Distributed server functionality for emulated LAN

• US 7,461,157 B2
• Filed: 06/27/2001
• Issued: 12/02/2008
• Est. Priority Date: 06/27/2001
• Status: Expired due to Fees

• Current Assignee: Hyglo Systems AB
• Original Assignee: Hyglo Systems AB
• Inventors: Byström, Leif, Bergkvist, Joakim, Ahlard, David, Hansson, Urban
• Primary Examiner(s): Patel; Haresh N
• Application Number:
  US10/481,978
• Publication Number:
  US 20040205188A1
• Time in Patent Office: 2,715 Days
• Field of Search: 709217-230, 709/238
• US Class Current: 709/228
• CPC Class Codes: H04L 12/1854 with non-centralised forwarding system, e.g. chaincast
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272

Abstract

A system for emulating a local network on top of a global communication network that includes Local Area Network (LAN) LAN Emulating clients units (LEC) and a LAN Emulating server (LES) which are connected to the global network, and a Broadcast and Unknown Server (BUS) functionality for relaying messages to all clients in the emulated local area network. The system is characterized in that the broadcast functionality is distributed and implemented in more than one network unit node in the emulated local area network. The global network is preferably an IP network, such as the Internet, and act as a backbone for the emulated local area network.

Claims

1. A system for emulating a local area network connected to a global communication network, acting as a backbone network comprising clients units and a server which are connected to said global network, and a broadcast functionality (BUS) for relaying messages to all clients in the emulated local area network, wherein said BUS functionality is distributed and implemented in more than one network unit node in the emulated local area network, wherein said system also is used for establishment of one or several Virtual Private Network (VPN) connections, the system comprising an end user client device and a VPN access server communicatively connected to the end user client via said global network, wherein a standalone VPN client device is interconnecting the end user client with said global network,

wherein said VPN client comprising monitoring means for monitoring all traffic between the end user client and the VPN server;

wherein said monitoring means are devised to detect when a handshake agreement is established between the end user client and the VPN server;

wherein said monitoring means are devised to determine said handshake agreement for the initialisation phase of said VPN access acquiring session as completed upon detecting that said server acknowledges said end user client as a confirmed user; and

wherein said VPN client is devised to request, upon detection of a completed handshake and execution of said VPN setup session overtake, said server to distribute VPN configuring data relevant for the inclusion of said end user client into said virtual private network.

3. The system as recited in claim 1, wherein the connections between the nodes of the emulated local area network are implemented as a multicast network transmitted through the global network.

4. The system as recited in claim 1, wherein the connections between the nodes of the emulated local area network are implemented as single-cast addresses, forming tunnels through said global network.

5. The system as recited in claim 1, wherein each network unit having a distributed broadcasting functionality comprises means for executing an algorithm for preventing broadcast messages from being indefinitely sent between the network unit nodes having the distributed broadcasting functionality.

6. The system as recited in claim 5, wherein said algorithm is based on a checksum of the broadcast message, which checksum uniquely identifies the broadcast packet and is cached by the broadcasting functionality for the purpose of dropping subsequently arriving broadcast packets having the same checksum.

7. The system as recited in claim 5, wherein said algorithm is based on a hop counter which is decremented by each broadcasting functionality unit upon arrival, said algorithm functioning to drop subsequent incoming packets when the counter has reached zero.

8. The system as recited in claim 1, wherein an example of is an Internet Protocol network.

9. The system as recited in claim 1, wherein said end user client comprising initiating means for initiating a communication session with the VPN server in order to acquire access to a VPN provided by the VPN server.

10. The system as recited in claim 1, wherein said VPN client is devised to act passive, and act as a third-party with regards to the two-party communication session between said end user client and said VPN server.

11. The system as recited in claim 1, wherein said VPN client comprises session overtaking means, devised to overtake a VPN access acquiring session for said end user client upon detection of said handshake agreement.

12. The system as recited in claim 1, wherein the end unit client side of the VPN client is defined as a secure domain, and the Internet and server side of the VPN client is defined as an insecure domain, said VPN client being devised only to accept a request for a VPN session access acquirement when initialized from said secure domain.

13. The system as recited in claim 1, wherein said VPN client is devised to form during the said overtaken VPN set-up session, secure associations between the VPN client and said VPN server by distributing one or many security keys/credentials to the VPN server, e.g. a public key specific for the VPN client itself, and receiving the. VP.N configuration data in forms of one or many security keys/credentials from the VPN server, e.g. a public key specific for the VPN server.

14. The system as recited in claim 1, wherein said VPN cleint is devised to undertake a proxy roll, comprising means for acting as a VPN server proxy towards the end user cleint, and means for acting as an end user client proxy towards the VPN server.

15. The system as recited in claim 1, wherein said server initially is configured with predetermined performance criteria, and wherein said server defines which clients units has an up and running BUS functionality based on predetermined performance criteria.

2. The system as recited in ciaim 1, wherein a master and initial broadcast functionality unit is configured in said server.