VLAN tunneling

• US 20080155252A1
• Filed: 12/22/2006
• Published: 06/26/2008
• Est. Priority Date: 12/22/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Nambiar, Brijesh
• Granted Patent: US 8,161,543 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement

Abstract

According to one embodiment of the invention, a method for establishing multiple tunnels for each virtual local area network is described. Upon receiving information over a first tunnel associated with a first virtual local area network, a determination is made whether the information is from a network device assigned to a second virtual local area network, which differs from the first virtual local area network. If the network device is a member of the second virtual local area network, a second tunnel associated with the second virtual local area network is created.

Claims

1. A method comprising:

receiving information over a first tunnel associated with a first virtual local area network;

determining whether the information is from a network device assigned to a second virtual local area network differing from the first virtual local area network; and

creating a second tunnel associated with the second virtual local area network if the network device is a member of the second virtual local area network.

2. The method of claim 1, wherein the network device is a wireless station.

3. The method of claim 1, wherein the creating of the second tunnel includes establishing a unique multicast key for the second tunnel.

4. The method of claim 3, wherein the first tunnel enables encrypted communications with the network device using a key differing from the multicast key.

5. The method of claim 1, wherein the determining whether the information is from the network device assigned to the second virtual local area network comprises:

determining a type of encryption used when transferring the information over the first tunnel;

determining that the second tunnel is needed if the type of encryption used by the information differs from a type of encryption supported by the first tunnel.

6. The method of claim 5, wherein the type of encryption supported by the first tunnel is Wired Equivalent Privacy (WEP) and the type of encryption supported by the second tunnel is a non-WEP encryption algorithm.

7. The method of claim 1, wherein the creating of the second tunnel includes creating an Open Systems Interconnection Layer 3 (OSI-L3) tunnel that transfers encapsulated Layer 2 and Layer 3 traffic.

8. Software executed by a processor implemented within a network switch of a network, comprising:

a first software module that, when executed, determines whether incoming information from a network device should be transferred over a second tunnel differing from a first tunnel associated with a first virtual local area network over which the incoming information is initially transferred; and

a second software module that, when executed, creates the second tunnel associated with a second virtual local area network if the network device is a member of the second virtual local area network.

9. The software of claim 8 further comprising a third software module that, when executed, routes all data received from the network device over the second tunnel after establishment of the second tunnel.

10. The software of claim 8, wherein the second software module for creating of the second tunnel includes software to establish a unique multicast key for the second tunnel that is made available to the network switch and the network device.

11. The software of claim 8, wherein the first software module determines whether incoming information from the network device should be transferred over the second tunnel comprises:

a software module to determine a type of encryption used when transferring the incoming information over the first tunnel;

a software module to determine that the second tunnel is needed if the type of encryption used by the incoming information differs from a type of encryption supported by the first tunnel.

12. The software of claim 11, wherein the type of encryption supported by the first tunnel is Wired Equivalent Privacy (WEP) and the type of encryption supported by the second tunnel is a non-WEP encryption algorithm.

13. The software of claim 8, wherein the second software module creates the second tunnel by creating an Open Systems Interconnection Layer 3 (OSI-L3) tunnel that encapsulates both Layer 2 and Layer 3 traffic.

14. A method comprising:

determining whether information is from a network device assigned to a second virtual local area network differing from a first virtual local area network corresponding to a tunnel previously established; and

creating a second tunnel associated with the second virtual local area network if the network device is a member of the second virtual local area network.

15. The method of claim 14, wherein the network device is a wireless station.

16. The method of claim 14, wherein the creating of the second tunnel includes establishing a unique multicast key for the second tunnel.

17. The method of claim 16, wherein the first tunnel enables encrypted communications with the network device using a key differing from the multicast key.

18. The method of claim 14, wherein the determining whether the information is from the network device assigned to the second virtual local area network comprises:

determining a type of encryption used when transferring the information over the first tunnel; and

determining that the second tunnel is needed if the type of encryption used by the information differs from a type of encryption supported by the first tunnel.