User to network interface protocol for packet communications networks

• US 4,922,486 A
• Filed: 03/31/1988
• Issued: 05/01/1990
• Est. Priority Date: 03/31/1988
• Status: Expired due to Term

• Current Assignee: Bell Telephone Laboratories, Inc. (Nokia Corporation), Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: American Telephone & Telegraph Company (AT&T, Inc.)
• Inventors: Roediger, Gary A., Lidinsky, William P., Weddige, Ronald C., Steele, Scott B.
• Primary Examiner(s): Orsino, Joseph A.
• Assistant Examiner(s): Scutch, III, Frank M.
• Application Number:
  US07/175,693
• Time in Patent Office: 761 Days
• Field of Search: 370/60, 370/94, 370/58, 370/110.1, 370/99, 340/625.34, 340/825.52, 340/825.33
• US Class Current: 370/427
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 49/205 Quality of Service based
• CPC Class Codes: H04L 49/3018 Input queuing
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 49/357 Fibre channel switches
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A high capacity metropolitan area network (MAN) is described. Data traffic from users is connected to data concentrators at the edge of the network, and is transmitted over fiber optic data links to a hub where the data is switched. The hub includes a plurality of data switching modules, each having a control means, and each connected to a distributed control space division switch. Advantageously, the data switching modules, whose inputs are connected to the concentrators, perform all checking and routing functions, while the 1024×1024 maaximum size space division switch, whose outputs are connected to the concentrators, provides a large fan-out distribution network for reaching many concentrators from each data switching module. Distributed control of the space division switch permits several million connection and disconnection actions to be performed each second, while the pipelined and parallel operation within the control means permits each of the 256 switching modules to process at least 50,000 transactions per second. The data switching modules chain groups of incoming packets destined for a common outlet of the space division switch so that only one connection in that switch is required for transmitting each group of chained packets from a data switching module to a concentrator. MAN provides security features including a port identification supplied by the data concentrators, and a check that each packet is from an authorized source user, transmitting on a port associated with that user, to an authorized destination user that is in the same group (virtual network) as the source user. A special network protocol for implementing these features is controlled by data in the header of packets for the network.

Claims

1. A protocol for a data network, comprising:

a data packet header comprising an identification of a source and a destination;

wherein said data network comprises means for checking for each data entity that transmission from said source to said destination is authorized prior to transmitting said each data entity to said destination if network transmission capacity is available.

2. A network protocol for a data network, said protocol specified by a header for each data packet, said header comprising:

an identification of a transmitting network port supplied by said network;

an identification of the name of a source and name of a destination supplied by a source user system;

said network comprising means for checking for each data entity that said source is authorized to transmit to said destination from said port prior to transmitting said each data entity to said destination if network transmission capacity is available.

6. The protocol of claim 2 wherein said header further comprises a user group identification and wherein said network further comprises:

means for translating from said name of said destination to a destination port identification for transmission of said each packet to said destination; and

wherein said means for checking further checks that said source and said destination are members of a user group identified by said user group identification.

3. A protocol for a data network, comprising a network protocol specified by a network header, comprising:

an identification of a source port;

an identification of a source user;

an identification of a destination user system;

an identification of a user group;

an identification of a type of service to be provided; and

a header check for detecting errors in said network header;

wherein said data network comprises means for identifying said source port and for inserting an identification of said source port into said network header as said identification of a source port;

wherein said data network comprises means for checking for each data entity whether a combination of said source user, said user group and said source port is authorized to transmit packets over said data network prior to transmitting said each data entity to said destination;

wherein said data network comprises means for generating a destination port identity from a combination of said destination user system identification and said group for transmitting said data packet to said destination port.

4. The protocol of claim 3 further comprising a user protocol specified by an end user header, comprising:

an identification of a user work unit;

an indication of the length of said user work unit;

an indication of a packet sequence number within said user work unit;

an identification of protocol to be used by said destination user; and

a number of a first byte of said packet within said user work unit;

wherein said destination user system comprises means for identifying said packet with reference to other packets of a user work unit, using said user work unit identification;

means for recognizing out of sequence packets using said packet sequence number;

said for storing data of said packet relative to a stored address for storing said user work unit using said number of said first byte; and

means for recognizing completion of reception of a user work unit using said length indication.

5. A method of transmitting data packets in a data network comprising the steps of:

inserting in a header of each data packet an identification of a source and a destination; and

checking in said data network for each data entity whether said source is authorized to transmit packets to said destination prior to transmitting said each data entity to said destination if network transmission capacity is available.