DETAILED DESCRIPTION

[0092] Reference will now be made in detail to the exemplary embodiments of the invention, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

[0093] In accordance with an embodiment of the present invention, a prospective user or customer may contact a mediation point or a control system, such as a network operations center via a base network, such as the Internet, and indicate a desire to establish one or more virtual private networks. After answering a series of questions posed by the network operations center, the user receives program code and information for loading onto one or more processors, such as personal computers. The program code and information may be in the form of a disk, such as an optical disk or floppy disk, downloaded over the Internet and onto a disk, or installed directly over the Internet on to a computer. The program code may be distributed to other computers at other desired sites user sites as well. Alternatively, the program code and information may be preinstalled on a computer and delivered to the user.

[0094] The user then runs or boots a computer with the provided code and information. When the computer is booted, it thereafter communicates with the network operations center over the Internet to receive further information such that the computer is configured as a gateway or a computer capable of participating in one or more virtual private networks enabled by the network operations center over a base network, such as the Internet. The provided code and information may also be loaded on other computers such that the computer is configured as a gateway.

[0095] After configuration is completed and based on the user's request, the network operations center may enable over the Internet one or more virtual private networks between the gateway and other gateways configured through the network operations center. At the consent of the user, the virtual private networks may be periodically reconfigured to add additional gateways at, for example, geographically dispersed sites or to provide full or limited access to the networks via other gateways.

[0096] Consequently, the user may configure one or more gateways using a computer, such as a personal computer, without investing in costly proprietary hardware or setting up a typically costly network administration department. Because the gateway as configured is not dependent on a particular piece of hardware, flexible virtual private networks may be inexpensively established between remote locations.

[0097] Accordingly, the user may choose and change its Internet service providers (ISPs), network equipment, and access types (T 1 , cable modem, DSL, etc.) and then access the network operations center through the Internet to update configuration information that may have resulted from such a change. Furthermore, to participate in a virtual private network, a user need not require other users to use specific network gear or sign-up with specific ISPs. Instead, the user may direct other users to the network operations center to receive program code and information to configure one or more gateways capable of participating in one or more virtual private networks.

[0098] The user may quickly bring up new gateways in minutes rather than weeks or months. As explained above, the user may install the program code, log onto a network operations center with any web browser, and connect to London, New York and Boston in minutes. Unlike traditional virtual private network services requiring 30 to 90 days for installation of a new Internet connection, the gateways may be configured to be compatible with the user's existing Internet connections. The user may even start with a dial-up or ISDN connection and later replace it with a faster DSL, cable, or T 1 connection without affecting service. Additionally, unlike traditional network equipment requiring expensive overnight shipping, the gateway program code may be downloaded almost anywhere in the world or may be distributed on a storage device, such as an optical disk or a floppy disk.

[0099] In another embodiment, two or more users may register with a controller or network operations center using a web browser. The network operations center may prompt them to provide basic identifying information, such as the Internet Protocol (IP) addresses of their computers. The network operations center may then generate a program code and configuration information and provide them to each user. After the users install the program code and configuration information on their respective computers, the respective computers establish communication with the network operations center to obtain additional configuration information for configuring themselves as gateways. After configuration is completed, one or more of the computers communicates its consent to the network operations center for establishing a tunnel to the other computer. Each computer may communicate its consent mutually and/or independently of the other computer.

[0100] If both gateways consent, the network operations center then proceeds to enable a tunnel between the user computers. The network operations center may enable the tunnel by providing sufficient information to each computer over the Internet such that the computer may establish the tunnel with the provided information. Once the tunnel is enabled, the computers may establish the tunnel and then use the tunnel to exchange information in a secure and trusted manner. At any time, each computer may withdraw its consent and terminate the tunnel. Furthermore, other computers configured through the network operations center may also join the virtual private network.

[0101] Consequently, the tasks of installing a gateway, establishing a virtual private network, and joining a virtual private network are simplified from the perspective of the users, even when establishing a temporary virtual private network for a short term project or a short term financial transaction (e.g., a purchase or sale).

[0102] As such, the described methods and systems may be for various applications, such as, for example, enabling the establishment of virtual private networks without costly hardware and software outlays; providing virtual private networks to businesses that sell products to customers over the Internet; providing virtual private networks to users of a corporate Intranet that seek to share information with outside users in a secure manner; and providing virtual private networks to users of the Internet in general. In such applications, the users may communicate with the virtual private networks by registering over the Internet with a control system, such as a network operations center; installing a program code; and indicating a consent to participate in a virtual private network. As a result, managing virtual private networks is simplified since users are not required to, for example, coordinate selection of encryption algorithms and/or authentication techniques; monitor and/or control tunnels of virtual private networks; and/or recover virtual private networks from failures.

[0103] From a business perspective, the user may be charged a periodic fee based on the number of gateways configured by the user through the network operations center. Alternatively, charges might also be assessed based on one or more of the following: the volume of information transported on the virtual private networks, the number of tunnels, or the usage time.

[0104] Before embarking on an element-by-element description of various preferred embodiments, the following terms are described. A gateway refers to any processor through which access is provided to a network. For example, a gateway may provide hosts or computers in a local area network or in a wide area network access to another network. A processor may include, for example, a personal computer, router, bridge, server, or any other network device. An encrypted information flow includes a flow of information that is encrypted. An example of an encrypted information flow is a tunnel, such as an encrypted tunnel. A tunnel may be established, for example, when two gateways open a channel of communication through a base network, such as the Internet. A tunnel may be enabled, for example, when a gateway is provided with authorization and/or sufficient information that may be used by the gateway to establish a tunnel with another gateway.

[0105] FIG. 1 shows a general block diagram of a network 100 , in accordance with an embodiment of the present invention. The network 100 may include a control system 175 with one or more network operations centers 170 , a communication channel 120 , one or more gateways 150 - 153 , one or more local networks 160 , 161 , one or more hosts 154 , 155 , and a computer 101 . The communication channel 120 may include a shared or base network, such as the Internet to facilitate communication and exchanges between the various entities depicted in the network 100 of FIG. 1 .

[0106] In accordance with an embodiment of the present invention, a first gateway, such as gateway 150 may establish through communication channel 120 a first encrypted information flow to the control system 175 . This first encrypted information flow may permit the control system 175 to exchange control information through the communication channel 120 with the first gateway 150 . Further, a second gateway, such as gateway 151 may establish through communication channel 120 a second encrypted information flow to the control system 175 . This second encrypted information flow may also permit the control system 175 to exchange with the second gateway 151 control information through the communication channel 120 . Since both of these information flows may be encrypted, the encrypted information flow may provide privacy.

[0107] The control system 175 may also enable a third encrypted information flow through the communication channel 120 between the first gateway 150 and the second gateway 151 . The control system 175 may enable the third encrypted information flow after the first gateway 150 and the second gateway 151 consent to enabling the third encrypted information flow.

[0108] The consent communicated to the control system 175 may be mutual in that the first gateway 150 and the second gateway 151 each consents to enabling of the third tunnel. Moreover, the consent may be independent in that the first gateway 150 and the second gateway 151 independently consent to the establishment of the third tunnel without regard to whether the other gateway consents. A gateway may communicate its consent by identifying the names and/or addresses of the other gateways. For example, in an embodiment, a gateway may identify its consent to enabling a tunnel with another gateway by simply providing the name of the other gateway to the control system 175 . If the control system 175 determines that the consent is mutual (i.e., that the other gateway also consents to enabling the tunnel), the control system 175 places the other gateway on a list (hereinbelow referred to as a partner list) that will be provided to the gateway. Likewise, the control system places the gateway on the partner list for the other gateway. That is, the control system 175 places each gateway on the partner list of the other gateway and provides the respective partner lists to each gateway. Accordingly, the partner list reflects the mutual desire of each gateway to enable a tunnel.

[0109] For example, referring to FIG. 1, a user using host computer 155 may use a web browser to access the control system 175 through the tunnel between gateway 150 and the control system 175 . The control system 175 may then provide the user with the names of other gateways that gateway 150 may establish a tunnel with (e.g., the names for gateways 151 - 153 ). The user then may select one or more names corresponding to the other gateways that gateway 150 consents to enabling a tunnel with. The user may then submit the names of the selected gateways to the control system 175 , which determines if there is mutual consent for each of the selected gateways. That is, the control system 175 determines for each of the selected gateways whether or not the selected gateway also consents to enabling a tunnel with gateway 150 . If there is mutual consent, each of the selected gateways that also consents is added to the partner list for gateway 150 , and gateway 150 is also added to the partner list for each of the selected gateways. These partner lists may then be forwarded by the control system 175 to gateway 150 and each of the selected gateways.

[0110] Accordingly, when the control system 175 determines that the first gateway 150 and the second gateway mutually consent to the third tunnel, the control system may then provide to the first and second gateways through the first and second tunnels, respectively, sufficient information to enable the third tunnel. The third tunnel may be enabled, for example, when the first and second gateways are provided sufficient information allowing them to establish this third tunnel through the communication channel 120 . In one embodiment, the sufficient information includes the partner list for the first gateway and the partner list for the second gateway. Moreover, for each gateway listed on the partner list, the partner list may include, for example, a virtual IP address, a real IP address, and/or other information describing each gateway. After the third tunnel is enabled, the first and second gateways 150 , 151 may establish the third tunnel through the communication channel 120 . This third tunnel may provide privacy as to the exchanged information and may also be authenticated using an Internet Protocol Security (IPSec) compliant authentication technique, such as MD-5 hashing. Also, the encryption used for the encrypted information flow may be a weak encryption or encoding algorithm that provides minimal privacy or may be a strong encryption scheme that essentially guarantees privacy.

[0111] An encrypted information flow, such as a tunnel may be established through communication channel 120 by, for example, encapsulating a protocol within another protocol. For example, a tunnel may be encrypted when an Internet Protocol packet encapsulates an encryption protocol. Examples of encryption protocols may include RSA, Digital Encryption Standard (DES), and Triple DES (3DES). For example, an encrypted tunnel may be established using Internet Protocol (IP) packets such that the payload of each packet is encrypted but the address of each packet is unencrypted (i.e., clear-text). As a result, the encrypted payload may be encapsulated by a clear text IP address, forming a virtual tunnel through a base network, such as the communication channel 120 . Other encrypted tunnels may be established through the communication channel 120 with other gateways, such as gateways 152 and 153 . These virtual tunnels established through the base network and enabled by the control system 175 may also form a virtual network. If a virtual network enabled by the control system 175 uses some type of encoding or encryption for privacy, the virtual network may also be referred to as a virtual private network.

[0112] In the embodiment of FIG. 1 , the computer 101 may include, for example, a personal computer and/or a workstation that include a web browser, such as the Netscape Navigator developed by Netscape or the Internet Explorer developed by Microsoft. The computer 101 may connect to the control system 175 through the communication channel 120 using the web browser. Once the computer 101 connects to the control system 175 , a user may register one or more gateways with the control system 175 and define an initial configuration for one or more of the gateways 150 - 153 desiring to participate in one or more virtual private networks.

[0113] After the initial configuration of the gateways 150 - 153 is defined, the control system 175 may create a disk image that includes program code and information for configuring the gateways 151 - 153 . The disk image may include, for example, a copy of the program code required to configure a personal computer as a gateway. Alternatively, the control system 175 may install through the communication channel 120 a bootable program on the gateways 151 - 153 . After executing the bootable program on a computer, the bootable program may retrieve additional program code and configuration information from the control system 175 or other secured site to configure the computer as a gateway. Moreover, the program code may be loaded onto the gateways 150 - 153 using a single disk (not shown) and/or downloaded through the communication channel 120 . Once the program code is installed, the gateways 150 - 153 may be capable of being enabled by the control system 175 and participating in one or more virtual networks or virtual private networks through the communication channel 120 .

[0114] The disk image may include program code for one or more of the following: program code for IPSec; program code for communications between network operations center 170 and gateways 151 - 153 ; the Linux Operating System (OS) including kernel and device drivers; the configuration of the IP stack such as a Dynamic Host Configuration Protocol (DHCP) client and a DHCP Server; program code for routing packets through one or more tunnels established between gateways 151 - 153 ; access control information for limiting the functions performed through one or more tunnels established between gateways 151 - 153 ; program code for the SOCKS Proxy code; program code for a web browser; and any other software that may be installed based on the user's configuration. In addition, the LINUX operating system may be a “hardened” version of Linux to improve the security of the operating system. When each of the gateways 150 - 153 loads the disk image, each gateway may execute the program code contained in the disk image. As each of the gateways 151 - 153 performs the steps contained in the program code, each may connect to the control system 175 and establish an encrypted information flow to the control system 175 .

[0115] The control system 175 may also enable an encrypted information flow between at least two gateways, permitting them to exchange information or traffic in a private manner. Further, the control system 175 may control and/or monitor the encrypted information flows in the network 100 by exchanging control and/or monitoring information with the gateways over the encrypted information flow.

[0116] Referring to FIG. 1 , the control system 175 may include one or more network operation centers 170 . Each of the network operation centers 170 may be located at the same location or may be distributed along the communication channel 120 connecting the distributed network operation centers 170 . If the network operations centers 170 are distributed, they may also use one or more gateways configured as described above to provide privacy and/or authentication. The control system 175 and the network operation centers 170 may be implemented with at least one processor including, for example, one or more of the following components: a central processing unit, a co-processor, a memory, a storage device, an input device, an output device, a network interface, a display, and/or other processing devices and systems.

[0117] The gateways 150 - 153 may each include, for example, one or more of the following processors: a computer, a server, a router, a switch, a portable device such as a cell phone or a personal digital assistant, or any other communication device capable of performing the functions of the gateway in accordance with the present invention. A gateway may participate as a stand-alone node or computer interfacing the communication channel 120 (see, e.g., the gateways 152 and 153 ) and/or as a gateway interfacing a local network (see, e.g., the gateways 150 and 151 ). In a stand-alone configuration, for example, the gateway 153 may permit a user to participate in one or more virtual private networks established over communication channel 120 . In a local network configuration, for example, the gateway 150 may interface the local network 100 to permit one or more users, such as hosts 154 and 155 to participate in one or more virtual private networks established over communication channel 120 . Furthermore, in the local network configuration, the gateway may resolve address conflicts that may exist with the local area network 160 and other networks such as local area network 161 .

[0118] The host computers 154 and 155 may each include a processor, such as a computer 200 shown in FIG. 2 . The computer 200 may include an input module 205 , a central processing unit (CPU) 220 , a storage module 250 , and an output module 230 . The output module 230 may include a display 235 , a printer 236 , and a network interface 238 . One of ordinary skill in the art will recognize that each host computer 154 and 155 may also function as a gateway in accordance with the present invention. Although FIG. 2 shows a computer 200 , other devices, such as printers, personal digital assistants, wireless devices, and mobile phones, may function as a host computer and participate in one or more virtual private networks established over communication channel 120 .

[0119] The input module 205 of FIG. 2 may be implemented with a variety of devices to receive a user's input and/or provide the input to the CPU 220 . Some of these devices (not shown) may include, for example, a network interface module, a modem, a keyboard, a mouse, and an input storage device.

[0120] Although FIG. 2 illustrates only a single CPU 220 , computer 200 may alternatively include a set of CPU. The CPU 220 may also include, for example, one or more of the following: a co-processor, memory, registers, and other processing devices and systems as appropriate.

[0121] The storage module 250 may be embodied with a variety of components or subsystems including, for example, a hard drive, an optical drive, a general-purpose storage device, a removable storage device, and/or other devices capable of storing. Further, although storage module 250 is illustrated in FIG. 2 as being separate or independent from CPU 220 , the storage module and CPU 220 may be implemented as part of a single platform or system.

[0122] Referring again to FIG. 1 , the communication channel 120 may facilitate communication between the various entities depicted in the network 100 . The communication channel may include, for example, a telephony-based network, a local area network (LAN), a wide area network (WAN), a dedicated Intranet, the Internet, and/or a wireless network. Further, any suitable combination of wired and/or wireless components and systems may be incorporated into the communication channel 120 . Any suitable combination of point-to-point communications or network communications may also be incorporated into communication channel 120 to facilitate communication between the entities illustrated in FIG. 1 . Moreover, although local networks 160 , 161 are shown as being separate from the communication channel 120 , the local network 160 , 161 may be implemented in the same manner as the communication channel 120 or include one or more of the features of the communication channel 120 .

[0123] In one embodiment, a user may serve as an administrator and may register at least one of the gateways 150 - 153 through control system 175 and/or establish one or more virtual private networks over communication channel 120 . The user may use an Internet browser on computer 101 to contact the control system 175 , to register at least one of the gateways 150 - 153 , and/or establish one or more virtual private networks over communication channel 120 . Moreover, although the computer 101 is shown as a stand-alone entity in the embodiment of FIG. 1 , the computer 101 may alternatively be co-located with one or more of the gateways 150 - 153 , the control system 170 , and/or the communication channel 120 .

[0124] Furthermore, the user may register with the control system 175 and provide basic information, such as the number of gateways participating in the virtual private network and billing information. Once registered, the user may receive code generated by the control system 175 . The user may then reboot a computer with the received code to configure the computer as a gateway. That is, the administrator may install the code on any computer that the administrator desires to configure as a gateway including the computer serving as the computer 101 . The configured gateway may then establish a tunnel to another gateway (i.e., similarly configured by the control system 175 ) after the control system 175 determines that each gateway mutually consents to enabling the tunnel and provides each gateway with sufficient information to enable the tunnel.

[0125] FIG. 3 shows an exemplary flowchart for initially registering one or more gateways with the control system 175 . Referring to FIGS. 1 and 3 , the user may register at least one of the gateways 150 - 153 with the control system 175 (step 310 ) and define a configuration for the registered gateways 150 - 153 (step 320 ). In one embodiment, the user may contact the control system 175 through the Internet using a web browser to specify a particular configuration for a gateway. This specified configuration information may include a name for the gateway and a name for the virtual private network. This name for the virtual private network will hereinafter be referred to as the virtual private network's domain name.

[0126] The control system 175 may use the specified configuration to assemble code and information, such as program code and textual information (e.g., Extensible Markup Language also referred to as “XML”), in the form of a disk image (step 330 ). This disk image may include all the program code and information needed to configure gateways 150 - 153 for establishing one or more virtual private networks established over communication channel 120 . The disk image may then be provided to the user and installed on a processor, such as a personal computer or a general-purpose computer (step 340 ). When the processor reboots, it uses the information provided in the disk image to configure itself as a gateway capable of establishing secure tunnels to the control system 175 . The disk image may be sized to fit on a single storage medium, such as a floppy disk or optical disk. Moreover, the disk may be distributed through alternative channels of distribution, such as direct mail, unsolicited mail, over-the-counter retail, or may be distributed with other hardware and software provided by a vendor. Alternatively, the disk image may be downloaded from the control system onto a storage medium or may be stored at the control system 175 for later transfer to the gateways 150 - 153 . Accordingly, a commercial-off-the-shelf computer may be configured as a gateway capable of participating in one or more virtual private networks established over communication channel 120 .

[0127] The control system 175 may perform various functions including, for example, enabling tunnels between two or more gateways in network 100 ; assembling and/or configuring a user's computer as a gateway; negotiating an authentication technique; determining one or more partner lists for the gateways 150 - 153 ; administering the configuration of virtual private networks established over communication channel 120 ; providing virtual Internet Protocol (IP) addresses to each gateway; monitoring and/or controlling the established virtual private networks; enabling the establishment of tunnels between two or more gateways in the network 100 ; enabling the establishment of tunnels with gateways not accessible behind firewalls; and/or recovering the established virtual private networks after a failure. The control system 175 may exchange control information with each of the gateways 150 - 153 through a tunnel established through the communication channel 120 . Moreover, each pair of the gateways 150 - 153 may exchange information through one or more tunnels established between the gateways.

[0128] FIG. 4 shows an exemplary virtual private network 400 established over the communication channel 120 . This exemplary network 400 will be used to illustrate how such a network is enabled. The network 400 includes a first gateway 450 , a second gateway 451 , a computer 401 , a first tunnel 425 , a second tunnel 426 , a third tunnel 423 , and the control system 175 . The first tunnel 425 , the second tunnel 426 , and the third tunnel 423 may be established through the communication channel 120 . Moreover, gateway 450 and gateway 451 may each participate as a stand-alone node in the virtual private network 400 or as a node interfacing a local network, such as local network 160 shown in FIG. 1 .

[0129] The virtual private network 400 may be established after each of the gateways 450 , 451 establishes a tunnel (e.g., the first tunnel 425 and the second tunnel 426 ) to the control system 175 ; after the first gateway 450 and the second gateway 451 each communicate to the control system 175 a consent to enable the third tunnel 423 between the first gateway 450 and the second gateway 451 ; after the control system 175 provides to the first gateway and the second gateway sufficient information to enable the third tunnel 423 ; and after the first gateway 450 and the second gateway 451 establish the third tunnel 423 . With the third tunnel established, the first gateway 450 and the second gateway 451 may communicate in a private and/or trusted manner. Although FIG. 4 only shows two gateways, additional gateways (not shown) may also join the virtual private network 400 . Accordingly, the task of configuring gateways that are capable of participating in a virtual private network is significantly simplified.

[0130] A user desiring to configure the virtual private network 400 may simply register one or more gateways and administer the network through the control system 175 . The tasks performed by the user may thus be simplified to, for example, initially registering with the control system, rebooting one or more computers with software provided by the control system to configure the computers as gateways, and selecting one or more gateways from a list of desired partners. When two gateways consent to enabling a tunnel between the two gateways, the control system 175 may place each gateway on the partner list of the other gateway and provide the partner list to each gateway. Accordingly, the partner list may reflect the mutual desire of each gateway to enable a tunnel.

[0131] Moreover, the control system 175 may perform at least one or more of the following tasks, which are otherwise typically administered by the users enabling tunnels between gateways; coordinating one or more partner lists; administering the configuration of one or more virtual private networks established based on the enabled tunnels; monitoring the virtual private networks; controlling the virtual private networks; distributing to gateways information about changes in the configuration of the virtual private networks and/or other gateways; disseminating software for configuring gateways; providing an indication of a compromised private key; negotiating an encryption algorithm with gateways; negotiating an authentication technique with gateways; and recovering from a failure in the virtual private networks.

[0132] As previously discussed with reference to FIG. 3 , after a user desiring virtual private network services registers for secure services, the control system may assemble a disk image and provide the disk image to the user for loading onto a computer and configuring the computer as a gateway. The gateway may then participate in a virtual private network established over a base network, such as the Internet.

[0133] FIG. 5 illustrates an exemplary flow chart of the steps for establishing a virtual private network between the gateways identified by the user. Each of these steps will be discussed in further detail following the broad description of FIG. 5 .

[0134] Referring to FIGS. 4 and 5 , the first gateway 450 may start with the disk image installed (step 510 ). The first gateway 450 may establish a connection to the control system 175 (step 520 ) and proceed to establish a first tunnel 425 to the control system 175 (step 530 ) through a communication channel, such as the communication channel 120 of FIG. 1 . The second gateway 451 may also perform the steps 510 - 530 to establish a second tunnel 426 to the control system 175 . Once the first and second tunnels are established, the control system 175 may exchange information with each gateway to further configure the gateways.

[0135] To enable a third tunnel 423 between the first gateway 450 and the second gateway 451 (step 540 ), the control system 175 may determine whether the first gateway 450 and the second gateway 451 have consented to enabling the third tunnel 423 . This consent may be mutual and independent of the decision of the other gateways (not shown). For example, the control system 175 may determine the consent based on a list that includes desired partners for each of the gateways 450 , 451 . If the first gateway 450 and the second gateway 451 each consent to enabling of the third tunnel 423 , the control system 175 may then enable the third tunnel 423 (step 540 ).

[0136] For example, to enable the third tunnel (step 540 ), the control system 175 may perform one or more of the following: update the partner lists of the first gateway 450 and the second gateway 451 to reflect mutual consent; provide an indication that a tunnel between the first and second gateways 450 , 451 is authorized; provide real IP addresses for each of the gateways to permit a connection through a base network, such as the Internet; provide the virtual IP address of each gateway to the other gateway to enable a tunnel between the gateways; facilitate the establishment of one or more tunnels by providing out-of-band signaling to the first gateway 450 and the second gateway 451 through the first tunnel 425 and the second tunnel 426 , respectively; determine one or more partner lists for one or more gateways 450 , 451 ; provide configuration information for the network and/or for each gateway; exchange control information with the first gateway 450 and the second gateway 451 on the first tunnel 425 and the second tunnel 426 , respectively; negotiate an encryption algorithm with each gateway; and negotiate an authentication technique. Moreover, the control system 175 may also monitor the status and performance of the tunnels established through the communication channel 120 (step 550 ).

[0137] FIG. 6A shows a third exemplary network 600 in accordance with an embodiment of the present invention. The network 600 may include one or more local area networks (LANs) 660 , 661 , a first, second, and third gateways 650 - 652 , the Internet 620 and/or Intranet access (not shown), and a network operations center 610 .

[0138] The LANs 660 , 661 may be similar to the LANs 160 , 161 of FIG. 1 . The Internet 620 and/or Intranet access may include features similar to the communication channel 120 of FIG. 1 . Moreover, the gateways 650 - 652 may each include information and program code for implementing one or more virtual private networks over the Internet 620 . Furthermore, the first and second gateways 650 , 651 may interface the LAN 660 , 661 and the network 600 whereas the third gateway 652 may be configured as a stand-alone node interfacing only the network 600 .

[0139] In the embodiment of FIG. 6 A, the network operations center 610 may determine a virtual address for each gateway desiring to participate in one or more virtual private networks established through a base network, such as the Internet 620 . Consequently, each gateway may be provided two addresses—a real or public address and a virtual address. The virtual address, which may be in an IP format, may be used by the gateways to establish one or more tunnels with each other through a base network, such as the Internet 620 and may be routable only through the established tunnels. This virtualized addressing may provide virtual connectivity through the Internet 620 and may allow routing of virtual addresses from one address to another. Moreover, this virtualized addressing may facilitate network address translation, port address translation, IP masquerade, and/or IP connection sharing during the process of routing as well as during the dynamic assignment of addresses. Although a virtual address may be used by a gateway to establish one or more tunnels to form a virtual network and/or virtual private network, the network operations center 610 may alternatively provide to each gateway any other address that is capable of enabling any other networks established through or over a base network, such as the Internet 620 .

[0140] Based on the virtual addresses determined by the network operations center 610 and provided to the gateways 650 , 651 , 652 , one or more virtual private networks may be established over the Internet 620 . For example, each gateway 650 , 651 , 652 may include a virtual device adapter (not shown), which may be capable of emulating the functions of a network interface card (NIC). Using the virtual device adapter, each gateway may route or forward information, such as packets through tunnels established with other gateways.

[0141] FIG. 6B shows the network 600 of FIG. 6A from the perspective of virtual addresses and real or public addresses that are used by gateways 650 - 652 to route information, such as packets through tunnels established through the Internet 620 , in accordance with an embodiment of the present invention. The gateways 650 - 652 may be assigned real IP addresses 601 , 602 , 603 and virtual IP addresses 604 , 605 , 606 , respectively. Each real IP address, which may be assigned by, for example, an Internet Service Provider (ISP), may be routable through a base network, such as the Internet 620 . On other hand, each virtual address, which may be assigned and provided by the network operations center 610 , may be only routable through the tunnels enabled by the network operations center 610 and established through the Internet 620 .

[0142] The solid lines connecting the gateways 650 - 652 represent the real IP connectivity between the machines. The real IP addresses 601 - 603 used by gateways 650 - 652 , respectively, may interface the Internet 620 or a local area network, such as LAN's 660 and 661 . The dashed lines represent virtual connectivity provided by the virtual IP addresses 604 - 606 . Each gateway may include at least one virtual device adapter with a corresponding virtual IP address. For example, a virtual device adapter (not shown)