Virtual private network with multiple tunnels associated with one group name

Claim 3

The method as recited in claim 1 further comprising the step of: configuring a tunnel definition database in said server node, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name.

Claim 4

The method as recited in claim 1 , wherein said list of members associated with said group name comprise an ID type and an ID of each member associated with said group name.

Claim 5

The method as recited in claim 3 , wherein said ID type is an Internet Key Exchange (IKE) defined ID type, wherein said list of members is a non-contiguous list of IKE defined ID types.

Claim 6

The method as recited in claim 3 , wherein said ID is a login ID.

Claim 7

The method as recited in claim 3 , wherein said ID is a specified name.

Claim 8

The method as recited in claim 2 , wherein configuring said tunnel definition database in said server node comprises establishing said server node and said client node as the two end points of said tunnel.

Claim 9

The method as recited in claim 7 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a GUI.

Claim 10

The method as recited in claim 7 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a command line interface.

Claim 11

The method as recited in claim 1 , wherein said group database in said server node comprises said group name and an ID type of each member of said group name and an ID of each member of said group name.

Claim 12

The method as recited in claim 10 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a GUI.

Claim 13

The method as recited in claim 10 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a command line interface.

Claim 14

The method as recited in claim 10 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through configuration files.

Claim 15

The method as recited in claim 1 , wherein said rules database in said server node comprises said group name, a group name ID type and a security policy pointer.

Claim 16

The method as recited in claim 14 , wherein configuring said rules database in said server node is accomplished by entering said group name, said group name ID type and said security policy pointer through a GUI.

Claim 17

The method as recited in claim 14 , wherein configuring said rules database in said server node is accomplished by entering said group name, said group name ID type and said security policy pointer through a command line interface.

Claim 20

The method as recited in claim 17 , wherein said first and second nonce are used to generate key material for said server and client node, respectively.

Claim 21

The method as recited in claim 17 , wherein said policy database in said client and server node are configured by entering said security policy through a GUI at said client and server node.

Claim 22

The method as recited in claim 17 , wherein said policy database in said client and server node are configured by entering said security policy through a command line interface at said client and server node.

Claim 23

The method as recited in claim 17 , wherein said first ID is an ID of said particular member of said group name.

Claim 26

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name.

Claim 27

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name.

Claim 28

The virtual private network system as recited in claim 23 , wherein said server node further comprises: a tunnel definition database, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name.

Claim 29

The virtual private network system as recited in claim 24 , wherein a particular tunnel of said plurality of tunnels associated with said group name is activated, wherein said particular tunnel is associated with a particular member of said group name.

Claim 30

The virtual private network system as recited in claim 23 , wherein said list of members associated with said group name comprise an ID type and an ID of each member associated with said group name.

Claim 31

The virtual private network system as recited in claim 26 , wherein said ID type is an Internet Key Exchange (IKE) defined ID type, wherein said list of members is a non-contiguous list of IKE defined ID types.

Claim 32

The virtual private network system as recited in claim 26 , wherein said ID is a login ID.

Claim 33

The virtual private network system as recited in claim 26 , wherein said ID is a specified name.

Claim 34

The virtual private network system as recited in claim 24 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a GUI.

Claim 35

The virtual private network system as recited in claim 24 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a command line interface.

Claim 36

The virtual private network system as recited in claim 23 , wherein said group database in said server node comprises said group name and an ID type of each member of said group name and an ID of each member of said group name.

Claim 37

The virtual private network system as recited in claim 32 , wherein said group database in said server node is configured by a user entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a GUI.

Claim 38

The virtual private network system as recited in claim 32 , wherein said group database in said server node is configured by a user entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a command line interface.

Claim 39

The virtual private network system as recited in claim 32 , wherein said group database in said server node is configured by a user entering said group name, said ID type of each member of said group name and said ID of each member of said group name through configuration files.

Claim 40

The virtual private network system as recited in claim 23 , wherein said rules database in said server node comprises said group name, a group name ID type and a security policy pointer.

Claim 41

The virtual private network system as recited in claim 36 , wherein said rules database is configured by a user entering said group name, said group name ID type and said security policy pointer through a GUI.

Claim 42

The virtual private network system as recited in claim 37 , wherein said rules database is configured by a user entering said group name, said group name ID type and said security policy pointer through a command line interface.

Claim 43

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name; wherein the server node further comprises; a tunnel definition database, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name; wherein a particular tunnel of said plurality of tunnels associated with said group name is activated, wherein said particular tunnel is associated with a particular member of said group name; wherein activating said particular tunnel comprises the steps of: sending a security policy stored in a policy database of said client node by said client node to said server node; sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node matches said security policy stored in said policy database of said client node; sending a first nonce by said client node to said server node; sending a second nonce by said server node to said client node; sending a first ID by said client node to said server node; and sending a second ID by said server node to said client node.

Claim 44

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name; wherein the server node further comprises; a tunnel definition database, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name; wherein a particular tunnel of said plurality of tunnels associated with said group name is activated, wherein said particular tunnel is associated with a particular member of said group name; wherein activating said particular tunnel comprises the steps of: sending a security policy stored in a policy database of said client node by said client node to said server node; sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node matches said security policy stored in said policy database of said client node; sending a first nonce by said client node to said server node; sending a second nonce by said server node to said client node; sending a first ID by said client node to said server node; and sending a second ID by said server node to said client node.

Claim 45

The virtual private network system as recited in claim 39 , wherein said first and second nonce are used to generate key material for said server and client node, respectively.

Claim 46

The virtual private network system as recited in claim 39 , wherein said policy database in said client and server node are configured by entering said security policy through a GUI at said client and server node.

Claim 47

The virtual private network system as recited in claim 39 , wherein said policy database in said client and server node are configured by entering said security policy through a command line interface at said client and server node.

Claim 48

The virtual private network system as recited in claim 39 , wherein said first ID is an ID of said particular member of said group name.

Claim 49

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name; wherein the server node further comprises; a tunnel definition database, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name; wherein a particular tunnel of said plurality of tunnels associated with said group name is activated, wherein said particular tunnel is associated with a particular member of said group name; wherein activating said particular tunnel comprises the steps of sending a security policy stored in a policy database of said client node by said client node to said server node; sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node agrees on the same set of protection suites at any point in time with said security policy stored in said policy database of said client node; sending a first nonce by said client node to said server node; sending a second nonce by said server node to said client node; sending a first ID by said client node to said server node; and sending a second ID by said server node to said client node.

Claim 50

A virtual private network system comprising: a plurality of tunnels associated with a group name, wherein each of said plurality of tunnels associated with said group name comprises a plurality of nodes, wherein each of said plurality of nodes comprises a communication adapter to interconnect with said virtual private network, wherein one of said plurality of nodes is a server node, wherein one of said plurality of nodes is a client node, wherein said server node comprises: a group database, wherein said group database comprises said group name and a list of members associated with said group name; and a rules database, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single copy of a security policy for each of the plurality of tunnels associated with said group name; wherein the server node further comprises; a tunnel definition database, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name; wherein a particular tunnel of said plurality of tunnels associated with said group name is activated, wherein said particular tunnel is associated with a particular member of said group name; wherein activating said particular tunnel comprises the steps of sending a security policy stored in a policy database of said client node by said client node to said server node; sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node agrees on the same set of protection suites at any point in time with said security policy stored in said policy database of said client node; sending a first nonce by said client node to said server node; sending a second nonce by said server node to said client node; sending a first ID by said client node to said server node; and sending a second ID by said server node to said client node.

Claim 51

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; and programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group.

Claim 52

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; and programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group.

Claim 53

The computer program product as recited in claim 45 further comprises: programming operable for configuring a tunnel definition database in said server node, wherein a remote ID in said tunnel definition is defined as said group name, wherein said server node has a single tunnel definition for each of the plurality of tunnels associated with said group name.

Claim 54

The computer program product as recited in claim 45 , wherein said list of members associated with said group name comprise an ID type and an ID of each member associated with said group name.

Claim 55

The computer program product as recited in claim 47 , wherein said ID type is an Internet Key Exchange (IKE) defined ID type, wherein said list of members is a non-contiguous list of IKE defined ID types.

Claim 56

The computer program product as recited in claim 47 , wherein said ID is a login ID.

Claim 57

The computer program product as recited in claim 47 , wherein said ID is a specified name.

Claim 58

The computer program product as recited in claim 46 , wherein configuring said tunnel definition database in said server node comprises: programming operable for establishing said server node and said client node as the two end points of said tunnel.

Claim 59

The computer program product as recited in claim 51 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a GUI.

Claim 60

The computer program product as recited in claim 51 , wherein said tunnel definition database in said server node is configured by a user entering a local ID, a local ID type, said remote ID and a remote ID type through a command line interface.

Claim 61

The computer program product as recited in claim 45 , wherein said group database in said server node comprises said group name and an ID type of each member of said group name and an ID of each member of said group name.

Claim 62

The computer program product as recited in claim 54 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a GUI.

Claim 63

The computer program product as recited in claim 54 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through a command line interface.

Claim 64

The computer program product as recited in claim 54 , wherein configuring said group database in said server node is accomplished by entering said group name, said ID type of each member of said group name and said ID of each member of said group name through configuration files.

Claim 65

The computer program product as recited in claim 45 , wherein said rules database in said server node comprises said group name, a group name ID type and a security policy pointer.

Claim 66

The computer program product as recited in claim 58 , wherein configuring said rules database in said server node is accomplished by entering said group name, said group name ID type and said security policy pointer through a GUI.

Claim 67

The computer program product as recited in claim 58 , wherein configuring said rules database in said server node is accomplished by entering said group name, said group name ID type and said security policy pointer through a command line interface.

Claim 68

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group; and programming operable for activating said tunnel, wherein said programming operable for activating said tunnel comprises: programming operable for sending a security policy stored in a policy database of said client node by said client node to said server node; programming operable for sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node matches said security policy stored in said policy database of said client node; programming operable for sending a first nonce by said client node to said server node; programming operable for sending a second nonce by said server node to said client node; programming operable for sending a first ID by said client node to said server node; and programming operable for sending a second ID by said server node to said client node.

Claim 69

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group; and programming operable for activating said tunnel, wherein said programming operable for activating said tunnel comprises: programming operable for sending a security policy stored in a policy database of said client node by said client node to said server node; programming operable for sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node matches said security policy stored in said policy database of said client node; programming operable for sending a first nonce by said client node to said server node; programming operable for sending a second nonce by said server node to said client node; programming operable for sending a first ID by said client node to said server node; and programming operable for sending a second ID by said server node to said client node.

Claim 70

The computer program product as recited in claim 61 , wherein said first and second nonce are used to generate key material for said server and client node, respectively.

Claim 71

The computer program product as recited in claim 61 , wherein said policy database in said client and server node are configured by entering said security policy through a GUI at said client and server node.

Claim 72

The computer program product as recited in claim 61 , wherein said policy database in said client and server node are configured by entering said security policy through a command line interface at said client and server node.

Claim 73

The computer program product as recited in claim 61 , wherein said first ID is an ID of said particular member of said group name.

Claim 74

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group; and programming operable for activating said tunnel, wherein said programming operable for activating said tunnel comprises: programming operable for sending a security policy stored in a policy database of said client node by said client node to said server node; programming operable for sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node agrees on the same set of protection suites at any point in time with said security policy stored in said policy database of said client node; programming operable for sending a first nonce by said client node to said server node; programming operable for sending a second nonce by said server node to said client node; programming operable for sending a first ID by said client node to said server node; and programming operable for sending a second ID by said server node to said client node.

Claim 75

A computer program product having a computer readable medium having computer program logic recorded thereon for allowing a server node in a virtual private network to have a single tunnel definition and a single security policy for a plurality of tunnels associated with a group name, comprising: programming operable for configuring a group database in said server node, wherein said group database in said server node comprises said group name and a list of members associated with said group name; programming operable for configuring a rules database in said server node, wherein said rules database associates said group name with a particular security policy, wherein said server node has a single security policy for each of the plurality of tunnels associated with said group name; programming operable for establishing a tunnel having a tunnel definition between a client node having a member name and said server node by negotiating a common security policy; programming operable for associating said tunnel with a group in said group database based on said member name such that only one copy of said tunnel definition and associated security policy is maintained on said server node regardless of the number of client nodes to server node tunnels associated with said group; and programming operable for activating said tunnel, wherein said programming operable for activating said tunnel comprises: programming operable for sending a security policy stored in a policy database of said client node by said client node to said server node; programming operable for sending a security policy stored in a policy database of said server node by said server node to said client node if said security policy stored in said policy database of said server node agrees on the same set of protection suites at any point in time with said security policy stored in said policy database of said client node; programming operable for sending a first nonce by said client node to said server node; programming operable for sending a second nonce by said server node to said client node; programming operable for sending a first ID by said client node to said server node; and programming operable for sending a second ID by said server node to said client node.