Abstract: The invention features receiving encrypted network packets sent over a network at a network interface computer, and passing the encrypted network packets to a computer on an internal network.The invention also features receiving encrypted network packets at a first computer over a network from a second computer, examining a field in each network packet to determine which of a plurality of encryption algorithms was used to encrypt the network packet, and decrypting the network packet in accordance with the determined encryption algorithm.The invention further features receiving network packets sent over a network, determining which virtual tunnel each network packet was sent over, and routing each network packet to a destination computer in accordance with the determined virtual tunnel.

Abstract: Passage of packets or messages is controlled between a device and a network via a virtual connection or flow which conforms to a predefined communication protocol. In connection with processing a packet or message that triggers a step in managing the virtual connection or flow, predefined authorization rules are applied to determine whether to permit the step to occur. In connection with processing a packet or message that does not trigger a step in managing the virtual connection or flow, the packet or message is permitted to pass directly via the virtual connection or flow, without applying the predefined authorization rules.

Abstract: The invention features a method for enabling computers to communicate using encrypted network packets. A configuration request is sent over a network from a first computer to a second computer, and tunnel record information is sent over the network from the second computer to the first computer. The tunnel record information is encrypted in accordance with a temporary configuration password.The invention also features a method for updating a tunnel record. A connection request is sent from a first computer to a second computer, and the first computer is authorized. A tunnel record corresponding to the connection request with the first computer's network address is then updated.