Patent ID: 8862883
Filing Date: 2014-10-14
Classification: H04L

Abstract:
1. A method, comprising: receiving a request for a cloud capability set during an Internet Key Exchange (IKE) negotiation associated with a virtual private network (VPN) tunnel between a subscriber and a cloud, wherein the cloud capability set comprises a plurality of cloud capabilities; selecting a cryptographic module from a plurality of cryptographic modules located in the cloud, wherein different cryptographic modules support different cloud capability sets, wherein the selected cryptographic module can support the requested cloud capability set; mapping the request to the selected cryptographic module that can support the cloud capability set; offloading the VPN tunnel to the selected cryptographic module for processing flows over the VPN tunnel according to the request; selecting another cryptographic module if the selected cryptographic module cannot support at least one of the cloud capabilities in the cloud capability set, wherein the selected cryptographic modules can collectively support the plurality of cloud capabilities in the cloud capability set; and splitting the VPN tunnel between the selected cryptographic modules.