Virtual private network (VPN)-aware customer premises equipment (CPE) edge router

• US 7,447,151 B2
• Filed: 05/12/2004
• Issued: 11/04/2008
• Est. Priority Date: 03/20/2001
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Business Global LLC (Verizon Communications Inc.)
• Inventors: McDysan, David E.
• Primary Examiner(s): Pham; Chi H.
• Assistant Examiner(s): Elallam; Ahmed
• Application Number:
  US10/843,761
• Publication Number:
  US 20040208122A1
• Time in Patent Office: 1,637 Days
• Field of Search: 370/229, 370/231, 370/230.1, 370/235, 370/235.1, 370/237, 370/351, 370/352, 370/355, 370/389, 370/392, 370/395.2, 370/395.21, 370/395.31, 370/395.4, 370/395.52, 370/395.53, 370/395.7, 370/395.42, 370/395.5, 370/395.71, 370/401, 370/409, 370/412, 370/428, 370/468, 709/228, 709/229, 709/240, 726 12- 15
• US Class Current: 370/231
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1446 inter-operator billing
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/467 Arrangements for supporting untagged frames, e.g. port-based VLANs
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 47/825 Involving tunnels, e.g. MPLS
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 61/4557 Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 65/103 : in the network
• CPC Class Codes: H04L 65/104 : in the network
• CPC Class Codes: H04L 65/1043 : Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1069 : Session establishment or de-establishment
• CPC Class Codes: H04L 65/1096 : Supplementary features, e.g. call forwarding or call holding systems providing special services or facilities to telephony subscribers H04M3/42
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1104 : Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/612 : for unicast
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04L 67/06 : specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 69/08 : Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/43 : Billing software details
• CPC Class Codes: H04M 15/47 : Fraud detection or prevention means
• CPC Class Codes: H04M 15/53 : using mediation
• CPC Class Codes: H04M 15/55 : for hybrid networks
• CPC Class Codes: H04M 15/56 : for VoIP communications
• CPC Class Codes: H04M 15/63 : based on the content carried by the session initiation protocol [SIP] messages
• CPC Class Codes: H04M 15/8292 : Charging for signaling or unsuccessful connection
• CPC Class Codes: H04M 2207/35 : virtual private networks
• CPC Class Codes: H04M 2215/0148 : Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0172 : Mediation, i.e. device or program to reformat CDRS from one or more switches in order to adapt to one or more billing programs formats
• CPC Class Codes: H04M 2215/202 : VoIP; Packet switched telephony
• CPC Class Codes: H04M 2215/2046 : Hybrid network
• CPC Class Codes: H04M 2215/22 : Bandwidth or usage-sensitve billing
• CPC Class Codes: H04M 2215/44 : Charging/billing arrangements for connection made over different networks, e.g. wireless and PSTN, ISDN, etc.
• CPC Class Codes: H04M 2242/06 : Lines and connections with preferential service
• CPC Class Codes: H04M 3/42187 : Lines and connections with preferential service
• CPC Class Codes: H04M 7/006 : Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/0078 : Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04Q 2213/13166 : Fault prevention
• CPC Class Codes: H04Q 2213/13384 : Inter-PBX traffic, PBX networks, e.g. corporate networks
• CPC Class Codes: H04Q 2213/13389 : LAN, internet
• CPC Class Codes: H04Q 2213/13399 : Virtual channel/circuits
• CPC Class Codes: H04Q 3/0029 : Provisions for intelligent networking
• CPC Class Codes: H04W 12/126 : Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A network architecture includes a communication network that supports one or more network-based Virtual Private Networks (VPNs). The communication network includes a plurality of boundary routers that are connected by access links to CPE edge routers belonging to the one or more VPNs. To prevent traffic from outside a customer'"'"'s VPN (e.g., traffic from other VPNs or the Internet at large) from degrading the QoS provided to traffic from within the customer'"'"'s VPN, the present invention gives precedence to intra-VPN traffic over extra-VPN traffic on each customer'"'"'s access link through access link prioritization or access link capacity allocation, such that extra-VPN traffic cannot interfere with inter-VPN traffic. Granting precedence to intra-VPN traffic over extra-VPN traffic in this manner entails partitioning between intra-VPN and extra-VPN traffic on the physical access link using layer 2 multiplexing and configuration of routing protocols to achieve logical traffic separation between intra-VPN traffic and extra-VPN traffic at the VPN boundary routers and CPE edge routers. By configuring the access networks, the VPN boundary routers and CPE edge routers, and the routing protocols of the edge and boundary routers in this manner, the high-level service of DoS attack prevention is achieved.

Claims

1. A method for supporting a virtual private network (VPN), the method comprising:

designating a first port of a router for packets transmitted internal to the VPN, the first port corresponding to a communication link;

designating a second port of the router for packets transmitted external to the VPN, the second port corresponding to the communication link;

determining whether a received packet is internal to the VPN;

transmitting the received packet over the first port if the received packet is determined to be internal to the VPN; and

preventing a Denial-of-Service (DoS) attack with respect to the communication link by allocating capacity on the communication link to ensure a predetermined Quality of Service (QoS) level for transmission of the packets internal to the VPN.

2. A method according to claim 1, wherein the router is a boundary router in communication with a customer premise router over the communication link.

3. A method according to claim 1, wherein the received packet includes a Differentiated Services Code Point (DSCP) field, the method further comprising:

setting the Differentiated Services Code Point (DSCP) field according to one of a plurality of Quality of Service (QoS) levels.

4. A method according to claim 1, wherein the packets external to the VPN correspond to another VPN.

5. A method according to claim 1, the method further comprising:

communicating with a first boundary router coupled to the VPN.

6. A method according to claim 5, the method further comprising:

communicating with a second boundary router coupled to a public data network.

7. A routing device for supporting a virtual private network (VPN), the device comprising:

a first port designated for packets transmitted internal to the VPN;

a second port designated for packets transmitted external to the VPN, wherein the first port and the second port couples to a communication link; and

a classifier configured to determine whether a received packet is internal to the VPN, wherein the received packet is transmitted over the first port if the received packet is determined to be internal to the VPN,

wherein a Denial-of-Service (DoS) attack with respect to the communication link is prevented by allocating capacity on the communication link to ensure a predetermined Quality of Service (QoS) level for transmission of the packets internal to the VPN.

8. A device according to claim 7, wherein the routing device is a boundary router.

9. A device according to claim 7, wherein the received packet includes a Differentiated Services Code Point (DSCP) field that is set according to one of a plurality of Quality of Service (QoS) levels.

10. A device according to claim 7, wherein the received packet is forwarded over the communication link to a customer premise equipment (CPE) router.

11. A device according to claim 7, wherein the packets external to the VPN correspond to another VPN.

12. A device according to claim 7, the device further comprising:

a third port configured to communicate with a first boundary router coupled to the VPN.

13. A device according to claim 12, the device further comprising:

a fourth port configured to communicate with a second boundary router coupled to a public data network.

14. A device for supporting a virtual private network (VPN), the device comprising:

a first network port configured to receive a packet from a host; and

a second network port coupled to a communication link for transporting the packet to a boundary router that interfaces the VPN,

wherein the boundary router has a first communication port designated for packets transmitted internal to the VPN and a second communication port for packets transmitted external to the VPN, the first communication port and the second communication port being configured to couple to the communication link,

wherein the boundary router prevents a Denial-of-Service (DoS) attack with respect to the communication link by allocating capacity on the communication link to ensure a predetermined Quality of Service (QoS) level for transmission of the packets internal to the VPN.

15. A device according to claim 14, wherein the device is a customer premise equipment (CPE) router.

16. A device according to claim 14, further comprising:

a third network port configured to communicate with another boundary router coupled to a public data network.