Screened subnet having a secured utility VLAN

• US 7,194,767 B1
• Filed: 06/28/2002
• Issued: 03/20/2007
• Est. Priority Date: 06/28/2002
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Boydstun, Kenneth C., Marshall, Stephen L., Chen, Jun
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US10/185,920
• Time in Patent Office: 1,726 Days
• Field of Search: None
• US Class Current: 726/14
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

A screened subnet for interconnecting an intranet to the Internet includes first and second subnets. A first firewall provides a first level of protection to a portion of the first subnet and to the second subnet while a second firewall provides a second level of protection to the second subnet. A secured utility VLAN provides utility services for the portion of the first subnet and/or the second subnet. The secured utility VLAN is coupled to the screened subnet such that it enjoys an additional level of protection relative to the subnets and/or the portion thereof which it serves. In various embodiments thereof, the screened subnet is configured to include a single, shared, secured utility VLAN for servicing both the portion of the first subnet and the second subnet, or a pair of discrete secured utility VLANs for respectively servicing the portion of the first subnet and the second subnet.

Claims

1. A screened subnet for interconnecting a first network with a second network, comprising:

a first protective device configured for coupling to said first network;

a subnet which includes at least one computer system, said subnet coupled to said first protective device, said first protective device providing a first level of protection, from said first network, to at least one portion of said subnet;

a second protective device coupled to said first protective device and configured for coupling to said second network; and

a secured utility VLAN for providing utility services for said at least one portion of said subnet, said secured utility VLAN comprised of at least one computer system, and

said secured utility VLAN coupled to said subnet such that said secured utility VLAN has a second level of protection from said first network.

2. The apparatus of claim 1, wherein said secured utility VLAN is coupled to said second protective device, said second protective device providing said secured utility VLAN with said second level of protection.

3. The apparatus of claim 2, wherein said first protective device is a first firewall and said second protective device is a second firewall.

4. The apparatus of claim 3, wherein a VLAN encompasses said at least one portion of said subnet.

5. The apparatus of claim 1, and further comprising:

a third protective device coupled to said subnet;

said secured utility VLAN coupled to said third protective device and said third protective device providing said secured utility VLAN with said second level of protection.

6. The apparatus of claim 5, wherein said first protective device is a first firewall, said second protective device is a second firewall and said third protective device is a choke router.

7. The apparatus of claim 6, wherein a VLAN encompasses said at least one portion of said subnet.

8. The apparatus of claim 5, wherein said first protective device is a first firewall, said second protective device is a second firewall and said third protective device is a third firewall.

9. The apparatus of claim 8, wherein a VLAN encompasses said at least one portion of said subnet.

10. The apparatus of claim 5, and further comprising a link configured for coupling said third protective device to said second network.

11. A screened subnet for interconnecting a first network with a second network, comprising:

a first protective device configured for coupling to said first network;

a first subnet which includes at least one computer system in a first portion thereof and at least one computer system in a second portion thereof, said first subnet coupled to said first protective device, said first protective device providing a first level of protection, from said first network, to said second portion of said first subnet;

a second protective device coupled to said first protective device and configured for coupling to said second network;

a second subnet which includes at least one computer system, said second subnet coupled to said second protective device, said first protective device providing a first level of protection, from said first network, to said second subnet; and

a first secured utility VLAN for providing utility services for said first portion of said first subnet, said first secured utility VLAN comprised of at least one computer system;

said first secured utility VLAN coupled to said first subnet such that said first secured utility VLAN has a second level of protection from said first network.

12. The apparatus of claim 11, wherein said first secured utility VLAN is coupled to said second protective device, said second protective device providing said first secured utility VLAN with said second level of protection from said first network, said second protective device further providing a second level of protection, from said first network, to said second subnet.

13. The apparatus of claim 12, wherein said first protective device is a first firewall and said second protective device is a second firewall.

14. The apparatus of claim 13, wherein a first VLAN encompasses said first portion of said first subnet and a second VLAN encompasses said second portion of said first subnet, said first protective device not providing said first level of protection, from said first network, to said first portion of said first subnet.

15. The apparatus of claim 11, and further comprising:

a third protective device coupled to said first subnet;

said first secured utility VLAN coupled to said third protective device and said third protective device providing said first secured utility VLAN with said second level of protection.

16. The apparatus of claim 15, wherein a first VLAN encompasses said first portion of said first subnet and a second VLAN encompasses said second portion of said first subnet, said first protective device not providing said first level of protection, from said first network, to said first portion of said first subnet.

17. The apparatus of claim 15, and further comprising a link configured for coupling said third protective device to said second network.

18. The apparatus of claim 15, and further comprising:

a second secured utility VLAN for providing utility services for said second subnet, said second secured VLAN comprised of at least one computer system;

said second protective device providing a second level of protection, from said first network, to said second subnet; and

said second secured VLAN coupled to said second subnet such that said second secured utility VLAN has a third level of protection from said first network.

19. The apparatus of claim 18, and further comprising:

a fourth protective device coupled to said second subnet;

said second secured utility VLAN coupled to fourth protective device and said fourth protective device providing said second secured utility VLAN with said third level of protection.

20. The apparatus of claim 19, wherein a first VLAN encompasses said first portion of said first subnet and a second VLAN encompasses said second portion of said first subnet, said first protective device not providing said first level of protection, from said first network, to said first portion of said first subnet.

21. The apparatus of claim 19, and further comprising:

a first link configured for coupling said third protective device to said second network; and

a second link configured for coupling said fourth protective device to said second network.

22. The apparatus of claim 19, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a first choke router and said fourth protective device is a second choke router.

23. The apparatus of claim 19 wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a third firewall and said fourth device is a choke router.

24. The apparatus of claim 19, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a choke router and said fourth protective device is a third firewall.

25. The apparatus of claim 19, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a third firewall and said fourth protective device is a fourth firewall.

32. The apparatus of claim 25, and further comprising:

a third protective device coupled to said first subnet;

a fourth protective device coupled to said second subnet;

said shared secured utility VLAN coupled to said first subnet by said third protective device and coupled to said second subnet by said fourth protective device, said third protective device providing said shared secured utility VLAN with said second level of protection from accesses via said first subnet and said fourth protective device providing said shared secured utility VLAN with said third level of protection from accesses via said second subnet.

33. The apparatus of claim 32, wherein a first VLAN encompasses said first portion of said first subnet and a second VLAN encompasses said second portion of said first subnet, said first protective device not providing said first level of protection, from said first network, to said first portion of said first subnet.

34. The apparatus of claim 32, and further comprising:

a first link configured for coupling said third protective device to said second network; and

a second link configured for coupling said fourth protective device to said second network.

35. The apparatus of claim 32, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a first choke router and said fourth protective device is a fourth choke router.

36. The apparatus of claim 32, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a choke router and said fourth protective device is a third firewall.

37. The apparatus of claim 32, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a third firewall and said fourth protective device is a choke router.

38. The apparatus of claim 32, wherein said first protective device is a first firewall, said second protective device is a second firewall, said third protective device is a third firewall and said fourth protective device is a fourth firewall.

26. A screened subnet for interconnecting a first network with a second network, comprising:

a first protective device configured for coupling to said first network;

a first subnet which includes at least one computer system in a first portion thereof and at least one computer system in a second portion thereof, said first subnet coupled to said first protective device, said first protective device providing a first level of protection, from said first network, to said second portion of said first subnet;

a second protective device coupled to said first protective device and configured for coupling to said second network;

a second subnet which includes at least one computer system, said second subnet coupled to said second protective device, said first protective device providing a first level of protection, from said first network, to said second subnet and said second protective device providing a second level of protection, from said first network, to said second subnet; and

a shared secured utility VLAN for providing utility services for said first portion of said first subnet and said second subnet, said secured shared utility VLAN comprised of at least one computer system;

said shared secured utility VLAN coupled to said first and second subnet that said shared secured utility VLAN has a second level of protection, from said first network, from accesses via said first subnet and a third level of protection, from said first network, from accesses via said second subnet.

27. The apparatus of claim 26 and further comprising:

a third protective device coupled to said first subnet and to said second subnet;

said shared secured utility VLAN coupled to said first and second subnets by said third protective device, said third protective device providing said shared secured utility VLAN with said second level of protection from accesses via said first subnet and said third level of protection from accesses via said second subnet.

28. The apparatus of claim 27, wherein a first VLAN encompasses said first portion of said first subnet and a second VLAN encompasses said second portion of said first subnet, said first protective device not providing said first level of protection, from said first network, to said first portion of said first subnet.

29. The apparatus of claim 27, and further comprising a link configured for coupling said third protective device to said second network.

30. The apparatus of claim 27, wherein said first protective device is a first firewall, said second protective device is a second firewall and said third protective device is a choke router.

31. The apparatus of claim 27, wherein said first protective device is a first firewall, said second protective device is a second firewall and said third protective device is a third firewall.