Apparatus and method for traffic filtering in a communication system

• US 20070140237A1
• Filed: 12/20/2005
• Published: 06/21/2007
• Est. Priority Date: 12/20/2005
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Gustin, Jay, Scott, Shannon
• Granted Patent: US 7,688,818 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272

Abstract

A method includes receiving traffic through a first interface in a first group of interfaces at a switch. The first group of interfaces is associated with a first virtual network. The method also includes determining that the traffic is destined for a destination associated with a second virtual network and forwarding the traffic to a second interface in a second group of interfaces at the switch. The second group of interfaces is associated with the second virtual network. The method further includes filtering the traffic that is received at the second interface in the second group of interfaces and communicating the filtered traffic towards the destination. The first and second virtual networks could represent Virtual Local Area Networks associated with different network levels of a process control system.

Claims

1. A method, comprising:

receiving traffic through a first interface in a first group of interfaces at a switch, the first group of interfaces associated with a first virtual network;

determining that the traffic is destined for a destination associated with a second virtual network;

forwarding the traffic to a second interface in a second group of interfaces at the switch, the second group of interfaces associated with the second virtual network;

filtering the traffic that is received at the second interface in the second group of interfaces; and

communicating the filtered traffic towards the destination associated with the second virtual network.

2. The method of claim 1, wherein filtering the traffic comprises one or more of:

determining whether a traffic type associated with the traffic is acceptable; and

determining whether a port associated with the traffic is acceptable.

3. The method of claim 2, wherein:

Address Resolution Protocol (ARP) broadcast traffic, multicast test traffic, and Network Timing Protocol (NTP) traffic are acceptable; and

unicast traffic associated with a Transmission Control Protocol (TCP) port or a User Datagram Protocol (UDP) port that is within a specified range of ports is acceptable.

4. The method of claim 1, wherein forwarding the traffic from the first interface to the second interface comprises forwarding the traffic from the first interface to a third interface in the first group of interfaces, the third interface coupled to the second interface by a cable.

5. The method of claim 4, wherein the cable coupling the second and third interfaces comprises a crossover cable.

6. The method of claim 1, further comprising:

receiving second traffic through one of the interfaces in the first group of interfaces;

determining that the second traffic is destined for a second destination associated with the first virtual network; and

communicating the second traffic towards the second destination without forwarding the second traffic to the second group of interfaces.

7. The method of claim 1, wherein communicating the filtered traffic towards the destination comprises forwarding the filtered traffic to a fourth interface in the second group of interfaces.

8. The method of claim 1, wherein:

the first virtual network comprises a first Virtual Local Area Network associated with a Level 2 network level in a process control system; and

the second virtual network comprises a second Virtual Local Area Network associated with a Level 1 network level in the process control system.

9. The method of claim 8, wherein the Level 1 network level comprises one or more controllers capable of controlling one or more process elements in a processing facility.

10. An apparatus, comprising:

a plurality of interfaces comprising a first group of interfaces associated with a first virtual network and a second group of interfaces associated with a second virtual network;

a switch fabric capable of transporting traffic between the interfaces; and

a controller capable of;

determining that traffic received through a first interface in the first group of interfaces is destined for a destination associated with the second virtual network;

causing the switch fabric to forward the traffic to a second interface in the second group of interfaces;

filtering the traffic that is received at the second interface in the second group of interfaces; and

causing the switch fabric to forward the filtered traffic to a third interface in the second group of interfaces for communication of the filtered traffic towards the destination.

11. The apparatus of claim 10, wherein the controller is capable of filtering the traffic by one or more of:

determining whether a traffic type associated with the traffic is acceptable; and

determining whether a port associated with the traffic is acceptable.

12. The apparatus of claim 10, wherein the controller is capable of causing the switch fabric to forward the traffic from the first interface to the second interface by causing the switch fabric to forward the traffic from the first interface to a fourth interface in the first group of interfaces, the fourth interface coupled to the second interface by a cable.

13. The apparatus of claim 12, wherein the cable coupling the second and fourth interfaces comprises a crossover cable.

14. The apparatus of claim 10, wherein the controller is further capable of:

determining that second traffic received through one of the interfaces in the first group of interfaces is destined for a second destination associated with the first virtual network; and

causing the switch fabric to communicate the second traffic towards the second destination without causing the switch fabric to forward the second traffic to the second group of interfaces.

15. The apparatus of claim 10, wherein:

the first virtual network comprises a first Virtual Local Area Network associated with a Level 2 network level in a process control system; and

the second virtual network comprises a second Virtual Local Area Network associated with a Level 1 network level in the process control system.

16. The apparatus of claim 15, wherein the Level 1 network level comprises one or more controllers capable of controlling one or more process elements in a processing facility.

17. A system, comprising:

a plurality of switches capable of facilitating communication between a plurality of endpoints, at least one of the switches comprising;

a plurality of interfaces comprising a first group of interfaces associated with a first virtual network and a second group of interfaces associated with a second virtual network;

a switch fabric capable of transporting traffic between the interfaces; and

a controller capable of;

determining that traffic received through a first interface in the first group of interfaces is destined for an endpoint associated with the second virtual network;

causing the switch fabric to forward the traffic to a second interface in the second group of interfaces;

filtering the traffic that is received at the second interface in the second group of interfaces; and

causing the switch fabric to forward the filtered traffic to a third interface in the second group of interfaces for communication of the filtered traffic towards the endpoint associated with the second virtual network.

18. The system of claim 17, wherein the controller is capable of causing the switch fabric to forward the traffic from the first interface to the second interface by causing the switch fabric to forward the traffic from the first interface to a fourth interface in the first group of interfaces, the fourth interface coupled to the second interface by a cable.

19. The system of claim 18, wherein the cable coupling the second and fourth interfaces comprises a crossover cable.

20. The system of claim 17, wherein:

the first virtual network comprises a first Virtual Local Area Network associated with a Level 2 network level in a process control system; and

the second virtual network comprises a second Virtual Local Area Network associated with a Level 1 network level in the process control system, the Level 1 network level comprising one or more controllers capable of controlling one or more process elements in a processing facility.