Multi-Wrapped Virtual Private Network

Abstract

The invention includes a system for transmitting multi-wrapped VPN enabled-data across a communication network from a device to another destination device within a remote protected network. The device comprises a software stack, hardware layer, application-layer VPN software, link-layer VPN software, and user-based application software. Next, the device is coupled to a communication network. Next, the system includes a link-layer VPN aggregator and an application-layer VPN aggregator. Finally, the system includes a protected network that includes the destination device. The invention includes embodiments for configuring a device to transmit multi-wrapped VPN enabled-data and processes for transmitting multi-wrapped VPN enabled-data across a communication network from a device to another destination device within a remote protected network. Finally, the invention includes inverse processes so the destination device can transmit data back through the communication network and to the device.

What is claimed: 
     
         1 . A first device enabled to transmit a data set across a communication network comprising:
 a user-based application operating on the first device, wherein the user-based application produces the data set;   an application-layer VPN application operating on the first device, wherein the application-layer VPN application takes the data set and encrypts the data set producing a single-encrypted data set;   a link-layer VPN application, wherein the link-layer VPN application takes the single-encrypted data set and encrypts the single-encrypted data set to produce a twice-encrypted data set; and   a local network interface that is enabled to send the twice-encrypted data set across the communication network.   
     
     
         2 . The first device of  claim 1  wherein a capture network filter hook within an OS layer of a software stack of the first device detects the transmission of the data set from the user-based application and diverts the data set to the link-layer VPN application. 
     
     
         3 . The first device of  claim 1  wherein a transmit network filter hook captures the twice-encrypted data set and transmits the twice-encrypted data set to the communication network via the local network interface. 
     
     
         4 . The first device of  claim 1  wherein the application-layer VPN application is associated with an application-layer VPN aggregator device. 
     
     
         5 . The first device of  claim 1  wherein the link-layer VPN application is associated with a link-layer VPN aggregator device. 
     
     
         6 . The first device of  claim 1  wherein the first device comprises a smart phone, tablet PC, notebook PC, desktop PC, remote monitoring device, camera, sensor, or any device that transmits data across applications operating on the device. 
     
     
         7 . The first device of  claim 1  wherein the user-based application, the application-layer VPN application are installed within a user space of a software stack of the first device that does not require a root access to operate including installing, uninstalling, updating, and configuring. 
     
     
         8 . The first device of  claim 1  wherein the application-layer application is enabled to encrypt a data set leaving a memory space of the first device dedicated to the user-space application. 
     
     
         9 . The first device of  claim 1  wherein the link-layer VPN application is enabled to capture and encrypt all data leaving the device. 
     
     
         10 . The first device of  claim 1  wherein the user-based application comprises an internet browser, an email application, a word processing application, a gaming application, a data analysis application, a video conferencing application, and a software application that requires a data set to be transmitted across the communication network. 
     
     
         11 . The first device of  claim 1  wherein the communication network includes a public or a private network including an Internet, an intranet, a telecommunications system, and any network capable of transmitting a data set. 
     
     
         12 . A data aggregator system enabled to receive a twice-encrypted data set from a first device via a communication network and produce a data set comprising:
 a link-layer VPN aggregator device enabled to take the twice-encrypted data set and decrypt the twice-encrypted data set to produce a single-encrypted data set; and   an application-layer VPN aggregator device enabled to take the single-encrypted data set and decrypt the single-encrypted data set to produce the data set.   
     
     
         13 . The system of  claim 12  wherein the twice-encrypted data set comprises the data set first encrypted by an application-layer VPN application on a first device to produce the single-encrypted data set and the single-encrypted data set encrypted a second time by a link-layer VPN application on the first device to produce the twice-encrypted data set. 
     
     
         14 . The system of  claim 13  wherein the data set is derived from a user-based application operating on the first device. 
     
     
         15 . A method for receiving a multi-encrypted data set from a first device and producing a decrypted data set comprising:
 a link-layer VPN aggregator device receiving a multi-encrypted data set from the first device;   the link-layer VPN aggregator device decrypting the multi-encrypted data set to produce a multi-encrypted data set with one-less-level of encryption;   a set of additional link-layer VPN aggregator devices further decrypting the multi-encrypted data set with one-less-level of encryption until a single-encrypted data set is produced; and   an application-layer VPN aggregator device decrypting the single-encrypted data set to produce the decrypted data set.   
     
     
         16 . The method of  claim 15  wherein the multi-encrypted data set comprises the data set first encrypted by an application-layer VPN application on the first device to produce the single-encrypted data set and the single-encrypted data set encrypted a multiple number of times by a set of multiple link-layer VPN applications on the first device to produce the multi-encrypted data set. 
     
     
         17 . The method of  claim 15  wherein the data set is derived from a user-based application operating on the first device.