Dynamic firewall and dynamic host configuration protocol configuration

• US 8,752,160 B1
• Filed: 09/13/2012
• Issued: 06/10/2014
• Est. Priority Date: 11/13/2008
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Delker, Jason R., Everson, John M., Norris, James W., Ross, Carol A., Whitney, Jason K.
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): GRACIA, GARY S
• Application Number:
  US13/612,830
• Time in Patent Office: 635 Days
• Field of Search: None
• US Class Current: 726/11
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A system is provided comprising a computer system and a dynamic network interfaces application that executes on the computer system. The dynamic network interfaces application activates a virtual local area network (VLAN) by associating subnet interface information and a virtual local area network tag, wherein the virtual local area network tag is unrelated to and randomly combined with the subnet interface information, and by transmitting the association of the subnet interface information and the virtual local area network tag to a firewall component and to a network access component.

Claims

1. A dynamic network interfaces system, comprising:

an at least one computer system; and

a dynamic network interfaces application that, when executed on the at least one computer system;

determines that a client device requesting a network service is a member of a group, wherein members of the group are associated with a single virtual local area network tag,

determines that the client device is the first member of the group to request access to the network service,

obtains subnet interface information from a subnet interface pool and the virtual local area network tag from a virtual local area network tag pool, wherein the virtual local area network tag is randomly selected from the virtual local area network tag pool and is unrelated to, and randomly combined with, the subnet interface information,

sends to an access device and a firewall device the subnet interface information from the subnet interface pool, the virtual local area network tag from the virtual local area network tag pool, physical interface designations, and instructions to configure a subnet interface using the subnet interface information and the virtual local area network tag and associate the subnet interface with the designated physical interfaces on the access device and the firewall device to provision a virtual local area network,

activates the virtual local area network in response to receiving at least one message from the access device and the firewall device indicating that the subnet interface has been configured on each device and associated with the virtual local area network tag and the designated physical interfaces.

2. The system of claim 1, further comprising a configuration database comprising the subnet interface pool and the virtual local area network tag pool, wherein the dynamic network interfaces application associates the subnet interface information and the virtual local area network tag by randomly selecting the subnet interface information from the subnet interface pool.

3. The system of claim 2, wherein the dynamic network interfaces application deactivates the virtual local area network and returns the virtual local area network tag and the subnet interface information to the configuration database a predefined time delay after the deactivation.

4. The system of claim 3, wherein the predefined time delay is about one hour.

5. The system of claim 1, wherein the dynamic network interfaces application activates a second virtual local area network (VLAN) by associating a second subnet interface information obtained from the subnet interface pool and a second virtual local area network tag obtained from the virtual local area network tag pool, wherein the second virtual local area network tag is randomly selected from the virtual local area network tag pool and is unrelated to and randomly combined with the second subnet interface information, and by transmitting the association of the second subnet interface information and the second virtual local area network tag to the firewall component and to a second access device, wherein the second access device is different from the access device.

6. The system of claim 1, wherein the dynamic network interfaces application activates the virtual local area network in response to receiving a message from the access device containing a request to authenticate the client device accessing the network service, and wherein the dynamic network interfaces application further transmits the association of the subnet interface information and the virtual local area network tag to the client device.

7. The system of claim 6, wherein the dynamic network interfaces application analyzes the request to authenticate the client device and determines that a policy requires the client device to be associated with the virtual local area network to access the network service.

8. The system of claim 1, wherein the dynamic network interfaces application sends the subnet interface information, the virtual local area network tag, the physical interface designations, and the instructions to the firewall component and to the access device using a messaging framework associated with one of a dynamic host configuration protocol and a simple network management protocol.

9. A method of dynamically provisioning virtual local area networks, comprising:

obtaining, by a server, a first subnet interface information from a subnet interface pool in a configuration database and a first virtual local area network tag from a virtual local area network tag pool in the configuration database, wherein the first virtual local area network tag is randomly selected from the virtual local area network tag pool and is unrelated to, and randomly combined with, the first subnet interface information;

provisioning, by a server, a first virtual local area network by transmitting the first subnet interface information and the first virtual local area network tag to a firewall device and to a first access device;

obtaining, by a server, a second subnet interface information from the subnet interface pool in the configuration database and a second virtual local area network tag from the virtual local area network tag pool in the configuration database, wherein the second virtual local area network tag is randomly selected from the virtual local area network tag pool and is unrelated to, and randomly combined with, the second subnet interface information;

provisioning, by a server, a second virtual local area network by transmitting the second subnet interface information and the second virtual local area network tag to the firewall device and to a second access device.

10. The method of claim 9, further comprising transmitting the first subnet interface information and the first virtual local area network tag to a client device, wherein the client device is one of a mobile telephone, personal digital assistant, laptop computer, tablet computer, desktop computer, set-top box, media player, Voice over Internet Protocol desk set, printer, data appliance, camera, webcam, and femtocell.

11. The method of claim 9, wherein provisioning the first virtual local area network is triggered by a first client device requesting a network service to the first access device, and wherein provisioning the second virtual area network is triggered by a second client device requesting a network service to the second access device.

12. The method of claim 11, further comprising determining that a policy requires the first client device to be associated with a virtual local area network to access the network service.

13. The method of claim 9, wherein transmitting the first subnet interface information and the first virtual local area network tag to the firewall device and to the first access device is performed using a messaging framework that is associated with one of a dynamic host configuration protocol and a simple network management protocol.

14. The method of claim 9, wherein the first access device provides notice when the first virtual local area network is terminating and the first virtual local area network tag and accompanying first subnet interface information are returned to their respective pools and are made available for future use.

15. The method of claim 14, wherein the first virtual local area network tag and accompanying first subnet interface information are returned to their respective pools after a time delay.

16. A method of dynamically provisioning a virtual local area network, comprising:

determining, by a server, that a client device requesting a network service is a member of a group wherein members of the group are associated with a single virtual local area network tag;

determining, by a server, that the client device is the first member of the group to request access to the network service;

obtaining, by a server, subnet interface information from a subnet interface pool and the virtual local area network tag from a virtual local area network tag pool, wherein the virtual local area network tag is randomly selected from the virtual local area network tag pool and is unrelated to, and randomly combined with, the subnet interface information,

sending, by a server, to an access device and a firewall device the subnet interface information from the subnet interface pool, the virtual local area network tag from the virtual local area network tag pool, physical interface designations, and instructions to configure a subnet interface using the subnet interface information and the virtual local area network tag and associate the subnet interface with the designated physical interfaces on the access device and the firewall device to provision the virtual local area network, and

activating, by a server, the virtual local area network in response to receiving at least one message from the access device and the firewall device indicating that the subnet interface has been configured on each device and associated with the virtual local area network tag and the designated physical interfaces.

17. The method of claim 16, further comprising:

determining, by a server, that a second client device requesting network service is a member of the group;

determining, by a server, that the second client device is not the first member of the group to request access to the network service; and

joining the second client device to the existing virtual local area network designated for the group.

18. The method of claim 17, wherein the client device and the second client device reach the access device from one of a code division multiple access evolution-data optimized, code division multiple access radio transmission technology, Institute of Electrical and Electronics Engineers 802.1Q, Worldwide Interoperability for Microwave Access, digital subscriber line, and global system for mobile communications high-speed downlink packet access network, and wherein the client device uses a different access network type to join the virtual local area network than the access network type used by the second client device to join the virtual local area network.

19. The method of claim 16, wherein the subnet interface information and virtual local area network tag are made available for reuse shortly after a last member of the group disconnects from the session.