Towards a scalable and flexible architecture for Virtual Private Networks

Abstract

Virtual Private Networks (VPNs) are commonly used to provide secure connectivity over public networks. VPNs use tunnels to provide encryption, compression, and authentication functions, which are identically applied to every packet passing through them. However, this behavior may be overly rigid in many situations where the applications require different functions to be applied to different parts of their streams. Current VPNs are unable to offer such differential treatment, posing a heavy computational burden on edge routers, reducing their flexibility and degrading network performance. Additionally, the administrative cost of maintaining these tunnels is as high as O(N2) for an N node VPN. In this paper, we propose and evaluate a flexible VPN architecture (called Flexi-Tunes) where within a single VPN tunnel, different VPN functions are applied to different packet streams. Flexi-Tunes also replaces the traditional point-to-point tunnels with packet switched tunnels that improve scalability by reducing administrative costs to O(N). Simulation of this enhanced model demonstrates 170% improvement in bandwidth and 40 times improvement in end-to-end delay. © Springer-Verlag Berlin Heidelberg 2005.