reachable. If a mobile user moves outside a private network and loses connectivity, a new IPSec connection may need to be established with a different VPN server or cluster. To overcome this limitation, the wireless device of the mobile user can be registered with a gateway VPN server at the edge of the private network and a public network, instead of a VPN server inside the private network. The gateway VPN server is reachable from the public network thus enabling seamless roaming when the mobile user transitions between the private and public networks. However, this solution can result in “tromboning” traffic within the private network as described in more detail below.

[0007] VPN users can also be affected by changes in server loads. A VPN user anchored to a specific VPN server can experience performance degradation if the load of that server increases during the VPN session. Current load-balancing algorithms for servers only act upon new VPN session requests to distribute server loads.

[0008] What is needed is a method that overcomes the above-described problems for VPN users. The present invention satisfies this need and provides additional advantages.

[0009] In one aspect, the invention features a method for seamless roaming of a mobile node during a VPN session. A VPN session for the mobile node and a current VPN server in a network is established. The VPN session is synchronized with at least one fail-over VPN server in the network. An address change message is sent to the current VPN server and-the fail-over VPN servers upon roaming of the mobile node. A reply message is sent from one of the fail-over VPN servers in response to the address change message. The fail-over VPN server that sent the reply message is registered as a current VPN server for continuation of the VPN session.

[0010] In another aspect, the invention features a method for load balancing during a VPN session of a node. The VPN session is established for the node and a current VPN server in a network. The VPN session is synchronized from the current VPN server to at least one fail-over VPN server in the network. A load query message is sent to the current VPN server and the fail-over VPN servers. A reply message is sent from the current VPN server and at least one of the fail-over VPN servers in response to the load query message. Each reply message includes server performance characteristics information for the respective VPN server. The VPN session is transferred from the current VPN server to one of the fail-over VPN servers in response to the server performance characteristics information in the reply messages.

[0011] In yet another aspect, the invention features a system for seamless roaming of a mobile node during a VPN session. The system includes a plurality of VPN servers each in communication with the other VPN servers over a network. Each VPN server is adapted for communication with the mobile node and is configured for operation as a fail-over VPN server for the VPN session in response to a synchronization by one of the other VPN servers. Each VPN server is configured to send a reply message to the mobile node in response to an address change message and to replace one of the other VPN servers as a current VPN server in response to a designation by the mobile node during the VPN session.

[0012] In still another aspect, the invention features a system for load balancing during a VPN session of a node. The system includes a plurality of VPN servers each in communication with the other VPN servers over a network. Each VPN server is adapted for communication with the node during the VPN session. Each VPN server is configured to send a reply message to the node to indicate a server performance characteristic for the respective VPN server in response to a load query message and is configured to replace one of the other VPN servers as a current VPN server in response to a selection by the node.

[0020] IPSec users are generally registered to a specific VPN server. Mobile nodes are limited in mobility because a change in a mobile node's IP address can result in loss of connectivity with the VPN server and, therefore, the need to initiate a new IPSec connection with a new VPN server. As used herein, mobile node means any mobile device such as a laptop computer, a personal digital assistant, a web-enabled cellular telephone and the like that can be used to communicate with other devices and resources located on a network. The change in IP address can be due to a mobile node roaming from one network with one IP address to a different network with a different IP address. For example, the mobile node can leave a coverage area for a first wireless network and join a different wireless network that is available. In another example, the change in IP address results from a user-initiated transition between two simultaneously available networks. For instance, the mobile node can be a laptop computer that is removed from a docking station on a first network (e.g., local area network (LAN)) and is joined to a second network (e.g., wireless network). The transfer between networks may be made to enable user mobility or to obtain greater bandwidth available over the wireless network. In these examples, the user experiences a disruption when the original IPSec session terminates and a new IPSec is established.

[0021] U.S. patent application Ser. No. 10/791,414, filed Mar. 3, 2004 and incorporated herein by reference, describes a solution to the roaming problem. According to the disclosed method a secure network connection established between the mobile node and a security gateway (i.e., the VPN server) is maintained after it is determined that the mobile node has changed its IP address. The mobile node detects its change of IP address when roaming to another network. The mobile node then updates its ISAKMP SAs and IPSec SAs with its new IP address. Using the current ISAKMP SA, a secure notification is sent from the mobile node to the security gateway. This notification, or “address change message”, includes the original IP address and the new IP address for the mobile node. The security gateway determines the appropriate ISAKMP SA for the mobile node based on information in the address change message. The SA is then used to extract the old IP address and new IP address from the address change message, enabling the IPSec session to be maintained. IP traffic between the mobile node and VPN server continues without disruption during the address change. This technique allows the mobile node to change its IP address and stay anchored to the VPN server as long as the VPN server remains reachable to the mobile node. However, the IPSec session is lost if the mobile node is beyond the range of the VPN server or the VPN server is otherwise unreachable. For example, the address change message may not reach the VPN server due to a network address translation (NAT) problem or a network address port translation (NAPT) problem. If the address change message fails to reach the VPN server, the mobile node will not receive a response and the existing IPSec session is dropped. The mobile node then has to initiate a new IPSec session with a different VPN server because the VPN server in the original network is not reachable from the new network.

[0022] In brief overview, the present invention allows a mobile node to maintain an IPSec session without disruption during roaming even if the original VPN server becomes unreachable. The mobile node is effectively registered, or “anchored”, at multiple VPN servers, including a current VPN server and one or more fail-over VPN servers. The mobile node transparently communicates with multiple VPN servers throughout the IPSec session. If the mobile node roams so that the current VPN server becomes unreachable, one of the fail-over VPN servers is used to continue the IPSec session. Advantageously, a node can periodically determine the load on the current VPN server and the fail-over VPN servers so that an existing IPSec session can be transitioned to an appropriate fail-over VPN server for dynamic load-balancing.

[0023] FIG. 1 illustrates a network configuration 10 as known in the art used to achieve “seamless” roaming. In this configuration 10, a mobile node 14 roams from a private network 18 to a public network 22 without breaking an IPSec session and, therefore, without the need to initiate a new IPSec session. When in the private network 18, the mobile node 14 is anchored at a gateway VPN server 26 at the edge of the private network 14 and the public network 22. The gateway VPN server 26 is always reachable from the public network 22 therefore seamless roaming is possible. However, traffic within the private network 18 can experience a “tromboning” effect which may not be acceptable for private networks in large corporations and organizations. More specifically, all traffic destined for a correspondent node (i.e., the peer with which the mobile node corresponds) in the same network goes to the gateway VPN server 26 and then to the correspondent node. Moreover, gateway VPN servers are typically engineered according to an expected number of users located outside the network, not for traffic between correspondent nodes within the network. Thus maintaining a single VPN server (i.e., the gateway VPN server 26) on a network is practical only for small networks. Large corporate networks with internal routing typically have many VPN servers.

[0024] FIG. 2 illustrates another network configuration 30 in which a mobile node 14 roams from a private network 18 to a public network 22. The private network 18 may be maintained by a large corporation or organization. When in the private network 18, the mobile node 14 has access to any number of “internal” VPN servers 34′, 34″ and 34′″ (generally 34), only three of which are shown for clarity. The availability of multiple VPN servers 34 reduces the effects of tromboning described above.

[0025] An IPSec session for the mobile node 14 is anchored at one of the internal VPN servers 34′. When the mobile node 14 moves from the private network 18 to the public network 22, the internal VPN server 34′ can be unreachable due to a network address translation (NAT) problem or a network address port translation (NAPT) problem. The problem can arise because the anchored VPN server 34′ is located in a subnet using a private IP address. Consequently, connectivity between the mobile node 14 and internal VPN server 34′ is lost and the IPSec session terminates. The mobile node 14 then has to initiate an IPSec session with the gateway VPN server 26 to re-establish the IP tunnel. To avoid the problem, the mobile node 14 can always anchor to the gateway VPN server 26 if public roaming is planned; however, this solution creates the tromboning problem described above.

[0026] FIG. 3 is a flowchart representation of an embodiment of a method 100 for seamless roaming of a mobile node in accordance with the invention. FIG. 4 is a network configuration 38 in which the method of FIG. 3 can be practiced. Referring to FIG. 3 and FIG. 4, an IPSec session of a mobile node 14 is established (step 110) with an internal VPN server 34′ in a private network 18. The internal VPN server 34′ synchronizes (step 120) the IPSec session with fail-over VPN servers 26 and 34″. More specifically, the ISAKMP SAs and IPSec SAs are synchronized in a secure manner to the fail-over VPN servers 26, 34″. As the mobile node 14 roams outside the private network 18 and into a public network 22, the anchor VPN server 34′ becomes unreachable. The mobile node 14 can determine that the anchor VPN server 34′ is unreachable by sending an address change message to the server 34′ and noting that no reply is received. Alternatively, the mobile node 14 can determine that the anchor VPN server 34′ has failed via a “keep alive” mechanism at the operating system level of the user device. Upon determining that the anchor VPN server 34′ is unreachable, the mobile node 14 sends (step 130) an address change message to the current VPN server 34′ and the fail-over VPN servers 26, 34″. Although synchronized for the IPSec session, the internal VPN server 34″ does not receive the address change message because the mobile node 14 has left its network. However, the other fail-over VPN server 26 is a gateway server and can therefore receive the address change message through the public network 22. The VPN gateway server 26 sends (step 140) a reply message to the mobile node 14 to indicate that it has received the address change message. The mobile node 14 then registers (step 150) the VPN gateway server 26 as its current VPN server. Subsequent traffic for the IPSec session is tunneled between the mobile node 14 and the gateway VPN server 26. The VPN server 34′ which served as the original anchor point for the IPSec session terminates (step 160) the IPSec session based on idleness. Optionally, the newly-registered current VPN server, i.e., VPN gateway server 26, sends a secure message to the original VPN server 34′ requesting that the VPN server 34′ terminate its participation in the IPSec session.

[0027] In general, it is preferable that interval VPN servers 34 configure at least one gateway VPN server as a fail-over server and that gateway VPN servers configure at last one internal VPN server as a fail-over VPN server. Consequently, the most appropriate VPN server is selected during roaming regardless of whether the mobile node 14 roams between two private networks, between a private network and a public network, or between two public networks.

[0028] Although the network configuration 38 of FIG. 4 shows only two fail-over VPN servers 26, 34″ synchronized with the original anchor server 34′, the invention contemplates synchronization with any number of fail-over servers. Moreover, if multiple fail-over servers send a reply message in response to the address change message, the mobile node 14 can employ an algorithm to determine a preferred fail-over VPN server for continuing the IPSec session. For example, the preferred fail-over VPN server can be the one associated with the first-received reply message. Alternatively, the determination of a preferred fail-over VPN server can be based on prioritization of information included in the reply messages. For example, server performance characteristics received in the reply messages can be used to determine the preferred fail-over VPN server as described in more detail below.

[0029] FIG. 5 is flowchart representation of an embodiment of a method 200 for load balancing during a VPN session of a node in accordance with the invention. FIG. 6 is a network configuration 42 in which the method of FIG. 5 can be practiced. Referring to FIG. 5 and FIG. 6, an IPSec session is established (step 210) between a mobile node 14 and a VPN server 34′ in a network 46. The VPN server 34′ synchronizes (step 220) the IPSec session with two gateway VPN servers 26′ and 26″, and two internal VPN servers 34″ and 34′″, although the invention contemplates more generally any number of gateway VPN servers 26 and internal VPN servers 34 to be used as fail-over VPN servers. Moreover, although FIG. 5 and FIG. 6 describe a mobile node 14, the invention contemplates other nodes, i.e., stationary nodes, that do not change location during the IPSec session.

[0030] The mobile node 14 sends (step 230) a load query message to all the VPN servers 26, 34 to determine the performance characteristics on each server. The load query message can be sent periodically at predetermined intervals to monitor changes in server performance characteristics.

[0031] In response to the load query message, each VPN server 26, 34 sends (step 240) a reply message that includes its performance characteristics. In some instances, one or more of the fail-over VPN servers 26, 34″, 34′″ may be unreachable so that no reply message is sent. The load distribution on the fail-over VPN servers 26, 34″, 34′″ is determined from the reply messages and a preferred VPN server is selected. The IPSec session is transferred (step 250) from the current VPN server 34′ to the preferred VPN server to at least partially compensate, or to better distribute, the load on the servers 26, 34.

[0032] While the invention has been shown and described with reference to specific embodiments, it should be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention. For example, the invention is not limited to IPSec sessions but also contemplates other security architectures and protocols that are implemented for VPN sessions.