Multi-tenant unit

• US 6,144,638 A
• Filed: 05/09/1997
• Issued: 11/07/2000
• Est. Priority Date: 05/09/1997
• Status: Expired due to Term

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: BBN Corporation (Verizon Communications Inc.)
• Inventors: Obenhuber, Thomas, Joffe, Rodney L.
• Primary Examiner(s): Olms, Douglas W.
• Assistant Examiner(s): Vanderpuye, Kenneth
• Application Number:
  US08/853,862
• Time in Patent Office: 1,278 Days
• Field of Search: 370/230, 370/231, 370/235, 370/398, 370/423, 370/468, 370/537, 370/538, 370/412, 370/413, 370/414, 370/415, 370/416, 370/417, 370/418, 370/232, 370/233, 370/234, 370/252 , 370/253
• US Class Current: 370/231
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2863 Arrangements for combining access network resources elements, e.g. channel bonding modem pooling H04L25/14; routing of packets H04L45/00; multichannel or multilink protocols H04L69/14
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893
• CPC Class Codes: H04L 49/25 Routing or path finding in a switch fabric
• CPC Class Codes: H04L 49/351 for local area network [LAN], e.g. Ethernet switches
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks

Abstract

Systems and methods for providing multiple users with access to a public network like the Internet are provided. A single high bandwidth connection (e.g., fast Ethernet) allows the users to communicate with the public network. Each user is allocated a specific bandwidth and can freely communicate with the public network up to the allocated bandwidth. Additionally, the invention may be remotely configured to change bandwidth allocations.

Claims

1. An apparatus for communicating information packets between each of a plurality of user ports and a network port, the apparatus comprising:

a switch for establishing communication paths between each of the user ports and the network port;

storage for configuration information regarding the user ports including, a bandwidth allocated to each user port and including security features for each user port;

a controller, responsive to the configuration information for a given user port, for limiting the flow of information packets in a given time interval between the given user port and the network port corresponding to the bandwidth allocated to each user port; and

a firewall, responsive to the configuration information for the given user port, for filtering network traffic to the given user port corresponding to the security features for that user port.

2. The apparatus of claim 1, wherein:

the controller for limiting operates to pass a maximum number of information packets in a given time interval, and, once during the given time interval, to drop subsequent information packets that appear during the given time interval.

3. The apparatus of claim 2, wherein the bandwidth is in a range of 1 kbps to 100 Mbps.

4. The apparatus of claim 1, wherein:

the configuration information for the given user port is information regarding a type of service specified for the given user port; and

the controller for limiting operates to pass only information packets meeting a given criterion consistent with the type of service specified for the given user port, and to drop information packets that are not consistent with the type of service specified for the given user port.

5. The apparatus of claim 1, wherein:

the storage includes a non-volatile computer memory; and

the controller for limiting comprises a computer processor, coupled to the non-volatile computer memory and programmed to implement a procedure for limiting the flow of information packets.

6. The apparatus of claim 1, wherein each of the user ports comprises an Ethernet controller.

7. A method for distributing data between a network port and a plurality of user ports, the method comprising the steps of:

storing configuration information, indicating data bandwidth allocated to each of the user ports and indicating security features of each of the user ports;

receiving a request to send data between the network port and the selected user port if the current data bandwidth is less than the allocated data bandwidth;

filtering data sent between the network port and the selected user port based on the security features of the selected user port;

determining if the current data bandwidth of the selected port exceeds the allocated data bandwidth according to a counter measuring the number of bytes of data in a given time interval; and

sending the filtered data between the network port and the selected user port if the counter indicates that the current data bandwidth is less than the allocated data bandwidth.

8. The method of claim 7, further comprising the step of not sending the data to the selected user port if the current data bandwidth is greater than or equal to the allocated data bandwidth.

9. The method of claim 7, wherein the determining step includes the step of determining that the current data bandwidth of the selected user port has exceeded the allocated data bandwidth if the counter is less than zero.

10. The method of claim 7, further comprising the step of decrementing the counter for each byte specified in request to send data if the current data bandwidth of the selected user port has not exceeded the allocated bandwidth.

11. The method of claim 10, further comprising the step of allocating data bandwidth to a user port in the range of 1 kbps to 100 Mbps.

12. The method of claim 7, wherein the step of sending the data includes sending data from the network port to the selected user port.

13. The method of claim 7, wherein the step of sending the data includes sending data from the selected user port to the network port.

14. The method of claim 7, further comprising the step of remotely defining the configuration information.

15. A method of establishing respective network connections between a wide area network (WAN) and each of a plurality of tenant sites at a single location to allow information packets to be communicated between each tenant site and the WAN, the method comprising the steps of:

providing a central switching apparatus at the location, the apparatus including a plurality of tenant ports, and a network port;

storing configuration information including security information for each tenant at the central switching apparatus;

coupling the WAN to the network port;

coupling at least one computer or a local area network (LAN) at each tenant site to a respective tenant port;

establishing, with the central switching apparatus, communication paths between each tenant port and the network port to provide each tenant with access to the WAN, and filtering, with the central switching apparatus, data sent between the network port and each tenant port based on the security information for each tenant port.

16. The method of claim 15, and further comprising the steps, carried out for each tenant, of:

storing configuration information germane to that tenant; and

using that tenant'"'"'s configuration to limit, according to a particular criterion, information packets that are allowed to travel between that tenant'"'"'s site and the WAN.