Hybrid network

• US 20040090972A1
• Filed: 09/25/2003
• Published: 05/13/2004
• Est. Priority Date: 04/12/2001
• Status: Abandoned Application

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Sager, John C, Armes, David J, Massicott, Jennifer F, Regnault, John C, Barrett, Mark A
• Application Number:
  US10/472,885
• Publication Number:
  US 20040090972A1
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

The 802.11b wireless LAN specification is compromised by the weaknesses of WEP. The invnetion routes wireless transmissions to the LAN via a firewall or VPN gateway and encrypts them.

Claims

1. A communications network arranged for segregation of network traffic generated by users having different security classes but carried over the same physical infrastructure, the network comprising;

connection means for a plurality of constituent virtual networks sharing a physical infrastructure, arranged such that, in use each constituent virtual network may be connected to one or more terminals carrying network traffic having a respective security class;

encryption means for encrypting traffic on the first virtual network supporting the low-security users,

a gateway connecting the constituent virtual networks to each other, the gateway having means for identifying network traffic passing from a first virtual network associated with a lower security class to a second virtual network associated with a higher security class, and access means for allowing only such network traffic from the first virtual network that is correctly so encrypted to be carried over the second virtual network supporting the high-security users.

2. A communications network according to claim 1, wherein the first virtual network is a wireless network

3. A communications network according to claim 1 in which network traffic having the lower security class is encrypted using the Internet Security Protocol.

4. A communications network according to any preceding claim in which the gateway includes a firewall system.

5. A communications network according to any preceding claim, in which calls routed from the first virtual network to destinations other than those in the second virtual network are not routed through the second virtual network.

6. A method of handling data traffic between terminals of a common physical interface, wherein the terminals are allocated to a plurality of different security classes, and wherein traffic from terminals allocated to a lower security class is encrypted when carried to terminals allocated to a higher security class

7. A method according to claim 6 in which the gateway includes a firewall system, the firewall allowing traffic from the low-security terminals to reach the high-security terminals only when so encrypted.

10. A method according to claim 6, 7, 8 or 9, wherein the lower security terminals are wireless terminals.

8. A method for the segregation of network terminals having different security levels using the same physical network infrastructure, low-security users and higher-security terminals being connected to different virtual networks carried on the same physical network, a gateway with firewall capabilities being provided for access between the virtual networks, traffic on the virtual network supporting the low-security terminals being encrypted.

9. A method according to claim 8, in which calls from the virtual network supporting the low-security terminals, routed to destinations other than those in the virtual network supporting the high-security terminals, are not routed through the virtual network supporting the high-security terminals.