Domain isolation through virtual network machines

• US 8,271,640 B2
• Filed: 11/11/2010
• Issued: 09/18/2012
• Est. Priority Date: 12/24/1998
• Status: Expired due to Term

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Inventors: Salkewicz, William
• Primary Examiner(s): Patel, Chirag R
• Application Number:
  US12/944,600
• Publication Number:
  US 20110060819A1
• Time in Patent Office: 677 Days
• Field of Search: 370/401, 726 2- 6, 726 17- 19, 709217-219, 709/223
• US Class Current: 709/223
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks

Abstract

A method and device for communicating information resources between subscriber end stations and nodes belonging to different network domains is described. The device instantiates different virtual network machines for different network domains using separate independently administrable network databases. Each of the administrable chores of the separate independently administrable network databases includes the assignment of access control and the configuration of the policies for those network databases. The policies include traffic filtering policies to indicate what kind of information payloads can be carried, traffic and route filtering policies to indicate what paths through the network will be used for each payload carried. Each of the network domains includes one of the different virtual network machines and each of the different network domains is virtually isolated from other network domains.

Claims

1. A single network device to act as an intermediate station comprising:

a plurality of transceivers to communicate information resources between subscriber end stations and nodes belonging to different network domains; and

a non-transitory machine-readable medium having stored therein a set of instructions to cause the single network device to, instantiate different virtual network machines for the different network domains,

wherein each of the different virtual network machines is one of a virtual router and a virtual bridge,

wherein each of the different virtual network machines has a separate independently administrable network database,

wherein administrative chores of the separate independently administrable network databases include an assignment of access control and a configuration of policies for the separate independently administrable network databases,

wherein the access control comprises user identifiers such as user names, passwords, and unique keys,

wherein the policies comprise traffic filtering policies to indicate what kind of information payloads can be carried, and traffic and route filtering policies to indicate what paths through the different network domains will be used for each payload carried, and

wherein each of the different network domains is to comprise a plurality of nodes and links that include one of the different virtual network machines, and each of the different network domains is virtually isolated from the other different network domains, and

couple different ones of the subscriber end stations to different ones of the different virtual network machines through dynamic bindings,

communicate information resources of different ones of the subscriber end stations using the virtual network machines to which those subscriber end stations are currently coupled, and

record subscriber activity for accounting.

2. The single network device of claim 1, wherein a same administrative authority may administer more than one of the different network domains.

3. The single network device of claim 1, wherein at least one of the subscriber end stations can be coupled to more than one of the different virtual network machines.

4. The single network device of claim 1, wherein each of the separate independently administrable network databases includes layer 2 addressing, layer 2 connections, bridge filters, layer 3 addressing, layer 3 connections, address translation policies, access policies, routing configuration, and routing protocols.

5. The single network device of claim 1, wherein the policies further comprises:

security policies to ensure integrity of the information payloads.

6. A network comprising:

a plurality of different network domains, wherein each of the different network domains comprises a plurality of nodes and links and each of the different network domains is virtually isolated from other different network domains;

a plurality of subscriber end stations; and

a single network device coupled between nodes of the different network domains and the plurality of subscriber end stations, the single network device having different virtual network machines belonging to the different network domains, wherein each of the different virtual network machines is one of a virtual router and a virtual bridge, wherein different ones of the subscriber end stations are coupled to different ones of the different virtual network machines through dynamic bindings, wherein the different virtual network machines communicate information resources between the subscriber end stations and nodes of the network domain to which that virtual network machine belongs, and wherein the different virtual network machines record subscriber activity, and

separate independently administrable network databases for each of the different virtual network machines,

wherein administrative chores of the separate independently administrable network databases include an assignment of access control and a configuration of policies for the separate independently administrable network databases,

wherein the access control comprises user identifiers such as user names, passwords, and unique keys, and

wherein the policies comprise traffic filtering policies to indicate what kind of information payloads can be carried, and traffic and route filtering policies to indicate what paths through the different network domains will be used for each payload carried.

7. The network of claim 6, wherein a same administrative authority administers more than one of the different network domains.

8. The network of claim 6, wherein at least one of the subscriber end stations can be coupled to more than one of the different virtual network machines.

9. The network of claim 6, wherein each of the separate independently administrable network databases includes layer 2 addressing, layer 2 connections, bridge filters, layer 3 addressing, layer 3 connections, address translation policies, access policies, routing configuration, and routing protocols.

10. The network of claim 6, wherein the policies further comprises:

security policies to ensure integrity of the information payloads.