Virtual network construction method, system, and relaying apparatus

• US 7,660,324 B2
• Filed: 11/19/2001
• Issued: 02/09/2010
• Est. Priority Date: 12/06/2000
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Oguchi, Naoki, Saito, Yuji
• Primary Examiner(s): Sheikh, Ayaz R
• Assistant Examiner(s): LEE, ANDREW CHUNG CHEUNG
• Application Number:
  US09/988,958
• Publication Number:
  US 20020067725A1
• Time in Patent Office: 3,004 Days
• Field of Search: 370/229, 370/230, 370/352, 370/389, 370/392, 370/401, 370/410
• US Class Current: 370/432
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]

Abstract

In a virtual network construction method, a virtual network construction system, and a relaying apparatus within a public data communication network, control packets each having set a multicast address are multicast, and upon reception of the control packets by the relaying apparatuses belonging to the multicast address group, virtual links to the transmitting sources of the control packets are established and reply packets are returned through the virtual links, whereby the virtual links are established between all of the relaying apparatuses belonging to the multicast address group to establish the virtual network.

Claims

1. A virtual private network (VPN) construction system for a public data communication network comprising:

first relaying apparatuses, with one or more virtual routers each of which is associated with a VPN-ID and a multicast address in a table, generating and multicasting control packets each of which contains a source address of each virtual router and is transmitted for the multicast address as a destination address corresponding to the VPN-ID of each virtual router, and

second relaying apparatuses, with one or more virtual routers each of which is associated with a VPN-ID and a multicast address in a table, accepting only the control packets of the multicast address corresponding to the VPN-ID of each virtual router of the second relaying apparatuses, establishing virtual links using the source address in the control packets with the first relaying apparatuses and returning reply packets to the first relaying apparatuses through the virtual links,

whereby the virtual private network is constructed between the virtual routers that are specific to a same multicast address in the first and the second relaying apparatuses, with the virtual links established between all pairs of the virtual routers and with virtual interfaces receiving packets from outside the public data communication network.

2. The virtual private network construction system as claimed in claim 1 wherein the second relaying apparatuses establishing the unicast virtual links authenticate the control packets received.

3. The virtual private network construction system as claimed in claim 1 wherein the unicast virtual links comprise IP tunnels.

4. The virtual private network construction system as claimed in claim 1 wherein the unicast virtual links comprise MPLS tunnels.

5. A relaying apparatus, which terminates virtual private networks (VPNs) within a public data communication network comprising:

virtual routers each of which is associated with a VPN-ID and a multicast address in a table,

a packet unit generating and multicasting control packets each of which contains a source address of each virtual router and is transmitted for the multicast address as a destination address corresponding to the VPN-ID of each virtual router, and

a link unit accepting only the control packets of the multicast address corresponding to the VPN-ID of each virtual router of one or more other relaying apparatuses establishing virtual links using the source address in the control packets with the one or more other relaying apparatuses which are transmitting sources of the control packets and returning reply packets to the one or more other relaying apparatuses through the virtual links,

whereby the virtual private network is constructed between the virtual routers that are specific to a same multicast address, with the virtual links established between all pairs of the virtual routers, and with virtual interfaces receiving packets from outside the public data communication network.

6. The relaying apparatus as claimed in claim 5, further comprising means for authenticating the control packets received.

7. The relaying apparatus as claimed in claim 5, further comprising means for generating a routing table for each of a plurality of virtual networks logically independent of one another, and means for performing a packet relay of each virtual network based on the routing table.

8. The relaying apparatus as claimed in claim 5 wherein the unicast virtual links comprise IP tunnels.

9. The relaying apparatus as claimed in claim 5 wherein the unicast virtual links comprise MPLS tunnels.