Method and system for managing multiple networks over a set of ports

A system has a switch that allows virtual private networks to be created dynamically. The system includes at least one network. The system also includes a computer having an address. The system also includes a plurality of ports for coupling to the computer. The system also includes a switch that assigns one of the plurality of ports to a private network according to the address of the computer. The switch assigns the port by correlating the address with an address list.

TECHNICAL FIELD

The present invention is directed to networks for exchanging information. More specifically, the present invention is directed to networks of computers that exchange information in a secure and efficient manner over a set of ports.

BACKGROUND OF THE INVENTION

As home computers and portable laptops become common, so do problems arising from using shared resources to access information over networks outside the home or office. Individuals having separate computers require access to different networks and need a secure line to exchange information. For example, one person may work for company A, and another person may work for company B. Both people desire to work via their laptops from the same physical location, such as the home or office. To work, the first person must access company A's network from a port, such as a telephone jack in the home. The second person needs to access company B's network from another port as well. Though using different ports, both people use the same physical resources to access their networks.

Local-area-network technology, such as shared Ethernet, is easy to use but is inconvenient if access to multiple separate networks is required. For each network, a set of wires is run to each room, or location, for using the network. Thus, one location may be wired for one network, while a second network is wired to another location. The users of these networks are constrained physically by the locations of the wires. Further, if outside internet access is desired, another set of wires is placed in those locations as well. Each room is separately wired.

If the network access requirements change, the wires must be physically modified to accept the new network or to remove the old one. These procedures are inconvenient for locations that are dynamic in their network requirements, such as office spaces or personal residences.

To avoid security violations and to keep network communications separate, switched as opposed to shared-Ethernet can be utilized. A switched Ethernet operates to keep virtual local area networks (“VLANs”) separate.

Assignment of a port to a VLAN is performed by a network administrator. From an individual user's perspective, however, the situation is the same as in the case of a shared Ethernet.

Attempts to make network access more dynamic or accessible result in increased costs or physical demands. Telephone jacks connected to a telephone network are one such attempt to provide better network access. A user can plug in to a telephone line anywhere in an office or house and access their network of choice. The user, however, now has exclusive use of the telephone line, and other users are prevented from using the same telephone line. Hence, to access multiple networks, additional telephone lines must be placed at each location, increasing the cost of maintaining each telephone line and installing additional telephone ports in each location. Yet another deficiency is speed since telephone lines, unlike broadband network connections, do not support high bandwidth for efficient and timely network access.

Another attempt to provide better network access is by placing special software on the personal computers that connect to the networks. The special software would provide encryption capabilities to communicate to the network from a wire location. However, the software consumes memory space on the computer and would have to be executed prior to accessing the network. Further, special decryption programs would have to run at the network's server to accept the encrypted information. From the user's standpoint it is difficult simultaneously execute security software and general application on the same personal computer.

None of these attempts provide a network configuration that is dynamic and not physically constrained. The above-enumerated systems do not allow a user to move from one location to another, creating and extinguishing networks as they are needed, or secure access to networks that prevent unauthorized access without undue physical requirements.

SUMMARY OF THE INVENTION

In one embodiment, the present invention provides a system which uses a switch to manage multiple virtual networks over a set of ports. The system includes at least one network and a computer having an address. The system may also include a plurality of ports for receiving the computer and a switch that assigns one of the plurality of ports to a private network according to the address of the computer. The switch assigns the port by correlating the address with an address list residing in the memory of the system.

The present invention also relates to a method for communicating over a network from a plurality of ports wherein a computer coupled to a port issues a data packet containing the computer's address, thereupon a switch connected to a address table determines which network is accessible by the computer and assigning the network to the port coupled to the computer.

DETAILED DESCRIPTION

One embodiment of the present invention is a system that uses a switch to manage multiple virtual networks over a set of ports. The system includes a connection to a network. The system also includes a computer having an address. The system also includes a plurality of ports for receiving the computer. The system also includes a switch that assigns one of the plurality of ports to a network according to the address of the computer. The switch assigns the port by correlating the address with an address list.

FIG. 1depicts a system100for managing multiple networks over a set of ports in accordance with an embodiment of the present invention. System100delivers information to computers and ports at different locations, such as a home or office. System100also allows information to be exchanged with networks and systems outside the locations. Broadband connection104carries the information and data to the location. Preferably, broadband connection104is a coaxial cable plugged into a modem106. Broadband connection104is connected to a cable service, or any service that exchanges data at a high speed (for example, at least 1 megabit per second). Modem106is a cable modem that enables Ethernet hub108to connect with the local cable television line via broadband connection104.

Ethernet hub108supports an Ethernet configuration, or network, for the location that uses system100. Ethernet hub108is the central point of connection for the wires from ports and nodes at the locations. Ethernet hub108receives information from modem106and sends it to the other ports. Ethernet hub108also receives and sends information to external systems, such virtual private networks (“VPNs”). Ethernet hub108also connects to virtual private network gateways such as one for virtual local area network A (“VLAN A”)110and virtual local area network B (“VLAN B”)120. Not every network connected to Ethernet hub108has to be a private network. Other connections might include shared resources128, comprised of printers, fax machines, or any devices for common use by the users of the networks connected to Ethernet hub108.

VLAN A gateway110is an encrypting gateway of a type known in the art. Text packets are received on private Ethernet port114, encrypted, and sent out on Ethernet port112. The terms private and wild are used to distinguish between the protected and unprotected sides of the gateway. The encrypted packets are received by Ethernet hub108for transmission by modem106. The packets will be received by a matching gateway established by the administrators of a network corresponding to virtual private network A (not shown).

Similarly, VLAN B gateway120is an encrypting gateway that receives cleartext packets on private port124, encrypts them, and sends them out on wild port122. The encrypted packets are likewise received by Ethernet hub108for transmission by modem106. They will be received by a matching gateway established by the administrators of A corresponding virtual private network B (not shown).

As opposed to a shared medium, switch130provides a switched architecture between ports within system100. Ports are grouped together into VLANs. The VLAN that includes port131is referred to as VLAN A. Port131, by virtue of its connection to private port114on gateway110, is connected to VLAN A for this reason. Likewise, port133belongs to VLAN B. Port135is connected directly to hub108. The VLAN that includes port135does not correspond to any external VPN, and is called the dirty VLAN.

Switch130also is connected to ports136,138,140and142. Ports136,138,140and142are in different rooms or physical locations within the house or office of system100. The ports allow a user to connect a computer, such as a laptop or other personal computer (“PC”), to switch130to access the networks connected at ports131and133. For example, PC150(also identified as PC1) and PC156(also identified as PC2) may connect to ports136and140, respectively. PC150and port136can be in one room or location, while PC156and port140are in another. PC150includes Media Access Control (“MAC”) address152and PC156includes MAC address158. MAC addresses152and158are unique hardware numbers correlating to their respective computers. In this embodiment, the MAC addresses are the Ethernet addresses for their respective computers. The MAC address of a computer will uniquely distinguish that computer from all others when connected to system100.

As PCs connect to a port, a VLAN is assigned to this port by switch130based upon the MAC address of the computer. In this manner, switch130may dynamically add and delete ports on VLANs as they are needed. Switch130includes switch fabric134, which is the internal wiring that connects VLANs to the individual ports. Each port has its own wire connecting to switch130.

An address table132is stored at switch130and has the MAC addresses of the computers that may connect to switch130. Address table132may be a file with data for each address. Each MAC address within address table132may correlate to a virtual private network (“VPN”) accessible to the PC with the MAC address. Address table132is dynamic in that it may be changed or updated. MAC addresses may be added or deleted as users change.

Switch130executes a serially monogamous protocol that ensures that a PC connected to a port always is connected to the correct VPN. For example, PC150has a MAC address152that correlates to VPN A. When switch130first receives a packet from PC150, switch130will extract MAC address152from the packet header, and will look up MAC address152in address table132. Then, switch130will assign port136to VLAN A, as described above. If the user of PC150disconnects from port136and moves to port138, then switch130will disconnect port136from VLAN A and assign port138to VLAN A. Subsequently, the user of PC156, whose MAC address158correlates to VPN B, may connect to port136. Switch130will assign port136to VLAN B.

FIG. 2depicts a switch exchanging information to a set of ports in accordance with an embodiment of the present invention. Switch130corresponds to switch130inFIG. 1. Switch130is connected to a plurality of private networks and Ethernet hub108receives information and data from these networks when accessed by a user. Switch130also is connected to a set of ports in different physical locations. For example, location202inFIG. 2is a first location having ports connected to switch130, and location204is a second location having ports connected to switch130. Location202includes ports222and226. Location204includes ports228and230. Locations202and204may be rooms within a house that have the ports in the rooms. Alternatively, locations202and204may be any area that has a set of ports located in it, such as a cubicle within a workplace or an office. Locations202and204also may not be limited physically and only may be distinguishable in that they define a group of ports.

Ports222,224and226are connected to switch130by wires that may have different colors. The different colors enable users to distinguish the ports from each other. For example, port222may connect with a red wire, depicted as “R” inFIG. 2. Ports224and226may connect with yellow and blue wires, respectively. Preferably, the wires are not materially distinct from each other. The different colors would help in visually showing how the wires are routed. Alternatively, the wires might be different in bandwidth specifications or other performance capabilities. Location204has ports228and230that are connected with red and blue wires, respectively. Thus, all wiring that runs to switch130terminates on separate ports.

Through the wires to the ports in locations202and204, switch130exchanges information and data between the PCs and the VLANs coupled to switch130. Users couple their PCs to the ports, which are connected to switch130by their wires. For example, location202might have two users using PC210and PC214. PC210has MAC address212. PC214may include MAC address216. Addresses212and216may identify their respective PCs to switch130. According toFIG. 2, the user of PC210desires to connect to port222. After PC210is connected, it sends a discover packet232to switch130to connect to a VLAN coupled to switch130. Discover packet232contains information about PC210, including address212. Switch130receives discover packet232and looks up address212within the address table132, as depicted inFIG. 1. Address212correlates to an Internet Protocol (“IP”) address for one of the private networks coupled to switch130. Address212determines the VLAN to be assigned to port222to support PC210, according to address table132. Switch130assigns the VLAN to port222and begins to send information, such as data packet234, to PC210. In an exemplary embodiment, data packet234may be from VLAN A. Thus, the user of PC210can use VLAN A to work and exchange data. In another embodiment not shown inFIG. 2, VLAN A may correspond to external VPN A.

Other users may connect to other ports and connect to other virtual private networks. The user of PC214sends address216to switch130. Address216correlates to VLAN B, and VLAN B may be assigned to port226. Data packet236is sent to PC214with information from VLAN B. In location204, the user of PC218connects to port230. PC218sends a discover packet with address220to switch130. Address220identifies VLAN A as the network supporting PC218. Thus, switch130may assign VLAN A to port230. Therefore, according to the embodiment described above, switch130can configure virtual private networks dynamically by assigning the networks to ports as users having PCs connect to the ports. Ports are not hard wired to specific networks and users may not be limited to specific locations. Thus, ports may have one of the following states: dead, alive and assigned to a VLAN, and alive and unassigned (“dirty”). A dead port may be unable to support any networks.

Further, the embodiment of the present invention depicted inFIG. 2may allow a user to disconnect from a port and reconnect to another port. Thus, the VLAN connection is torn down and reconnected elsewhere. For example, the user of PC210may wish to go to location204and reconnect to VLAN A. PC210is disconnected from port222. Switch130detects that PC210is disconnected and terminates VLAN A's connection to port222. This termination prevents access to the external VPN after the user of PC210is finished. Thus, the embodiment of the present invention can prevent accidental or unauthorized access to a VLAN as a result of a user disconnecting from a port and another user connecting thereto. The user of PC210can then connect to the network through location204and port228. After the connecting to port228, switch120assigns VLAN A to port228, thus changing the VLAN configuration. Therefore, the configuration of the networks through switch130depends on the MAC addresses seen on the ports.

If switch130receives a discover packet containing an unknown MAC address, then switch130may act in a number of different ways. Service may be denied completely. Switch130may attempt to connect an appropriate VLAN by eliciting additional information from the user. This information may or may not be stored permanently in address table132. The user may be assigned to the “dirty” VLAN, such as port135depicted inFIG. 1. In addition, switch130may consider connection to multiple VPNs, but might require the user to provide additional information, such as selecting the network to be assigned to the port.

As depicted inFIG. 2, ports224and228are not assigned to any virtual private networks. These ports are assigned to “dirty” local area networks by default. By being assigned to dirty VLANs, these ports will not receive any data packets from existing VLANs set up by switch130. Instead, ports224and228will have direct access to modem106through port135and hub108, as depicted inFIG. 1.

FIG. 3depicts a flowchart of a method for managing multiple networks over a set of ports in accordance with an embodiment of the present invention. Step300is the start of the method. Step302executes by switch130determining the port status for the wired ports. As discussed above, ports may be dead, assigned or dirty. Step304executes by connecting a PC with a MAC address to a port wired to switch130. For example, referring back toFIG. 2, PC210with address212connects to port222. Step306executes by determining whether the port is already assigned to a VLAN. An assigned port may be accessed only by a PC belonging to the same VLAN. If the answer at step306is no, then step308is executed by receiving discover packet232at switch130. Switch130receives address212of PC210with discover packet232. If the answer at step306is yes, then step320is executed by noting an error has occurred and that further steps are to be taken to correct the error. For example, an alarm may be raised that a security violation has occurred.

Step310executes by switch130finding a private network that matches the address received in step308. Switch130queries address table132to determine the proper VLAN to establish and assign to the port. Using the example described above, address table132would contain a list that shows network A matching address212. Step312executes by assigning the VLAN found in step310to the port. Port222is assigned VLAN A. Step314executes by allowing the user to perform operations and receive information from the assigned VLAN, and corresponding VPN, through the port and switch130. PC210receives and sends information to VLAN A via port222. Step316executes by the user disconnecting the PC from the port to terminate operations. PC210is disconnected from port222. Step318executes by revoking VLAN access at the port and terminating operations. The port is marked as “dead”. Step322ends the method.

It may be seen that a switch is disclosed that allows a plurality of VLANs associated with different VPNs to be created dynamically. The switch includes an address table that contains addresses that correlate to outside networks accessible by the switch. When the switch receives the address from a personal computer or other processing device, it matches the address to a network in the address table. The switch then establishes a VLAN and assigns it to the port connecting the personal computer to the switch. The outside network is accessible by the user through the switch. When the user removes the computer from the port, the switch destroys the association between the VLAN and the port. Another user may connect to the port and establish a different VLAN connection corresponding to the address of the computer. In addition, the original user may connect to another port connected to the switch and obtain a new connection to the original VLAN. The switch may be compatible with existing Ethernet hubs to provide dynamic network capabilities to a plurality of locations.