Extended internet protocol virtual private network architectures

• US 6,493,349 B1
• Filed: 11/13/1998
• Issued: 12/10/2002
• Est. Priority Date: 11/13/1998
• Status: Expired due to Term

• Current Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Casey, Liam M.
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): ELALLAM, AHMED
• Application Number:
  US09/191,142
• Time in Patent Office: 1,488 Days
• Field of Search: 370/466, 370/467, 370/469, 370/389, 370/392, 370/395, 370/396, 370/397, 370/400, 370/401
• US Class Current: 370/409
• CPC Class Codes: H04L 12/4675 Dynamic sharing of VLAN information amongst network nodes configuration of the network or of network elements H04L41/08
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]

Abstract

A virtual private network infrastructure is provided which enables private network communications over a shared network. The infrastructure includes a shared network partitioned into at least two separate areas. A first router is connected to a first area and configured to distribute first router VPN information across the first area. The first router VPN information includes a VPN identifier which is assigned to the first router. It also includes a second router connected between the first area and a second area which is configured to distribute second router VPN information across the first area. The second router VPN information includes a VPN identifier which is assigned to the second router which is the same VPN identifier assigned to the first router.

A method of configuring a virtual private network infrastructure is also provided which enables private network communications over a shared network. The method includes partitioning a shared network into multiple areas and connecting a virtual router between at least two of the areas. A VPN identifier is assigned to the virtual router. A link is created between a first private network router and a first shared network router which is connected to a first area. The VPN identifier assigned to the virtual router is also assigned to the first shared network router and the VPN identifier is communicated between the first shared network router and the virtual router.

Claims

1. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two separate areas;

a first router coupled to a first of said areas and configured to distribute first router VPN information across said first area, wherein said first router VPN information includes a VPN identifier which is assigned to said first router;

a second router coupled between said first area and a second of said at least two areas and configured to distribute second router VPN information across said first area;

wherein said second router VPN information includes a VPN identifier which is assigned to said second router; and

,

wherein said VPN identifier assigned to said first router is the same as said VPN identifier assigned to said second router.

5. The virtual private network infrastructure according to claim 1 wherein said second router is virtual.

7. The virtual private network infrastructure according to claim 1 wherein said first area operates using a first network protocol and a said second area operates using a second network protocol.

8. The virtual private network infrastructure according to claim 7 wherein said first network protocol is a protocol selected from the group consisting of MPLS, ATM, IP, Frame Relay, Local Area Network Emulation, GRE, L2TP, IPSec, and ethernet.

9. The virtual private network infrastructure according to claim 7 wherein said second network protocol is a protocol selected from the group consisting of MPLS, ATM, IP, Frame Relay, Local Area Network Emulation, GRE, L2TP, IPSec, and ethernet.

10. The virtual private network infrastructure according to claim 1 wherein said distribution of information by each of said routers is dynamic.

11. The virtual private network infrastructure according to claim 1 wherein:

said second of said at least two areas is the Internet; and

said second shared network router is configured to provide firewall services to said first of at least two areas.

2. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two separate areas;

a first router coupled to a first of said areas and configured to distribute first router VPN information across said first area, wherein said first router VPN information includes a VPN identifier which is assigned to said first router;

a second router coupled between said first area and a second of said at least two areas and configured to distribute second router VPN information across said first area;

wherein said second router VPN information includes a VPN identifier which is assigned to said second router;

wherein said VPN identifier assigned to said first router is the same as said VPN identifier assigned to said second router; and

a third router coupled to said second area and configured to distribute third router VPN information across said second area, wherein said third router VPN information includes a VPN identifier which is assigned to said third router, said second router being further configured to distribute said second router VPN information across said second area, VPN identifier assigned to said third router being the same as said VPN identifier assigned to said second router.

3. The virtual private network infrastructure according to claim 2 wherein said distribution of information by each of said routers is dynamic.

4. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two separate areas;

a first router coupled to a first of said areas and configured to distribute first router VPN information across said first area, wherein said first router VPN information includes a VPN identifier which is assigned to said first router;

a second router coupled between said first area and a second of said at least two areas and configured to distribute second router VPN information across said first area;

wherein said second router VPN information includes a VPN identifier which is assigned to said second router, said VPN identifier assigned to said first router being the same as said VPN identifier assigned to said second router;

a first private network adaptation device selectively coupleable to said first router; and

,

a second private network adaptation device selectively coupleable to said third router;

wherein when said first private network adaptation device is coupled to said first router, and said second private network adaptation device is coupled to said third router said first private network adaptation device may communicate with said second private network adaptation device.

6. The virtual private network infrastructure according to Clam 4 wherein said first and third routers each are virtual.

12. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two separate areas;

a first router coupled to a first of said areas and configured to distribute first router VPN information across said first area, wherein said first router VPN information includes a VPN identifier which is assigned to said first router;

a second router coupled between said first area and a second of said at least two areas and configured to distribute second router VPN information across said first area;

wherein said second router VPN information includes a VPN identifier which is assigned to said second router, said VPN identifier assigned to said first router being the same as said VPN identifier assigned to said second router;

a third router coupled to said first of said areas configured to route communications between a dial-up network and said first router;

wherein said VPN identifier assigned to said first and second routers is assigned to said third router.

13. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two distinct areas;

first router means coupled to a first of said areas for dynamically distributing first router means VPN information across said first area, wherein said first router means VPN information includes a VPN identifier which is assigned to said first router means;

a second router means coupled between said first area and a second of said areas for dynamically distributing second router means VPN information across said first and second areas;

wherein said second router means VPN information includes a VPN identifier which is assigned to said second router means; and

,

wherein said VPN identifier assigned to said first router means is the same as said VPN identifier assigned to said second router means.

14. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two distinct areas;

first router means coupled to a first of said areas for dynamically distributing first router means VPN information across said first area, wherein said first router means VPN information includes a VPN identifier which is assigned to said first router means;

a second router means coupled between said first area and a second of said areas for dynamically distributing second router means VPN information across said first and second areas;

wherein said second router means VPN information includes a VPN identifier which is assigned to said second router means, said VPN identifier assigned to said first router being the same as said VPN identifier assigned to said second router means; and

third router means coupled to said second area for dynamically distributing third router means VPN information across said second area, wherein said third router means VPN information includes a VPN identifier which is assigned to said third router means; and

,

wherein said VPN identifier assigned to said third router means is the same as said VPN identifier assigned to said second router means.

15. A virtual private network infrastructure which enables private network communications over a shared network comprising:

a shared network partitioned into at least two distinct areas;

first router means coupled to a first of said areas for dynamically distributing first router means VPN information across said first area, wherein said first router means VPN information includes a VPN identifier which is assigned to said first router means;

a second router means coupled between said first area and a second of said areas for dynamically distributing second router means VPN information across said first and second areas;

wherein said second router means VPN information includes a VPN identifier which is assigned to said second router means, said VPN identifier assigned to said first router being the same as said VPN identifier assigned to said second router means;

first private router means, selectively coupleable to said first router means, for routing communications to a node on a private network attached thereto; and

second private router means, selectively coupleable to said third router means, for routing communications to a node on a private network attached thereto;

wherein when said first private router means is coupled to said first router means, and said second private router means is coupled to said third router means said first private router means may communicate with said second private router means.

16. A method of configuring a virtual private network infrastructure which enables private network communications over a shared network comprising:

partitioning a shared network into a plurality of areas;

coupling a virtual router between at least two of said plurality of areas;

assigning at least one VPN identifier to said virtual router;

creating a link between a first private network router and a first shared network router, wherein said first shared network router is coupled to a first of said at least two of said plurality of areas;

assigning said at least one VPN identifier to said first shared network router;

communicating said VPN identifier between said first shared network router and said virtual router.

17. A method of configuring a virtual private network infrastructure which enables private network communications over a shared network comprising:

partitioning a shared network into a plurality of areas;

coupling a virtual router between at least two of said plurality of areas;

assigning at least one VPN identifier to said virtual router;

creating a link between a first private network router and a first shared network router, wherein said first shared network router is coupled to a first of said at least two of said plurality of areas;

assiging said at least one VPN identifier to said first shared network router;

communicating said VPN identifier between said second shared network router and said virtual router.

creating a link between a second private network router and a second shared network router, wherein said second shared network router is coupled to a second of said at least two of said plurality of areas;

assigning said at least one VPN identifier to said second shared network router;

communicating said VPN identifier between said second shared network router and said virtual router.

18. The method of configuring a virtual private network infrastructure according to claim 17 further comprising:

said first private router transmitting a communication to said first shared network router, wherein said communication is intended for said second shared network router;

said first private router receiving said communication and encapsulating said communication in accordance with a tunneling protocol specific to said first of said at least two of said plurality of areas;

said first shared network router forwarding said encapsulated communication to said virtual router;

said virtual router receiving said communication from said first shared network router, deencapsulating said communication and re-encapsulating said communication in accordance with a tunneling protocol specific to said second of said at least two of said plurality of areas;

said virtual router forwarding said re-encapsulated communication to said second shared network router.