Patent ID: 7961722

Claim:
A method comprising: maintaining, with a network security device, a plurality of logically separated virtual systems having respective context information, wherein each of the virtual systems comprises a data structure for storing the context information for providing a corresponding virtual private network (VPN) to each subscriber network, wherein the context information for each of the virtual systems comprises session information and configuration parameters that include security policies and a secure socket layer (SSL) encryption key for the respective VPN; receiving, with the network security device, a network communication associated with a first one of the virtual systems from a first one of the subscriber networks; setting, in response to the network communication, a context identifier identifying the first one of the virtual systems; processing the network communication with a first one of a plurality of VPN software processes executing on the network security device, wherein each of the VPN software processes corresponds to a different one of the virtual systems of the network security device and provides the corresponding VPN to each subscriber network, and wherein the first one of the VPN software processes generates a data access request to include the context identifier in response to the network communication; dynamically directing the data access request from the first one of the plurality of VPN software processes to the first one of the virtual systems with a generic application programming interface (API) based on the context identifier included within the data access request to retrieve the SSL encryption key and the session information for the corresponding VPN; and applying VPN services with the first one of the plurality of VPN software processes to the network communication in accordance with the context information associated with the first one of the virtual systems to which the data access request is directed in order to provide VPN connectivity to the first one of the subscriber networks by at least encrypting or decrypting the network communication based on the retrieved SSL encryption key and session information and to enforce the security policies defined within the context information.