Method and system for multi-domain virtual private network configuration

• US 20060018300A1
• Filed: 06/30/2005
• Published: 01/26/2006
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: NovaCloud Licensing LLC
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Westberg, Lars, Flinta, Christofer, Mangs, Jan-Erik
• Granted Patent: US 7,869,447 B2
• Time in Patent Office: Days
• US Class Current: 370/351
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Information about virtual private networks—VPNs—in each domain of a multi-domain communications system is provided. By comparing a request for a configuration of a VPN with the provided information of other connected domains, a match can be found. VPN configuration can then be performed based on the outcome of the match. The provided domain VPN information is in one embodiment spread to other domains under constrictions put by SLAs between domain operators. The spreading of VPN information can be performed regularly or triggered by an external event. In another embodiment, the VPN configuration request is instead spread to different domains.

Claims

1. Method for configuration of a multi-domain virtual private network—

VPN—

within a communications network, the communications network having at least two domains interconnected to each other, and whereby customers are connected to VPNs at edge nodes of the at least two domains, comprising the steps of;

initiating a connect request for connecting a first edge node in a first domain to a first VPN not presently available in the first domain;

providing domain VPN information within the at least two domains;

the domain VPN information comprising at least VPN identity of VPNs available in respective domain;

matching an identity of the first VPN with VPN identities of a second domain of the at least two domains different from the first domain; and

configuring the first VPN to comprise the first edge node based on the outcome of the matching step.

2. Method according to claim 1, wherein the step of matching in turn comprises the steps of:

sending an information request about existence of the first VPN from the first domain to an adjacent domain; and

comparing the information request with provided domain VPN information in a domain different from the first domain.

3. Method according to claim 1, wherein the step of matching in turn comprises the steps of:

sending an information request about existence of the first VPN from the first domain to one, several or all domains; and

comparing the information request with provided domain VPN information in a domain different from the first domain.

4. Method according to claim 2, wherein the step of matching in turn comprises the steps of:

returning an acknowledgement to the first domain if a match is found.

5. Method according to claim 2, wherein the step of matching further comprises the step of:

forwarding the information request about existence of the first VPN to further adjacent domain if no match is found.

6. Method according to claim 2, wherein the acknowledgement additionally comprises data representing at least one of:

domain ID of domain in which the first VPN is available;

edge node ID of edge node in which the first VPN is available;

information about which domains that has to be transited to reach the domain in which the first VPN is available; and

routing information to the edge node in which the first VPN is available.

7. Method according to claim 1, wherein the step of matching in turn comprises the steps of:

processing the domain VPN information into processed VPN information comprising at least one VPN identity;

transferring the processed VPN information between adjacent domains;

comparing the identity of the first VPN with the transferred processed VPN information.

8. Method according to claim 1, wherein the step of matching in turn comprises the steps of:

processing the domain VPN information into processed VPN information comprising at least one VPN identity;

transferring the processed VPN information to one, several or all domains;

comparing the identity of the first VPN with the transferred processed VPN information.

9. Method according to claim 7, wherein the step of matching comprises the further step of further processing the transferred processed VPN information before the comparing step.

10. Method according to claim 7, wherein the processed VPN information to be transferred to other domains additionally comprises processed VPN information received from adjacent domains.

11. Method according to claim 10, wherein the step of processing comprises addition of transit information regarding the processed VPN information transferred from other domains or information derived therefrom.

12. Method according to claim 7, wherein the processed VPN information additionally comprises at least one of:

domain ID of domains in which different VPNs are available;

edge node ID of edge nodes at which different VPNs are available;

information about which domains that has to be transited to reach the domain in which different VPNs are available; and

routing information to the edge node at which different VPNs are available.

13. Method according to claim 7, wherein the step of transferring of processed VPN information is performed on a regular basis.

14. Method according to claim 7, wherein the step of transferring of processed VPN information is performed as a response on changes of domain VPN information.

15. Method according to claim 7, wherein the step of transferring of processed VPN information is performed as a response of the connect request.

16. Method according to claim 1, wherein the domain VPN information further comprises customer identities of customers connected to the respective edge nodes and associated VPN.

17. Method according to claim 1, wherein the domain VPN information further comprises properties of the VPNs.

18. Method according to claim 17, wherein the properties of the VPNs comprise at least one of:

quality of service properties;

encryption properties;

transparency layer properties;

tunneling properties; and

topology properties.

19. Method according to claim 1, wherein the step of providing domain VPN information in turn comprises collecting of domain VPN data from edge nodes within the same domains.

20. Method according to claim 19, wherein the collecting of domain VPN data is performed in a centralized manner in at least one domain.

21. Method according to claim 19, wherein the collecting of domain VPN data is performed in a distributed manner in at least one domain.

22. Method according to claim 19, wherein the collecting of domain VPN data is performed by a push mechanism.

23. Method according to claim 19, wherein the collecting of domain VPN data is performed by a pull mechanism.

24. Communications network, comprising:

at least two network domains being interconnected by connections between border nodes;

means for operating virtual private networks—

VPNs—

within the communications network;

edge nodes connected by the VPNs, whereby customer sites of the VPNs are connected at the edge nodes;

means for initiating a connect request for connecting a first edge node in a first domain to a first VPN not presently available in the first domain;

VPN control nodes in each of the at least two network domains comprising means for providing domain VPN information;

the domain VPN information comprising at least VPN identity of VPNs available in the domain;

means for matching an identity of the first VPN with VPN identities of a second domain of the at least two domains different from the first domain; and

means for configuring the first VPN to comprise the first edge node based on the output of the means for matching.

25. Communications network according to claim 24, wherein the VPN control node is a centralized node in at least one domain.

26. Communications network according to claim 24, wherein the VPN control node is a distributed node in at least one domain.

27. Communications network according to claim 26, wherein at least a part of the distributed VPN control node is in logical connection with a border node, whereby communication between the distributed VPN control node and domains connected through the border node takes place via the border node.

28. Communications network according to claim 24, wherein the VPN control node comprises a storage for VPN information.

29. Communications network according to claim 24, wherein the means for matching is distributed in all domains, which distributed parts in turn comprise:

request handling means for sending and receiving information requests about existence of a particular VPN to and from an adjacent domain; and

means for comparing received information requests with provided domain VPN information of its own domain;

whereby the request handling means is further arranged for returning an acknowledgement if a match is found.

30. Communications network according to claim 24, wherein the means for matching is distributed in all domains, which distributed parts in turn comprise:

request handling means for sending and receiving information requests about existence of a particular VPN to and from one, several or all domains; and

means for comparing received information requests with provided domain VPN information of its own domain;

whereby the request handling means is further arranged for returning an acknowledgement if a match is found.

31. Communications network according to claim 29, wherein the request handling means is further arranged to forward an information request to further adjacent domains if no match is found.

32. Communications network according to claim 24, wherein the VPN control node further comprises:

first processor for processing the domain VPN information into processed VPN information, connected to the storage; and

means for transferring the processed VPN information to other domains, connected to the first processor.

33. Communications network according to claim 32, wherein the VPN control node further comprises:

means for receiving processed VPN information from other domains;

second processor for processing the received processed VPN information, connected to the means for receiving and the storage,

whereby the processed received VPN information can be stored in the storage.

34. Communications network according to claim 24, wherein the VPN control nodes in at least one network domain comprises means for collecting domain VPN information from edge nodes in the same domain.

35. VPN control node in a first domain of a communications network having at least two domains and supporting multi-domain virtual private networks—

VPNs, customers being connected to the VPNs at edge nodes of the at least two domains, the VPN control node comprising;

means for providing domain VPN information;

the domain VPN information comprising at least VPN identity of VPNs available within the first domain; and

means for matching an identity of a requested first VPN with the VPN identities.

36. VPN control node according to claim 35, further comprising a configuring machine for VPN connections within the first domain.

37. VPN control node according to claim 35, further comprising a configuring machine for inter-domain VPN connections involving the first domain.

38. VPN control node according to claim 35, wherein the control node is a centralized node.

39. VPN control node according to claim 38, further comprising means for communicating with VPN control nodes in other domains via border nodes.

40. VPN control node according to claim 38, further comprising means for communicating by dedicated VPN control signal connections with VPN control nodes in other domains.

41. VPN control node according to claim 35, wherein the control node is a distributed node.

42. VPN control node according to claim 41, wherein at least a part of the distributed control node is in logical connection with a border node, through which data communication to neighboring domains takes place.

43. VPN control node according to claim 35, wherein the control node comprises a storage for VPN information.

44. VPN control node according to claim 43, wherein the storage for VPN information is centralized.

45. VPN control node according to claim 43, wherein the storage for VPN information is distributed.

46. VPN control node according to claim 35, further comprising means for communicating domain VPN information to and from other domains.

47. VPN control node according to claim 35, further comprising means for receiving a VPN request, whereby the means for matching comprises means for sending an acknowledgement if a match is found.

48. VPN control node according to claim 47, further comprising means for forwarding a VPN request to other domains if no match is found by the means for matching.

49. VPN control node according to claim 35, further comprising means for collecting domain VPN information from edge nodes in the same domain.

50. VPN control node according to claim 49, wherein the means for collecting domain VPN information is arranged to operate according to a push mechanism.

51. VPN control node according to claim 49, wherein the means for collecting domain VPN information is arranged to operate according to a pull mechanism.