Abstract:
A method and system for dual channel network connections where one channel can be used for normal data transmission and the second channel can be used for administration tasks such as correcting error on the data channel or running diagnostics. A first data processing system and a second data processing system communicate on a physical network by transmitting data packets on the network using a virtual private network (VPN). Data packets are transmitted through a first VPN channel. Administrative packets are transmitted through a second VPN channel independently of the first VPN channel. The data packets may be transmitted using Internet Protocol (IP), and a portion of the network may include the Internet. The data VPN channel and the administrative VPN channel share a single network interface card, hence only a single network interface card (NIC) is required for each data processing system.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     The present invention is related to the following applications entitled “METHOD AND SYSTEM FOR ALGORITHM-BASED ADDRESS-EVADING NETWORK SNOOP AVOIDER”, U.S. application Ser. No. 09/383,740; “INTERNET SNOOP AVOIDER”, U.S. application Ser. No. 09/428,400, U.S. Pat. No. 6,473,863, now entitled “AUTOMATIC VIRTUAL PRIVATE NETWORK INTERNET SNOOP AVOIDER”; and “PRE-NEGOTIATED EVASION PATH INTERNET SNOOP AVOIDER”, U.S. application Ser. No. 09/428,401, now entitled “MANUAL VIRTUAL PRIVATE NETWORK INTERNET SNOOP AVOIDER”. 
    
    
     BACKGROUND OF THE INVENTION 
     1. Technical Field 
     The present invention relates to an improved data processing system and, in particular, to a method and system for reliable communication on a computer network. 
     2. Description of Related Art 
     As electronic commerce becomes more prevalent, business relationships between vendors and between a vendor and its customers become more valuable. Businesses are more willing to protect those relationships by spending more money on information technology that protects the integrity and reliability of their electronic commerce connections. In so doing, businesses protect not only their data and cash flow but also intangibles, such as reputations and good will. In addition, the complexity of information technology, the pressure of global competition, and the demands of universal access around-the-clock availability of electronic systems greatly increases the need to minimize disruptions in electronic commerce operations. The growing complexity of distributed data processing systems faces increasing reliability demands. Corporations are using new methods of communicating to meet expanding and disparate needs. Traveling employees require access to company databases. Some companies employ extranets, and other companies may require constant communication paths with strategic partners. All of these factors contribute to a corporation&#39;s growing reliance and vulnerability to complex communication infrastructures. 
     A corporation&#39;s information technology infrastructure may fail at various pressure points, such as telecommunication links, servers, networks, etc. Although hardware reliability may be a major concern, cost may also be a concern, and corporations have attempted to contain costs by using the open, distributed infrastructure of the Internet to transmit data between corporate sites. Dedicated leased lines may be prohibitively expensive for some companies, and other companies may require more flexibility than is provided by owning a complete communication channel. However, this openness also introduces another major concern to corporations: vulnerability. Corporations must protect against both physical vulnerability, such as hardware failures, and logical vulnerability, such as network failures. 
     Virtual private networks (VPNs) using the Internet enterprise-wide, communication-related problems. VPNs allow corporate administrators to connect remote branch offices to a main corporate network economically and relatively securely. Rather than depend on dedicated leased lines, an Internet-based VPN uses the open infrastructure of the Internet. 
     Computer systems within one business site are typically connected using a Local Area Network (LAN) and a Network Administrator is responsible for keeping the network up and running properly. To the user, a VPN has the same appearance as a LAN and requires a network administration just like a LAN. However network administration is much more difficult in a VPN because some machines are local and other machines are remote, perhaps even thousands of miles away. Many remote sites may be in small offices or may be mobile; in both cases, no network administrator is present at the remote site to solve problems. 
     In the past, problems have been handled by installing a second network card in every machine on the VPN. One of the cards in each machine is used to set up the data channels for the users and the second card provides a communications channel for the network administrator. Even if there is a problem on the data channels, the network administrator can access the machine on the administrative channel and work on solving the problem. This redundancy solution is usually successful since a vast majority of networking problems are due to software issues and not due to hardware failures. This solution has one major disadvantage: the need for a second network card. This is not only expensive but it uses up a card slot in the machine that may be needed for some other purpose. 
     Therefore, it would be advantageous to have a method and a system for more reliable network communication, and in particular, to provide a reliable network link using secure VPN channels. 
     SUMMARY OF THE INVENTION 
     A method and system for dual channel network connections where one channel can be used for normal data transmission and the second channel can be used for administration tasks such as correcting error on the data channel or running diagnostics. A first data processing system and a second data processing system communicate on a physical network by transmitting data packets on the network using a virtual private network (VPN). Data packets are transmitted through a first VPN channel. Administrative packets are transmitted through a second VPN channel independently of the first VPN channel. The data packets may be transmitted using Internet Protocol (IP), and a portion of the network may include the Internet. The data VPN channel and the administrative VPN channel share a single network interface card, hence only a single network interface card (NIC) is required for each data processing system. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein: 
     FIG. 1 is a pictorial representation of the user perspective of a Virtual Private Network (VPN) in which the present invention may be implemented; 
     FIG. 2 depicts a physical organization of a VPN that may be configured with a mixture of equipment at several remote sites; 
     FIG. 3 is a block diagram of an individual data processing system in which the present invention may be implemented; 
     FIG. 4 illustrates a set of dual data and administration channels between three machines on a VPN; 
     FIG. 5 is a flow diagram showing the setup and use of an administration channel; 
     FIG. 6 depicts the detailed steps of the setup process in flow diagram form; and 
     FIGS. 7A-7B give a specific implementation of the setup process for two machines, one local and one remote, in the form of a korn-shell script. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
     With reference now to the figures, and in particular with reference to FIG. 1, a pictorial representation of a user&#39;s view of a VPN is depicted in which the present invention may be implemented. To the user, the network appears to function like LAN  100  that has server  102  and several users:  104 ,  106 ,  108 ,  110 ,  112 ,  114 ,  116 , and  118 . 
     With reference now to FIG. 2, a diagram depicts a physical organization of a VPN. Internet  200  connects three LANs in San Francisco  202 , Chicago  204 , and New York  206 . The LANs are connected to the Internet through IP Security Gateways  208 ,  210 , and  212 , respectively. An IP Security Gateway insures that unauthorized traffic outside the local network cannot come inside the network. An IP security gateway typically provides two types of services: external and internal. The external services might include reception of incoming email or providing directory services (DNS—Domain Naming System) for public services. The internal services are more extensive and only available for those inside the IP security gateway. These might include services for retrieving mail or finding confidential file servers. The network administrator is responsible for providing rules that define which network packets are allowed through the IP security gateway and under what conditions this occurs. 
     Encryptors  214 ,  216  and  218  are part of IP Security Gateways  208 ,  210  and  212 , respectively, that connect the LANs to the Internet. If Charlott needs to access the server in Chicago, her packets go through encryptor  214  contained in IP Gateway  208  and then out to Internet  200 . The packets are routed to IP Gateway  210  and encryptor  216 . Encryptor  216  determines that Charlott does have proper access to LAN  204  and records the encryption technique being used for sending replies. The interception of the packet over the Internet by an adversary would cause little or no problem since the packet is encrypted at that time. Sensitive information that allows access to systems can be exchanged back and forth using encryption. 
     With reference now to FIG. 3, a block diagram of a data processing system in which the present invention may be implemented is illustrated. Data processing system  300  is an example of a networked computer. Data processing system  300  employs a peripheral component interconnect (PCI) local bus architecture. Although the depicted example employs a PCI bus, other bus architectures, such as Micro Channel and ISA, may be used. Processor  302  and main memory  304  are connected to PCI local bus  306  through PCI bridge  308 . PCI bridge  308  may also include an integrated memory controller and cache memory for processor  302 . Additional connections to PCI local bus  306  may be made through direct component interconnection or through add-in boards. In the depicted example, local area network (LAN) adapter  310 , SCSI host bus adapter  312 , and expansion bus interface  314  are connected to PCI local bus  306  by direct component connection. The LAN Adapter  310  is sometimes called a Network Interface Card (NIC), and it is possible to have multiple NICs on a single system. The audio adapter  316 , graphics adapter  318 , and audio/video adapter (A/V)  319  are connected to PCI local bus  306  by add-in boards inserted into expansion slots. Expansion bus interface  314  provides a connection for a keyboard and mouse adapter  320 , modem  322 , and additional memory  324 . In the depicted example, SCSI host bus adapter  312  provides a connection for hard disk drive  326 , tape drive  328 , CD-ROM drive  330 , and digital video disc read only memory drive (DVD-ROM)  332 . Typical PCI local bus implementations will support three or four PCI expansion slots or add-in connectors. 
     An operating system runs on processor  302  and is used to coordinate and provide control of various components within data processing system  300  in FIG.  3 . The operating system may be a commercially available operating system, such as AIX (Advanced Interactive Executive), which is available from International Business Machines Corporation. “AIX” is a trademark of International Business Machines Corporation. System-level software, such as korn-shell scripts, may run in conjunction with the operating system, providing calls to the operating system on data processing system  300 . Instructions for the operating system, the korn-shell scripts, and applications or programs are located on a storage device, such as hard disk drive  326 , and may be loaded into main memory  304  for execution by processor  302 . 
     Those of ordinary skill in the art will appreciate that the hardware in FIG. 3 may vary depending on the implementation. For example, other peripheral devices, such as optical disk drives and the like, may be used in addition to or in place of the hardware depicted in FIG.  3 . The depicted example is not meant to imply architectural limitations with respect to the present invention. For example, the processes of the present invention may be applied to multiprocessor data processing systems. 
     With reference now to FIG. 4, a block diagram depicts a data processing network that implements VPN administration channels in accordance with the present invention. The local system, called System A  400 , contains a single Network Interface Card (NIC)  402 . This card is set up with two IP addresses: main address  404  set as 8.8.8.100 and IP alias  406  set as 8.8.8.8. System B  408  is a remote system with a single NIC  410 . It also has two IP addresses: main address  412  set as 9.9.9.100 and IP alias  414  set as 9.9.9.9. There is a Virtual Private Network (VPN) using the Internet  499  as a carrier between System A  400  and System B  408 . Data VPN Channel  416  has been established between main IP address  404  on System A and main IP address  412  on System B. A second VPN channel between System A and System B, Admin VPN Channel  418 , has been established for administrative tasks between IP alias  406  on System A and IP alias  414  on System B. It is important to note that only a single NIC is needed on each machine to set up this secondary channel. 
     FIG. 4 also depicts how other machines can be added to the network. System C  420  at a remote location also contains a single NIC  422 . It has main IP address  424  set as 7.7.7.100 and IP alias  426  set as 7.7.7.7. Data VPN Channel  428  is established between IP address  404  on System A and IP address  424  on System C. Administrative VPN Channel  430  is established between IP alias  406  on System A and IP alias  426  on System C. In a similar manner, a Data VPN Channel  432  and Administrative VPN Channel  434  are set up from System B and System C on IP addresses  412  and  424  and IP aliases  414  and  426 , respectively. Hence, the Data VPN Channels in this network are comprised of channels  416 ,  428  and  432 , and the Administration VPN channels are comprised of channels  418 ,  430  and  434 . 
     With reference now to FIG. 5, a flowchart that shows the use of Administrative Channels and illustrates the utility of the present invention. The Data and Administrative Channels have to be set up (step  500 ), which is explained in more detail in FIG.  6 . Normal use of the VPN uses the Data VPN Channels (step  502 ). However, several problems may arise that require attention of the network administrator. If there are data channel errors (step  504 ), then the network administrator would use the Administrative VPN Channel to access the problematic machine in order to correct the problem (step  512 ). Examples of data channel errors might be an incorrect refresh of secret keys on the data channel causing it to be disabled or an incorrect activation time where a data channel may shut down prematurely. If there is a need to transfer out-of-band data (step  506 ), this can be done using the Administrative VPN Channel (step  512 ). As an example of out-of-band data consider System A, System B, and System C in FIG.  4 . Suppose data and administrative channels have been established between System A and System B and also between System A and System C. Further, suppose that data and administrative channels have not yet been established between System B and System C. Establishing such a channel requires knowledge of the number of channels, secret keys, encryption standard, etc. This out-of-band data could be safely sent from System A to System B and also from System A to System C. Then Systems B and C would have enough information to establish direct Data and Administrative VPN channels. 
     If there is a denial-of-service attack (step  508 ), then the network administrator would use the Administrative VPN Channel to correct the problem (step  512 ). As an example of a denial-of-service attack, a common trick among hackers is to flood a particular target on the Internet with a series of trivial activities or incomplete packets just to tie the site up trying to respond to these activities. This may make the site virtually inaccessible, thus making corrective actions difficult. However, by using a separate Administrative VPN channel, the problem can be handled directly and the attack warded off. If there is a need to run diagnostics (step  510 ), the Administrative VPN Channel can be used for this purpose (step  512 ). These are only a few examples of the representative situations that may require use of the Administrative VPN Channels. If after correcting a problem it is desired to continue running the VPN Channels (step  514 ), then control transfers to normal use of the Data VPN Channels (step  502 ). Otherwise, the network administrator can end the process. 
     With reference now to FIG. 6, a flowchart shows the details of the process for setting up the Data and Administrative Channels, as implemented in the present invention. The data and administrative IP addresses need to be exported so that they will be visible elsewhere in the system (step  600 ). The initial definition (step  602 ) has two Phases referred to as Phase  1  and Phase  2 . During Phase  1 , a single channel is used between two sites to negotiate the initial setup, including number of channels, secret keys, encryption standard, etc. During Phase  2 , the data and administrative channels are setup. Next, an alias IP address needs to be added to the local NIC (step  604 ). The IP aliases are then set up at each remote site on its NIC (step  606 ). Since the Administrative VPN Channels will be unpublished, restrictions are made so the IP addresses will only be displayed at the network administrator node (step  608 ). The VPNs are then created (step  610 ), and the Data and Administrative Channels are activated (step  612 ). In summary, step  602  defines all the protocols that will be used in the VPN, steps  604  and  606  set up the local and remote IP addresses, step  608  is an optional step to prevent display of the hidden IP addresses except on the root node, and then the VPNs are created (step  610 ) and activated (step  612 ). 
     With reference now to FIG.  7 A and FIG. 7B, a korn-shell script shows the details of setting up the Data and Administrative VPN Channels for one particular implementation of the present invention. The commented sections of this script match the flowchart activities described in FIG.  6 . This script illustrates a simple VPN with only two machines, one local and one remote. The basic steps can be extended to set up more machines at remote sites. Some of the commands shown are specific to the AIX operating system but could be adapted to other operating systems. 
     The IP addresses, in this case two Data Channels addresses (one local and one remote) and two Administrative Channels addresses (one local and one remote), are exported so that they will be visible elsewhere in the system, as shown in statements  700 . During Phase  1  of defining the Channels, the number of channels is specified, the secret keys are negotiated, the encryption standard is set, and so forth. During Phase  2  one Data Channel and one Administrative Channel are defined (in this particular script). The actual DefineChannels function is shown in statement  702 . The ifconfig (interface configuration) command is used to add an alias for the local NIC, as shown in statement  704 . The same command has to be run on the remote machines; this is accomplished using the remote shell (rsh) command, as shown in statement  706 . 
     The UNIX command to change mode (chmod) is used to restrict the display of the IP addresses to the network administrator machine, as shown in statements  708 . The mode  0500  means only the owner has read and execute privileges. The same commands are run at the remote site using the rsh command, also shown in statements  708 . The restrictions shown here are to four particular subdirectories; the exact form of these commands is system dependent. This step is optional and is only included to illustrate implementing a “need to know” policy. 
     The VPNs are created by calling DefineChannels, as shown in statement  710 . This command is operating system specific, and systems other than AIX would use an equivalent command. The final step is the activation of the Data VPN Channel and the Administrative VPN Channel, as shown in statement  712 . The AIX command “ike” is shown; an equivalent command would be used with other operating systems. 
     Alternatively, Data and Administrative VPN Channels may be configured using methods other than the execution of a script. Various operating system commands may be entered through a command line interface, e.g., by a system or network administrator having the appropriate security or system privileges, to accomplish the configuring of the VPN. In addition, an application with a graphical user interface may be executed in which a network or system administrator enters the addresses for the VPN, and this application may dynamically configure the VPN or store the VPN information for a subsequent static configuring operation. 
     The advantages of the present invention should be clear from the detailed description provided above. If a machine on a VPN becomes inaccessible for any reason (such as a mis-configured security code or a denial of a service attack), it is still possible for the network administrator to remotely access the machine and correct the problem. Since a single NIC is used, no additional new hardware is required. This invention provides fault tolerance to existing systems and protects a VPN system from a single point of failure. The network administrator can control the degree of fault tolerance. For example, if more fault tolerance is desired, additional Administrative VPN Channels can be added with no additional hardware costs. By keeping the IP addresses hidden, this invention provides greater network security. The network administrator can monitor and run diagnostic programs as necessary in order the optimize the primary Data VPN Channels or take corrective actions when required. 
     It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media such a floppy disc, a hard disk drive, a RAM, and CD-ROMs and transmission-type media such as digital and analog communications links. 
     The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.