Special Feature

Layer-1 Virtual Private Networks––ServiceConcepts and Enabling Technologies
Tomonori Takeda†, Ryuichi Matsuzaki, Ichiro Inoue,and Kohei ShiomotoAbstract
Internet protocol (IP) and optical networking technologies based on generalized multiprotocol label
switching (GMPLS) enable not only improved operation, but also new services offered by optical networks. One such promising service is the layer-1 virtual private network (L1VPN). This article introduces NTT’s research and development of L1VPNs, focusing on service concepts and enabling technologies.

1. Background
With the progress of optical technologies andGMPLS technologies [1], which provide tools forflexible network operation, it is becoming possible tooffer new services characterized by high bandwidth,
efficient support for packet-based services, andadvanced control and management functions. These
services are expected to be new sources of revenue
for carriers. Advanced control and management functions are important elements in achieving service differentiation, such as security, safety, and user convenience.
2. Service concepts
Carriers currently offer private line services
between a pair of static end points and the line’sbandwidth is also static. Such services are usuallybased on transport technologies such as SONET/SDH (synchronous optical network and synchronous
digital hierarchy). Recently, however, multiprotocollabel switching (MPLS) pseudowire*1 technologies
have begun emerging as an alternative way to offer
private line services.
In traditional SONET/SDH networks, bandwidth† NTT Network Service Systems Laboratories
Musashino-shi, 180-8585 Japan
Email: takeda.tomonori@lab.ntt.co.jp

66

must follow the digital hierarchy, so it is not possible
to support packet-based services efficiently. Forexample, in order to support a 1-Gbit/s Ethernet line,
one must allocate an OC48/STM16 line, that is 2.4
Gbit/s. Furthermore, network operations weredesigned to offer static services with uniform features
across all customers. That is, flexibility and customization are not well considered. Thus, they are notsuitable for supporting applications that transmit ahuge amount of data within a short period. Anotherexample is that since there was little consideration ofoffering different sets of service features to different
customers, it is not straightforward to offer customerspecific monitoring information (e.g., reports of bit
error rate or loss of light (failure detected by monitoring the optical signal power)) to the corresponding
customers. This feature is desirable, especially when
private line services are deployed to support various
service networks of the same carrier, such as an
MPLS network for layer-3 virtual private network(VPN) services.
Various technologies are emerging to solve theseproblems. By using optical cross connects (OXCs)
and reconfigurable optical add/drop multiplexers(ROADMs), which offer wavelength switching capabilities, it is possible to make high-bandwidth ser*1 Pseudowire: A mechanism that carries the essential elements of anemulated service from one provider edge router to one or moreother provider edge routers over a packet-switched network.

NTT Technical Review

Special Feature

Common layer-1 network

VPN#1

Layer-2 switch

Layer-1 connection
VPN#2

Layer-1 switch(e.g., OXC)
RouterFig. 1. Concept of L1VPN.

vices. In addition, by using next-generation
SONET/SDH [2], which offers efficient support for
Ethernet signals, it is possible to achieve efficient
support for packet-based services. Furthermore, byusing GMPLS, it is possible to achieve advanced control and management functions, such as flexible connection setup and service customization.
Combinations of these technologies are expected tomake it possible to offer new services. Among suchnew services, layer-1 VPNs (L1VPNs) give users theimpression of having a private network. The conceptof the L1VPN is shown in Fig. 1. It is a VPN service
offered by the high-bandwidth layer-1 (or optical)
network, which makes it possible to flexibly form andoperate a private network for each service, networkoperator, or user on a common infrastructure.
3. L1VPN service features
The key service features of an L1VPN are listed inTable 1. In terms of transmission, it offers layer-1
connections with a range of bandwidths from high tolow. The use of layer-1 connections enables various
data formats to be transmitted and should lead toimprovements in service quality, such as performance, resiliency, and security. In terms of control
and management, an L1VPN has the following features.
• It establishes connections in response to customer
requests, so it offers convenient services to users.
Both on-demand and reservation services aresupported. In the on-demand service, a connection is established at the time of a request. In thereservation service, a customer specifies the starting and ending times as part of the request, and aconnection is established or deleted based on thisrequest.
• It provides monitoring information to customers,
so it helps make network operation efficient.
Vol. 5 No. 3 Mar. 2007

Table 1. L1VPN service features.
Transmission

Provides high-bandwidth to low-bandwidthlayer-1 connections
Enables flexible connection setup in response
to customer requests
Provides monitoring information to customers

Control andmanagement

Provides resource management for eachcustomer
Provides various recovery options
Supports intranets and extranets• It manages resources for each customer, so it performs admission control based on resource usage.
• Among its recovery options, it offers various
recovery features provided by GMPLS.
• It supports various connectivity models, such as
intranets and extranets.
These features can be customized for each customer.
For example, the network can be configured to allow
connection setup requests from one customer, but notfrom another customer. There are various alternatives
for the interface for receiving connection setup
requests from customers. These lead to various service models, as shown in Fig. 2.
In the management mode where connection setup
requests are received over the management interface(e.g., web), both on-demand and reservation services
are supported. This service model operates in a similar manner to the current one, so it is suitable for initial deployment. When connection setup requests arereceived over the control interface (i.e., GMPLS signaling), only the on-demand service is supported.
This service model is further classified based onwhether or not the network topology is provided tocustomers.
In the basic mode where the network topology isnot provided, GMPLS signaling makes it possible toprovide strong recovery options, which protects aconnection end-to-end between two pieces of cus67

Special Feature

Support for on-demand and reservation services
FeaturesManagement interface
Management mode • High commonality with current operation

Interfaces forconnection setup requests
from customers.

Control interface

NoBasic mode

• Strong recovery options(recovery between a pair of customernetwork equipments)• Automatic label assignment

Is topology
information provided tocustomers?

Support of on-demand
services

Yes

Enhanced mode

• Strong connection control by customers(customers may specify routes)

Fig. 2. L1VPN service model classification.

tomer network equipment. In addition, label assignment with customer network equipment is automated, which helps to reduce the operator’s workload.
In the enhanced mode where network topology
information is provided, customers may also specify
routes in connection setup requests.
One example of an L1VPN deployment scenario isa multiservice network, that is, support for multiple
service networks over a common transport network.
L1VPNs are designed to allow independent operationof each VPN. Therefore, L1VPNs allow us to keep
today’s unit of operation, but allow more flexible network operation, such as establishing a connection
based on a customer’s request and sharing monitoring
information.
Another example of an L1VPN deployment scenario is to offer new services by establishing layer-1
connections either on demand or based on a reservation. Such services could be suitable for data backup
to remote data centers, delivery of huge content (e.g.,video), and advanced applications such as grid computing.
4. Enabling technologies
L1VPNs require development in two important
areas: 1) optical transport network equipment supporting high-bandwidth transmission and 2) control
and management technologies supporting flexible
operation. In this article, we focus on the latter anddiscuss enabling technologies, which are summarized
in Fig. 3. There are two key elements.
The first element is a server, called an L1VPN server. It administers the logical separation of the common optical network. Namely, it performs not only
networkwide configuration and performance man68

agement, but also VPN-specific configuration andperformance management. This helps to quickly
identify VPNs affected by failures, which reduces
operator workload. The L1VPN server also supports
the management mode, by receiving and admitting
customer requests via the management interface, andby providing customized services. It communicateswith network equipment or an element management
system (EMS), and its role includes initiating connection setup based on customer requests.
The second element is a network equipment control
entity, where GMPLS is the key component. It communicates with the L1VPN server or EMS, and when
it receives a connection setup initiation request, itestablishes a connection by GMPLS signaling. Thismode of connection setup, which is called soft permanent connection (SPC), allows multivendor interoperability and the use of GMPLS recovery techniques. The network equipment control entity also
supports the basic and enhanced modes, by receiving
and admitting signaling directly from customer network equipment. This mode of connection setup iscalled switched connection (SC). It also performs
admission control based on VPN membership.
Note that it is possible to use a TE (traffic engineering) server for advanced path computation. In
such a case, the L1VPN server or network equipment
communicates with a TE server.
5. R&D activities
NTT Network Service System Laboratories is
engaged in various activities aimed at achieving
L1VPNs. The network equipment control entity
requires the implementation of functions in vendor
network equipment, so NTT is leading standardizaNTT Technical Review

Special Feature• Logical separation of the common opticalnetwork• Receiving and admitting customer request• Communication with network equipment

Provideroperator
VPN #1view

VPN #2view

L1VPN server

TE server• Communication with theL1VPN server• Connection setup (SPC)• Receiving and admitting
customer signaling• Connection setup (SC)

Wide area
network
Management interface
Data communication network

GMPLS
control plane
VPN #1

VPN #1

VPN #1 operator

VPN #2

VPN #2 operator

VPN #2
ProviderNetwork equipment
control entity

Fig. 3. L1VPN enabling technologies.
2003

2004

2005

2006
Now

ITU-T
(SG13)

Recommendation on
service requirements(Editor is from NTT)

Recommendation onarchitectures(Editor is from NTT)

Individual draft
Working group draft

WG chartered

Initiation of RFC process(submission to IESG)

Framework

IETF(L1VPN WG)

Basic mode
protocol sets

Signaling
IGP discovery
BGP discovery

Applicability
IGP: interior gateway protocol
BGP: border gateway protocol
IESG: Internet Engineering Steering Group

Fig. 4. L1VPN standardization progress.

tion for that purpose, as shown in Fig. 4. ITU-T SG
13 (International Telecommunication Union
Telecommunication Standardization Sector Study
Group 13) was responsible for approving Recommendations on L1VPN service requirements [3] andarchitectures [4], and NTT provided an Editor foreach Recommendation.
In response to ITU-T standardization, a framework
for using GMPLS and a scope of applicability haveVol. 5 No. 3 Mar. 2007

been proposed in the Internet Engineering Task Force(IETF) at the initiative of NTT. After that, the L1VPN
Working Group (WG) was chartered, and one of cochairs is from NTT [5]. Currently, a set of protocols
to support the basic mode is being discussed. These
are now working group drafts, but they are expected
to become Requests for Comments (RFCs) as discussion progresses.
For the server, NTT is developing an L1VPN serv69

Special Feature

er prototype. Some snapshots of its graphical userinterface are shown in Fig. 5. The provider viewshows the status of the whole network, while the VPN
views show the status of each VPN. These features
help VPN-context-aware network operation.
Furthermore, to promote implementation on vendor
network equipment, NTT is driving interoperability
testing, in addition to standardization. Interoperability tests performed in the University of New Hamp-

Provider view

shire Interoperability Laboratory (UNH-IOL) [6] andin ISOCORE [7] are shown in Figs. 6 and 7, respectively.
6. Future direction
The demand for high-bandwidth services is expected to grow and more efficient support for packetbased services will be required in response toVPN #1 view

VPN #2 viewFig. 5. Graphical user interface of the L1VPN server prototype.

L1VPN
server

IPv4

IPv4

IPv6

IPv6Fig. 6. Interoperability testing with an L1VPN server (UNH).

MPLS
network

MPLS
network

GMPLS
UNI

GMPLS
Peer

GMPLS
UNI
UNI: user-network interface

Fig. 7. Interoperability testing with signaling (ISOCORE).

70

NTT Technical Review

Special Feature

progress in broadband access lines and broadband
content services. Advanced control and management
functions will be essential for service differentiation.
In order to create such new services, we need todevelop and deploy optical transport network equipment, as well as control and management technologies. This article introduced NTT R&D activities forthat purpose, including standardization, server prototype development, and interoperability testing.

References
[1]
[2]

[3]
[4]
[5]
[6]
[7]

E. Mannie (Editor), “Generalized Multi-Protocol Label Switching(GMPLS) Architecture,” IETF RFC3945, Oct. 2004.
Y. Maeda, K. Nakanishi, M. Murakami, and H. Ohta, “Organizationof ITU-T SG15 in Study Period 2005-2008,” NTT Technical Review,Vol. 3, No. 6, pp. 65–69, June 2005.
ITU-T Recommendation Y.1312, “Layer 1 Virtual Private Network
generic requirements and architecture elements,” Sept. 2003.
ITU-T Recommendation Y.1313, “Layer 1 Virtual Private Network
service and network architectures,” July 2004.
http://www.ietf.org/html.charters/l1vpn-charter.html
http://www.iol.unh.edu/consortiums/osrm/
http://www.isocore.com/mpls2005/program.htm#interop

Tomonori Takeda

Kohei Shiomoto

Engineer, IP Optical Networking Group,Broadband Network Systems Project, NTT Network Service System Laboratories.
He received the M.E. degree in electronics,
information and communication engineeringfrom Waseda University, Tokyo, in 2001. He
joined NTT in 2001 and has been engaged inresearch on the next-generation network architecture, IP optical network architecture, andrelated protocols. He currently co-chairs theL1VPN WG in IETF. He is a member of IEEEand the Institute of Electronics, Information andCommunication Engineers (IEICE) of Japan.

Senior Research Engineer, Supervisor, GroupLeader, IP Optical Networking Group, Broadband Network Systems Project, NTT Network
Service Systems Laboratories.
He received the B.E., M.E., and Ph.D. degrees
in information and computer sciences from
Osaka University, Osaka, in 1987, 1989, and1998, respectively. He joined NTT in 1989 andengaged in R&D of ATM traffic control andATM switching system architecture design. During 1996–1997, he was engaged in research on
high-speed networking as a Visiting Scholar atWashington University in St. Louis, MO, USA.
During 1997–2001, he was directing architecture
design for the high-speed IP/MPLS label switching router research project at NTT Network Service Systems Laboratories. Since July 2001, hehas been engaged in the research fields of photonic IP router design and routing algorithms andin GMPLS routing and signaling standardization,
first at NTT Network Innovation Laboratories
and then at NTT Network Service Systems Laboratories. He is active in GMPLS standardization
in IETF. He is a member of IEEE, IEICE, and theAssociation for Computing Machinery. He was
the Secretary for International Relations of theCommunications Society of IEICE from June
2003 to May 2005. He was the Vice Chair ofInformation Services of the IEEE ComSoc Asia
Pacific Board from January 2004 to December
2005. He has been involved in the organizationof several international conferences including
HPSR 2002, WTC 2002, HPSR 2004, WTC2004, MPLS 2004, iPOP 2005, MPLS 2005,
iPOP 2006, and MPLS 2006. He received theYoung Engineer Award from IEICE in 1995 andthe Switching System Research Award fromIEICE in 1995 and 2000. He is one of the authorsof “GMPLS Technologies: Broadband Backbone
Networks and Systems”.

Ryuichi Matsuzaki
Senior Research Engineer, IP Optical Networking Group, Broadband Network Systems
Project, NTT Network Service Systems Laboratories.
He received the B.E. and M.S. degrees fromWaseda University, Tokyo, in 1989 and 1991,
respectively. Since joining NTT in 1991, he has
been engaged in R&D of network performance
evaluation, an ATM network management system, a content tracking system, and IP opticalnetworks. He is a member of IEEE and the Operations Research Institute of Japan.

Ichiro Inoue
Senior Research Engineer, Supervisor, IP
Optical Networking Group, Broadband Network
Systems Project, NTT Network Service Systems
Laboratories.
He received the M.E. degree in electrical engineering from the University of Tokyo, Tokyo, in1990. He joined NTT in 1990. Since then, his
research interests have included telecommunication protocols such as IP and ATM. He has been
active in standardization such as ISO/ISC (as anational committee member), ITU-T, and IETF.
He was a Visiting Scholar at Columbia University, USA, in 1995.

Vol. 5 No. 3 Mar. 2007

71