SHARED APPLICATION INTER-WORKING WITH VIRTUAL PRIVATE NETWORKS

• US 20070140250A1
• Filed: 12/18/2006
• Published: 06/21/2007
• Est. Priority Date: 12/21/2005
• Status: Active Grant

• Current Assignee: Solace Corp.
• Original Assignee: Solace Systems, Inc. (United Kingdom)
• Inventors: McAllister, Shawn, Barr, Kenneth, Gonzalez, Erick
• Granted Patent: US 7,889,738 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/76 Routing in software-defined topologies, e.g. routing between virtual machines

Abstract

A method of providing a shared application infrastructure simultaneously to multiple independent virtual private networks with potentially overlapping IP addresses, involves connecting to an underlying layer 1, 2 or 3 virtual private network offering one or more virtual private networks, determining which virtual private network traffic is being received from or sent into, maintaining logically separate routing tables per VPN to allow overlapping addresses, and providing an application which provides a logical instance of the service to each VPN.

Claims

1. A method of implementing a virtualized service simultaneously to multiple independent virtual private networks (VPNs) with potentially overlapping network addresses, comprising:

establishing said VPNs;

maintaining logically separate routing tables for each VPN; and

providing a logical instance of the virtualized service to each VPN while maintaining the integrity of the separate VPNs using shared equipment.

2. The method of claim 1, wherein said logical instances of said virtualized service are provided by one or more network devices communicating with different VPNs through separate interfaces.

3. The method of claim 2, wherein each separate interface is a separate physical interface.

4. The method of claim 2, wherein each separate interface is a separate flow on a common physical interface.

5. The method of claim 2, wherein each interface is associated with a connection instance having its own virtual routing and forwarding (VRF) table.

6. The method of claim 2, wherein the connection instance is provided by an Ethernet port with VLAN tagging, each VLAN tag being associated with a corresponding VPN.

7. The method of claim 5, wherein said one or more network devices are message router(s).

8. The method of claim 7, wherein a plurality of said message routers are interconnected by a common VPN backbone, whereby a message required by different VPNs can be sent as a single shared copy over said common VPN backbone between said network devices.

9. The method of claim 8, wherein said message routers are content-based routers.

10. The method of claim 8, wherein in order to determine the next hop for an egress packet, a said message router runs a routing protocol for each VRF instance.

11. The method of claim 1, wherein said VPNs are implemented using virtual private network technologies selected from the group consisting of:

IP VPNs, transparent LAN service, VPLS, Frame Relay, ATM, and Time-division multiplexing.

12. The method of claim 1, wherein said service is offered over a distributed infrastructure.

13. The method of claim 1, wherein said service is content-based message routing.

14. The method of claim 1, wherein said logical instances of the virtualized service are provided by an application running on a device connected to multiple provider edge routers.

15. The method of claim 1, wherein said logical instances of the virtualized service are provided by an application running on a device connected to a provider edge router over multiple connections.

16. The method of claim 5, wherein one said connection is provided for each VPN, and one said connection is provided for a backbone VPN.

17. A method of implementing a virtualized service simultaneously to multiple independent virtual private networks (VPNs) with potentially overlapping network addresses, comprising:

establishing said VPNs;

maintaining logically separate routing tables for each VPN; and

providing a single logical instance of the virtualized service to at least two VPNs to allow communication between VPNs in accordance with pre-established entitlements using shared equipment.

18. The method of claim 17, wherein the virtualized service is a content-based message routing service, and a publisher on a first VPN can reach a subscriber on a second VPN sharing said single logical instance.

19. The method of claim 18, wherein the messages are delivered between VPNs over a common backbone VPN.

20. A method of implementing a virtualized service simultaneously wherein publishers provide content to subscribers associated with virtual private networks (VPNs), comprising:

organizing the publishers and subscribers into entitlement groups;

maintaining separate routing tables for different entitlement groups; and

routing messages through the network using the routing tables for the entitlement group associated with the publisher and subscribers of the message.

21. The method of claim 20, wherein the publishers and subscribers are tagged with their respective entitlement groups, and when a publisher publishes a message into an ingress router, the only subscribers to which the ingress router routes the message are those tagged with the same entitlement group as the publisher.

22. A network providing a content based message routing service comprising:

at least one message router;

a plurality of virtual private networks connected to said message router(s); and

said message router(s) having multiple interfaces associated with the respective VPNs and maintaining logically separate routing tables for each VPN.

23. The network of claim 22, comprising a plurality of said message routers interconnected by a common backbone to permit sharing of a common message by different VPNs when they are each entitled to that message.

24. The network of claim 22, wherein interface on said message routers comprises an Ethernet port with VLAN tagging, wherein each VLAN tag is associated with a different VPN.

25. A network providing a content based message routing service comprising:

a plurality of message routers interconnected by communications links;

each message router being connected to multiple virtual private networks (VPNs) over respective separate interfaces and maintaining logically separate routing tables for each VPN;

said message routers being connected to a shared infrastructure to permit publishers on one VPN to reach subscribers on another VPN in accordance with pre-established entitlements.

26. The network of claim 25, wherein said message routers are interconnected over links residing in a backbone virtual private network, and traffic carried between different routers for various customers is separated in accordance with message routing entitlements.

27. A content-based message router, comprising:

a plurality of interfaces for connection to respective virtual private networks; and

logically separate routing tables for each VPN associated with respective interfaces to permit the insertion of messages into different VPNs with potentially overlapping addresses and without affecting the integrity of the VPNs.

28. The content-based message router of claim 27, wherein said interfaces are Ethernet ports with VLAN tagging, and wherein each VLAN tag corresponds to a different VPN.

29. The content-based message router, of claim 27, further comprising a table for maintaining storing pre-established entitlements for publishers and subscribers, and being connectable to a shared infrastructure to permit publishers on one VPN to reach subscribers on another VPN in accordance with the pre-established entitlements.

30. A method of implementing a virtualized service wherein publishers provide content to subscribers, comprising:

organizing the publishers and subscribers into entitlement groups;

maintaining separate routing tables for different entitlement groups; and

routing messages through the network using the routing tables for the entitlement group associated with the publisher and subscribers of the message.