Virtual private network (VPN)-as-a-service with delivery optimizations while maintaining end-to-end data security

Abstract

A mechanism to facilitate a private network (VPN)-as-a-service, preferably within the context of an overlay IP routing mechanism implemented within an overlay network. A network-as-a-service customer operates endpoints that are desired to be connected to one another securely and privately using the overlay IP (OIP) routing mechanism. The overlay provides delivery of packets end-to-end between overlay network appliances positioned at the endpoints. During such delivery, the appliances are configured such that the data portion of each packet has a distinct encryption context from the encryption context of the TCP/IP portion of the packet. By establishing and maintaining these distinct encryption contexts, the overlay network can decrypt and access the TCP/IP flow. This enables the overlay network provider to apply one or more TCP optimizations. At the same time, the separate encryption contexts ensure the data portion of each packet is never available in the clear at any point during transport.

Having described the invention, what is claimed is set forth below: 
     
         1 . A method operative in a routing overlay network that couples a first endpoint location to a second endpoint location, wherein each endpoint location is associated with a firewall of an enterprise, the routing overlay network comprising a set of machines distributed at least in part across Internet locations, the routing overlay network comprising an ingress point associated with the first endpoint location, and an egress point associated with a second endpoint location, comprising:
 positioning respective first and second network appliances in association with the ingress and egress points of the routing overlay network;   establishing a secure logical VPN tunnel between the first network appliance and the ingress point, wherein a machine of the set of machines at the ingress point uses keep-alive signaling to maintain the secure logical VPN tunnel through the firewall associated with the first endpoint location;   establishing a secure logical VPN tunnel between the second network appliance and the egress point, wherein a machine of the set of machines at the egress point uses keep-alive signaling to maintain the secure logical VPN tunnel through the firewall associated with the second endpoint location;   with respect to traffic that originates behind the firewall associated with the first endpoint location, wherein the traffic is destined for delivery behind the firewall associated with the second endpoint location, establishing and maintaining a segmented tunnel for packet delivery end-to-end between the first and second network appliances; and   applying a routing optimization to the traffic as it flows on the routing overlay network.