Broadband access for virtual private networks

• US 8,520,681 B2
• Filed: 07/06/2012
• Issued: 08/27/2013
• Est. Priority Date: 07/29/2003
• Status: Expired due to Term

• Current Assignee: Marlow Technologies, Llc
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chen, Weijing, Allen, Keith Joseph
• Primary Examiner(s): Lai, Andrew
• Assistant Examiner(s): LEE, ANDREW CHUNG CHEUNG
• Application Number:
  US13/542,724
• Publication Number:
  US 20120281701A1
• Time in Patent Office: 417 Days
• Field of Search: 370/352, 370/353, 370/354, 370/389, 370/391, 370/392, 370/393, 370/400, 370/401, 370/395.5, 370/395.63
• US Class Current: 370/392
• CPC Class Codes: H04L 12/46 Interconnection of networks
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 49/354 for supporting virtual local area networks [VLAN]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/611 for multicast or broadcast systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method for communicating between a source and a destination in a service provider internet protocol network includes receiving, at an egress edge device from an ingress edge device on the service provider internet protocol network, an upper layer packet comprising data received in turn from the source and encapsulated in accordance with a service provider format into the upper layer packet. The upper layer packet includes a virtual private network identification identifying a destination. The method also includes authenticating the upper layer packet at the egress edge device using the virtual private network identification. Upon authentication, the upper layer packet is decapsulated into a lower layer packet for the destination.

Claims

1. A method for communicating between a source and a destination in a service provider internet protocol network, comprising:

receiving, at an egress edge device from an ingress edge device on the service provider internet protocol network, an upper layer packet comprising data received in turn from the source and encapsulated in accordance with a service provider format into the upper layer packet, the upper layer packet including a virtual private network identification identifying a destination;

authenticating the upper layer packet at the egress edge device using the virtual private network identification by matching the virtual private network identification against an expectation for the upper layer packet; and

upon authentication, decapsulating the upper layer packet into a lower layer packet for the destination.

2. The method according to claim 1,

wherein the egress edge device is a router.

3. The method according to claim 1,

wherein the virtual private network identification distinguishes upper layer packets originated by the source from other upper layer packets in the service provider internet protocol network but not from the source.

4. The method according to claim 1,

wherein the upper layer packet is received at multicast addresses determined by the service provider internet protocol network and including an address of the egress edge device when the destination is not mapped specifically to the egress edge device.

5. The method according to claim 1,

wherein the upper layer packet is received at an address of the egress edge device but not at other egress edge devices of the service provider internet protocol network when the destination is mapped specifically to the egress edge device.

6. The method according to claim 1, further comprising:

verifying a secured network identifier corresponding to a secured network to which the source and the destination belong.

7. The method according to claim 6, further comprising:

transmitting a decapsulated packet to the destination when the secured network identifier is verified.

8. The method according to claim 6, further comprising:

discarding the upper layer packet when the secured network identifier is not identified.

9. The method according to claim 1,

wherein the destination accesses an upper layer device to which the upper layer packet is delivered via a broadband access link.

10. The method according to claim 1,

wherein the destination accesses an upper layer device to which the upper layer packet is delivered via a digital subscriber line.

11. The method according to claim 9,

wherein the upper layer device comprises a digital subscriber line access multiplexer.

12. The method according to claim 9,

wherein the upper layer device comprises an asynchronous transfer mode edge switch.

13. The method according to claim 9,

wherein the upper layer device comprises an interworking function device.

14. The method according to claim 9,

wherein the broadband access link comprises one a digital cable.

15. The method according to claim 1,

wherein the service provider internet protocol network comprises gateways, and

wherein each of the gateways comprises a plurality of line interfaces.

16. The method according to claim 15,

wherein the destination corresponds to one of the plurality of line interfaces.

17. The method according to claim 15,

wherein the destination corresponds to more than one of the plurality of line interfaces.

18. The method according to claim 15,

wherein each of the plurality of line interfaces are associated with a virtual learning device, and

wherein the virtual learning device caches a mapping of the destination to at least one corresponding line interface.

19. A system for communicating between a source and a destination in a service provider internet protocol network, comprising:

a receiver at an egress edge device that receives, from an ingress edge device on the service provider internet protocol network, an upper layer packet comprising data received in turn from the source and encapsulated in accordance with a service provider format into the upper layer packet, the upper layer packet including a virtual private network identification identifying a destination; and

a decapsulator at the egress edge device that authenticates the upper layer packet using the virtual private network identification by matching the virtual private network identification against an expectation for the upper layer packet and, upon authentication, decapsulates the upper layer packet into a lower layer packet for the destination.

20. A non-transitory computer readable medium comprising a set of instructions for communicating between a source and a destination in a service provider internet protocol network, the set of instructions directing at least one processor to perform acts of:

receiving, at an egress edge device from an ingress edge device on the service provider internet protocol network, an upper layer packet comprising data received in turn from the source and encapsulated in accordance with a service provider format into the upper layer packet, the upper layer packet including a virtual private network identification identifying a destination;

authenticating the upper layer packet at the egress edge device using the virtual private network identification by matching the virtual private network identification against an expectation for the upper layer packet; and

upon authentication, decapsulating the upper layer packet into a lower layer packet for the destination.