Methods and systems for enabling communication between a processor and a network operations center

• US 20020026531A1
• Filed: 04/11/2001
• Published: 02/28/2002
• Est. Priority Date: 04/12/2000
• Status: Active Grant

• Current Assignee: Oracle Systems Corporation (Oracle Corporation)
• Original Assignee: Corente, Inc. (Oracle Corporation)
• Inventors: Harris, Michael J., Macey, Christopher, Keane, John, Brutman, Neil R.
• Granted Patent: US 7,085,854 B2
• Time in Patent Office: Days
• US Class Current: 709/250
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0897 by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

Methods and systems are provided for enabling a virtual network between a first processor and a second processor using at least one additional processor separate from the first and second processors. The additional processor may determine a first virtual address that identifies the first processor in the virtual network and provide the first virtual address to the first processor. When a tunnel between the first processor and the second processor is requested from the additional processor, the additional processor may authenticate the request based on the first virtual address and determine a second virtual address that identifies the second processor in the virtual network. After the additional processor authenticates the request and determines that the first and second processors have indicated a mutual consent for enabling one or more tunnels between the first and second processors, the additional processor may provide the second virtual address to the first processor to enable the requested tunnel between the first and second processors. filed Apr. 11, 2001, Attorney Docket No. 07937-0002-09, all of which are expressly incorporated herein by reference in their entirety and concurrently filed herewith the present application.

Claims

1. A method for enabling a virtual network between a first processor and a second processor using at least one additional processor separate from the first and second processors, said method comprising the steps of:

determining, at the at least one additional processor, a first virtual address that identifies the first processor in the virtual network;

providing the determined first virtual address to the first processor;

requesting, from the at least one additional processor, a tunnel between the first processor and the second processor;

authenticating, at the at least one additional processor, the request based on the first virtual address;

determining, at the at least one additional processor, a second virtual address that identifies the second processor in the virtual network; and

providing the second virtual address to the first processor to enable the requested tunnel between the first and second processors, when the at least one additional processor authenticates the request and determines that the first and second processors have indicated a mutual consent for enabling one or more tunnels between the first and second processors.

2. The method of claim 1, further comprising the steps of:

establishing at least one of the enabled tunnels between the first and second processors based on the provided first and second virtual addresses;

requesting, from the at least one additional processor, a modification to the at least one established tunnel between the first and second processors;

determining, at the at least one additional processor, at least one command for performing the requested modification;

providing the at least one command to the first processor; and

executing, at the first processor, the at least one command to perform the requested modification to the at least one established tunnel.

3. The method of claim 2, further comprising the steps of:

determining, at the at least one additional processor and based on the requested modification, information for routing one or more packets through the at least one established tunnel.

4. The method of claim 3, further comprising the step of:

providing, to the first processor, the determined information such that the first processor routes one or more packets through the at least one established tunnel based on the determined information.

5. The method of claim 1, further comprising the steps of:

establishing at least one enabled tunnel between the first and second processors based on the provided first and second virtual addresses;

receiving information indicating performance of the at least one established tunnel between the first and second processors; and

providing the received information to the at least one additional processor such that performance of the at least one established tunnel is monitored at the at least one additional processor.

6. The method of claim 5, wherein the step of receiving information indicating performance of the at least one established tunnel comprises the step of:

receiving information indicating a latency of one or more packets flowing through the at least one established tunnel.

7. The method of claim 5, wherein the step of receiving information indicating performance of the at least one established tunnel comprises the step of:

receiving information indicating a bandwidth of the at least one established tunnel.

8. The method of claim 1, wherein the step of determining the first virtual address comprises the steps of:

determining, for the first processor, an address that is routable in a base network interfacing the first and second processors; and

determining the first virtual address based on the address that is routable in the base network.

9. The method of claim 8, wherein the step of determining the first virtual address based on the address that is routable in the base network comprises the steps of:

selecting a portion of the address that is routable in the base network; and

determining the first virtual address such that the first virtual address includes the selected portion.

10. The method of claim 8, further comprising the step of:

establishing at least one of the enabled tunnels through the base network interfacing the first and second processors based on the provided first and second virtual addresses.

11. The method of claim 10, wherein the step of determining the second virtual address establishing at least one of the enabled tunnels through the base network comprises the steps of:

determining, for the second processor, a base address that is routable in the base network interfacing the first and second processors; and

determining the second virtual address based on the base address; and

establishing the at least one of the established tunnels based on the determined base address.

12. The method of claim 8, further comprising the step of:

establishing the one or more enabled tunnels through the base network based on the provided first and second virtual addresses.

13. The method of claim 1, wherein the step of determining the first virtual address comprises the step of:

determining the first virtual address based on a predetermined range of addresses.

14. The method of claim 1, wherein the step of requesting the tunnel from the first processor to the second processor comprises the step of:

providing, to the at least one additional processor, a name identifying the second processor.

15. The method of claim 14, wherein the step of determining the second virtual address that identifies the second processor comprises the step of:

determining, at the at least one additional processor, the second virtual address based on the provided name identifying the second processor.

16. The method of claim 1, further comprising the steps of:

determining, at the at least one additional processor, a key unique to the first processor and the at least one additional processor for encrypting information when the first processor and the at least one additional processor communicate with each other; and

providing the key to the first processor

17. A system for enabling a virtual network between a first processor and a second processor using at least one additional processor separate from the first and second processors, said system comprising:

a tunneling interface that receives a request for a tunnel between the first processor and the second processor; and

a controller that determines a first virtual address that identifies the first processor in the virtual network, provides the determined first virtual address to the first processor, authenticates the request based on the first virtual address, determines a second virtual address that identifies the second processor in the virtual network, and provides the second virtual address to the first processor to enable the requested tunnel between the first and second processors, when the controller authenticates the request and determines that the first and second processors have indicated a mutual consent for enabling one or more tunnels between the first and second processors.

18. An apparatus for enabling a virtual network between a first processor and a second processor using at least one additional processor separate from the first and second processors, said apparatus comprising:

means for determining, at the at least one additional processor, a first virtual address that identifies the first processor in the virtual network;

means for providing the determined first virtual address to the first processor;

means for requesting, from the at least one additional processor, a tunnel between the first processor and the second processor;

means for authenticating, at the least one additional processor, the request based on the first virtual address;

means for determining, at the at least one additional processor, a second virtual address that identifies the second processor in the virtual network; and

means for providing the second virtual address to the first processor to enable the requested tunnel between the first and second processors, when the at least one additional processor authenticates the request and determines that the first and second processors have indicated a mutual consent for enabling one or more tunnels between the first and second processors.

19. A computer program product for enabling a virtual network between a first processor and a second processor using at least one additional processor separate from the first and second processors, said computer program product comprising code, said code comprising:

code for determining, at the at least one additional processor, a first virtual address that identifies the first processor in the virtual network;

code for providing the determined first virtual address to the first processor;

code for requesting, from the at least one additional processor, a tunnel between the first processor and the second processor;

code for authenticating, at the least one additional processor, the request based on the first virtual address;

code for determining, at the at least one additional processor, a second virtual address that identifies the second processor in the virtual network; and

code for providing the second virtual address to the first processor to enable the requested tunnel between the first and second processors, when the at least one additional processor authenticates the request and determines that the first and second processors have indicated a mutual consent for enabling one or more tunnels between the first and second processors.