Secure multipoint internet protocol virtual private networks

• US 20060198368A1
• Filed: 03/04/2005
• Published: 09/07/2006
• Est. Priority Date: 03/04/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Guichard, James N., Wainner, W. Scott, Weis, Brian E., Mullooly, John J.
• Granted Patent: US 7,724,732 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method, apparatus and computer program product for providing secure multipoint Internet Protocol Virtual Private Networks (IPVPNs) is presented. A packet lookup is performed in order to determine a next hop. A VPN label is pushed on the packet, as is an IP tunnel header. Group encryption through the use of DGVPN is further utilized. In such a manner secure connectivity and network partitioning are provided in a single solution.

Claims

1. A method of providing secure multipoint Internet Protocol Virtual Private Networks (IPVPNs), the method comprising:

performing a packet lookup to determine a next hop;

pushing a VPN label on said packet; and

pushing an IP tunnel header on said packet.

2. The method of claim 1 further comprising encrypting and forwarding said packet.

3. The method of claim 1 wherein said providing comprises building a point-to-point IPSec between a source CE router and a destination CE router for unicast traffic.

4. The method of claim 1 wherein said providing comprises building a security group for multicast and Unicast traffic.

5. The method of claim 4 wherein said providing comprises building a security group using DGVPN for multicast and Unicast traffic.

6. The method of claim 1 wherein said IP tunneling is provided by encapsulating MPLS VPN packets with an L2TPv3 or GRE IP header.

7. A computer readable medium having computer readable code thereon for providing secure multipoint Internet Protocol Virtual Private Networks (IPVPNs), the medium comprising:

instructions for performing a packet lookup to determine a next hop;

instructions for pushing an VPN label on said packet; and

instructions for pushing an IP tunnel header on said packet.

8. The computer readable medium of claim 7 further comprising instructions for encrypting and forwarding said packet.

9. The computer readable medium of claim 7 wherein said instructions for providing comprises instructions for building a point-to-point IPSec between a source CE router and a destination CE router for unicast traffic.

10. The computer readable medium of claim 7 wherein said instructions for providing comprises instructions for building a security group using multicast and Unicast traffic.

11. The computer readable medium of claim 10 wherein said instructions for providing comprises instructions for building a security group using DGVPN for multicast and Unicast traffic

12. The computer readable medium of claim 7 wherein said instructions for providing of at least one IP tunnel instance comprises instructions for encapsulating MPLS VPN packets with an L2TPv3 and GRE IP header.

13. A computer system comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface; and

wherein the memory is encoded with an application for providing secure multipoint Internet Protocol Virtual Private Networks (IPVPNs), that when performed on the processor, provides a process for processing information, the process causing the computer system to perform the operations of;

performing a packet lookup to determine a next hop;

pushing an VPN label on said packet; and

pushing an IP tunnel header on said packet.

14. The computer system of claim 13 wherein the process further causes the computer system to perform the operations of encrypting and forwarding said packet.

15. The computer system of claim 13 wherein said providing comprises building a point-to-point IPSec between a source CE router and a destination CE router for unicast traffic.

16. The computer system of claim 13 wherein said providing comprises building a security group for multicast and unicast traffic.

17. The computer system of claim 16 wherein said providing comprises building a security group using DGVPN for multicast and unicast traffic.

18. The computer system of claim 13 wherein said provision of at least one IP tunnel instance is provided by encapsulating MPLS VPN packets with an L2TPv3 header.

20. The system of claim 16 further comprising means for encrypting and forwarding said packet.

19. A system for providing secure multipoint Internet Protocol Virtual Private Networks (IPVPNs), the system comprising:

means for performing a packet lookup to determine a next hop;

means for pushing an VPN label on said packet; and

means for pushing an IP tunnel header on said packet.