Methods and systems for an extranet

• US 20020029276A1
• Filed: 04/11/2001
• Published: 03/07/2002
• Est. Priority Date: 04/12/2000
• Status: Active Grant

• Current Assignee: Oracle Systems Corporation (Oracle Corporation)
• Original Assignee: Corente, Inc. (Oracle Corporation)
• Inventors: Bendinelli, Samuel, Macey, Chistopher, Herrick, Michael, Keane, John
• Granted Patent: US 6,631,416 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

Methods and systems are provided for enabling a network between a first and a second processor using at least one additional processor separate from the first and second processors. In one embodiment, the first processor and the second processor may each be independently administered through the additional processor. Further, the additional processor may receive information indicating a consent on behalf of the first processor to enabling a tunnel between the first processor and the second processor and receives information indicating a consent on behalf of the second processor to enabling a tunnel between the second processor and the first processor. The additional processor may determine a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through the network. The additional processor may provide to each of the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors.

Claims

1. A method for enabling a network between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, the first processor and the second processor each identifiable by a name and each independently administered through the at least one additional processor, the method comprising the steps of:

receiving, at the at least one additional processor, information indicating a consent on behalf of the first processor for enabling a tunnel to the second processor;

receiving, at the at least one additional processor, information indicating a consent on behalf of the second processor for enabling a tunnel to the first processor;

determining a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through a base network; and

sending to the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors.

2. The method of claim 1, wherein the first processor and the second processor are administered by different organizations.

3. The method of claim 1, further comprising the steps of

providing for one or more processors separate from the at least one additional processor a set of one or more names that includes the name of the first processor;

receiving, at the at least one additional processor, information indicating on behalf of the first processor a selection of one or more of the names in the set of names that includes the name of the first processor; and

providing for one or more processors separate from the at least one additional processor a set of one or more names that includes the name of the first processor;

wherein the indication of consent on behalf of the second processor includes a selection on behalf of the second processor of the name of the first processor.

4. The method of claim 1, further comprising the step of:

establishing, by the first processor, one or more tunnels through the base network to the second processor using the first and second virtual addresses.

5. The method of claim 4, wherein in the step of establishing by the first processor one or more tunnels to the second processor, the tunnel is established through an Internet.

6. The method of claim 1, further comprising the steps of:

determining if the selection on behalf of the first processor is authorized.

7. The method of claim 1, wherein each of the names includes a two-level naming hierarchy, and wherein at least one level of the two-level naming hierarchy is used for identifying an organization.

8. The method of claim 1, further comprising the steps of:

enabling a tunnel between the first processor and the at least one additional processor; and

enabling a tunnel between the second processor and the at least one additional processor;

wherein in the step of receiving, at the at least one additional processor, information indicating on behalf of the first processor a selection, the indication is received through the tunnel between the first processor and the at least one additional processor; and

wherein in the step of receiving, at the at least one additional processor, information indicating on behalf of the second processor a selection, the indication is received through the tunnel between the second processor and the at least one additional processor.

9. A method for enabling a network between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, the first processor interfacing a first network using a first address space and the second processor interfacing a second network using a second address space, the method comprising the steps of:

receiving, at the at least one additional processor, information indicating a consent on behalf of the first processor for enabling a tunnel to the second processor;

receiving, at the at least one additional processor, information indicating a consent on behalf of the second processor for enabling a tunnel to the first processor;

determining a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through a base network;

providing to the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors;

identifying, by the first processor, a conflict between the first address space and the second address space; and

resolving, by the first and second processors, the conflict between the first address space and the second address space.

10. The method of claim 9, further comprising the steps of:

establishing, by the first processor, one or more tunnels through the base network to the second processor using the first and second virtual addresses.

11. The method of claim 10, wherein in the step of establishing by the first processor one or more tunnels to the second processor, the tunnel is established through an Internet.

12. The method of claim 9, wherein the step of resolving, by the first and second processors, the conflict between the first address space and the second address space, comprises the steps of:

determining, by the first processor, a first intermediate address space;

providing, by the first processor, the first intermediate address space to the second processor;

determining, by the second processor, if the first intermediate address space is acceptable;

providing, by the second processor to the first processor, an indication as to whether the first address space is acceptable.

14. The system of claim 13, wherein the first processor and the second processor are administered by different organizations.

13. A system for enabling a network between a first processor and a second processor each identifiable by a name and each independently administered through the system, the method comprising the steps of:

means for receiving information indicating a consent on behalf of the first processor to enable a tunnel to the second processor;

means for receiving information indicating a consent on behalf of the second processor to enable a tunnel to the first processor;

means for determining a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through a base network, and

means for sending to the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors.

15. A system for enabling a network between a first processor and a second processor, the first processor interfacing a first network using a first address space and the second processor interfacing a second network using a second address space, the system comprising:

means for receiving information indicating a consent on behalf of the first processor to enable a tunnel to the second processor;

means for receiving information indicating a consent on behalf of the second processor to enable a tunnel to the first processor;

means for determining a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through the network;

means for providing to the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors;

means for providing information to the first processor, such that the first processor is capable of identifying a conflict between the first address space and the second address space, and is capable of resolving with the second processor the conflict between the first address space and the second address space.

16. A system for enabling a network between a first processor and a second processor, wherein the first and second processors are separate from said system, are each identifiable by a name, and are each independently administered through the system, said system:

a tunneling interface that receives information indicating a consent on behalf of the first processor for enabling a tunnel between the first processor and the second processor, and receives information indicating a consent on behalf of the second processor for enabling a tunnel between the second processor and the first processor; and

a controller that determines a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through a base network, and that provides to each of the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors.

17. A system for enabling a network between a first processor and a second processor, wherein the first and second processors are separate from said system, the first processor interfacing a first network using a first address space and the second processor interfacing a second network using a second address space, said system:

a tunneling interface that receives information indicating a consent on behalf of the first processor for enabling a tunnel between the first processor and the second processor, and receives information indicating a consent on behalf of the second processor for enabling a tunnel between the second processor and the first processor; and

a controller that determines a first virtual address for the first processor and a second virtual address for the second processor such that the first and second virtual addresses uniquely identify the first and second processors, respectively, and are routable through a base network, that provides to each of the first and second processors the first and second virtual addresses to enable one or more tunnels between the first and the second processors, and that provides information to the first processor, such that the first processor is capable of identifying a conflict between the first address space and the second address space and resolving with the second processor the conflict between the first address space and the second address space.