Ethernet encryption over resilient virtual private LAN services

• US 7,864,762 B2
• Filed: 02/14/2007
• Issued: 01/04/2011
• Est. Priority Date: 02/14/2007
• Status: Active Grant

• Current Assignee: Certes Networks, Inc.
• Original Assignee: Certes Networks, Inc.
• Inventors: Carrasco, Serge-Paul
• Primary Examiner(s): Shah; Chirag G
• Assistant Examiner(s): NGUYEN, MINH TRANG T
• Application Number:
  US11/706,442
• Publication Number:
  US 20080192739A1
• Time in Patent Office: 1,420 Days
• Field of Search: None
• US Class Current: 370/389
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Encryption of Ethernet/IEEE 802.3 packet data units (PDUs) at the edge of the enterprise network, in such a way as to support resilient Virtual Private LAN Services (VPLS) network designs. The Ethernet traffic is securely tunneled within encrypted Ethernet tunnels from the edge to the edge of the enterprise network. The encrypted Ethernet traffic is also tunneled within Multi-Protocol Layer Switching (MPLS) tunnels from the edge to the edge of the service provider network. The enterprise network thus manages its own Ethernet site-to-site Virtual Private Network (VPN). The service provider thus independently manages its own MPLS network. The result provides a VPLS or Layer 2 MPLS VPN to the enterprise; the enterprise Ethernet encrypted network can thus be considered as an overlay to the MPLS service provider network.

Claims

1. A method for operating on an Ethernet data packet to provide an enterprise networking environment over a service provider network, comprising the steps of:

encrypting the Ethernet data packet according to an Ethernet encryption protocol to form an encrypted Ethernet data packet;

applying a security association policy to the encrypted Ethernet data packet;

applying an MPLS protocol to the encrypted Ethernet data packet to provide a Virtual Private LAN Network (VPLS) service to the enterprise;

forwarding the encrypted Ethernet data packet according to MAC learning and aging functions provided by the VPLS service;

wherein encrypting the Ethernet data packet and applying the security association policy are performed by a Policy Enforcement Point (PEP); and

wherein applying the MPLS protocol and forwarding the encrypted Ethernet data packet are performed by a provider edge router.

2. The method of claim 1, additionally comprising the step of receiving the security association from a network overlay that is responsible for distributing the security policy and the encryption key to the PEPs.

3. The method of claim 2 wherein the network overlay additionally comprises:

a security policy layer; and

an encryption key layer.

4. The method of claim 3 wherein the security policy layer is provided by a Management and Policy (MAP) server and the encryption key layer is provided by a Key Authority Point (KAP) server.

5. The method of claim 4 wherein one outbound encryption key is provided for each PEP site that becomes the inbound encryption key for the other PEP sites.

6. The method of claim 4 further comprising the following steps:

generating one key; and

distributing the same key both for inbound traffic and outbound traffic for each associated PEP.

7. The method of claim 1, further comprising the steps of:

maintaining the original MAC address header in the Ethernet data packet in the clear; and

encrypting the Ethernet payload of the Ethernet data packet.

8. The method of claim 1, further comprising the steps of:

providing resiliency, by connecting two or more CEs to two or more PEs.

9. The method of claim 8 wherein two PEs are controlled by different service providers.

10. The method of claim 8 wherein the method provides for full mesh connectivity between n sites, where n is greater than 2, enterprise sites is provided by only 2 security associations.

11. A system for operating on an Ethernet data packet to provide an enterprise networking environment over a service provider network, the system comprising:

a customer edge (CE) router, located within the enterprise network, configured to provide the Ethernet data packet;

a Policy Enforcement Point (PEP) communicatively coupled to the CE router, the PEP configured to;

encrypt the Ethernet data packet according to an Ethernet encryption protocol to form an encrypted Ethernet data packet; and

apply a security association policy to the encrypted Ethernet data packet;

a provider edge router communicatively coupled to the PEP and located within the service provider network, the provider edge router configured to;

apply an MPLS protocol to the encrypted Ethernet data packet having a security association policy to provide a Virtual Private LAN Network (VPLS) service to the enterprise; and

forward the data packet according to MAC learning and aging functions provided by the VPLS service.

12. The system of claim 11 wherein the PEP is further configured to receive the security association from a network overlay that is responsible for distributing the security policy and the encryption key to the PEPs.

13. The system of claim 12 wherein the network overlay further comprises:

a security policy layer; and

an encryption key layer.

14. The system of claim 13 wherein the security policy layer is provided by a Management and Policy (MAP) server and the encryption key layer is provided by a Key Authority Point (KAP) server.

15. The system of claim 14 wherein one outbound encryption key is provided for each PEP site that becomes the inbound encryption key for the other PEP sites.

16. The system of claim 14 wherein the KAP is configured to:

generate one key; and

distribute the same key both for inbound traffic and outbound traffic for each associated PEP.

17. The system of claim 11 wherein the PEP is further configured to

maintain the original MAC address header in the Ethernet data packet in the clear;

and

encrypt the Ethernet payload of the Ethernet data packet.

18. The system of claim 11, further comprising two or more CEs operable in communication with two or more PEs for providing resiliency.

19. The system of claim 18 wherein two PEs are controlled by different service providers.

20. The system of claim 18 wherein the network includes full mesh connectivity between n sites, where n is greater than 2, enterprise sites is provided by only 2 security associations.