Abstract:
The present invention provides a method, device and system for implementing a VPN configuration service. According to the invention, a VPN configuration request message is received at a network side and a verification is performed on the VPN configuration request message with a directory service table; and the directory service table is updated after the verification is passed; and, thus, a VPN configuration is implemented. Thus, the efficiency of the VPN service is improved. Through configuring the VPN policy information, the VPN connection request of the user is limited within a closed user group and a corresponding control is performed on the VPN connection request of the user. Thus, a flexible management mode is achieved.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of International Patent Application No. PCT/CN2007/001260, filed Apr. 18, 2007, which claims priority to Chinese Patent Application No. 200610060995.6, filed Jun. 2, 2006, both of which are hereby incorporated by reference in their entirety. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to the field of network communications, and in particular, to a method, device, and system for implementing a Virtual Private Network (VPN) configuration service. 
       BACKGROUND OF THE INVENTION 
       [0003]    Generally, the VPN network includes a Customer Edge (CE) device, a Provider Edge (PE) device, and a Provider (P) device which is an internal device in the network. The CE device is a customer edge node and is an egress/ingress of VPN user ends on the same site. The PE device is an edge node of the transport network and functions as an edge device responsible for providing users with VPN services in the transport network. One PE device is connected to at least one CE device and is at least connected to another transport network device. In other words, the PE device is connected with P device. The P device is an internal transport device in the transport network and is connected with other transport network devices in the transport network. However, the P device does not directly connect to the CE device. 
         [0004]    One solution of the prior art is as follows. 
         [0005]    The VPN service is generally implemented by a Network Management System (NMS). As shown in  FIG. 1 , the NMS implements the VPN configuration and the establishment of the user VPN connection service. Specifically, the solution includes the following steps. 
         [0006]    1. VPN information, including VPN member information and VPN policy information, is manually configured in the NMS. 
         [0007]    2. When a user needs to establish a VPN connection, the user sends a VPN connection request message to the NMS. 
         [0008]    3. The NMS performs a verification on the request from the user according to the VPN information preconfigured, and establishes the network connection when the verification is passed. 
         [0009]    Another solution of the prior art is as follows. 
         [0010]    An auto-detection for VPN member is implemented and the VPN service is provided via Border Gateway Protocol (BGP). In combination with the auto-detection for VPN member as described in BGP, the VPN connection service is provided by the network through the following processes. 
         [0011]    1. The VPN member information is configured on the PE device and the VPN member is identified with &lt;CPI PPI&gt;. The CPI is the port ID of the access network device on the CE device and the PPI is the port ID of the port connecting with the CE device on the PE device. 
         [0012]    2. The PE device interacts with other PE devices in VPN via BGP after configuring the VPN member information. Thus, a VPN member information table PIT is configured on all PE devices in the VPN through the auto-detection mechanism for VPN member. 
         [0013]    3. When a CE device needs to communicate with other VPN members, a PE device performs a verification on a VPN communication request from the CE device, according to the VPN member information table PIT. After the verification is passed, the VPN connection is established. 
         [0014]    In the above solutions, both the VPN member information and the VPN policy information are configured manually on the NMS or the PE device by an administrator. When the VPN member changes dynamically, the VPN network configuration information needs to be added, deleted, or modified; thus, a large time delay is caused and the management mode is not flexible. 
       SUMMARY OF THE INVENTION 
       [0015]    The invention provides a method, device, and system for implementing a VPN configuration service. Thus, the VPN member information and the VPN policy information may be configured flexibly and the VPN member may join and exit dynamically. 
         [0016]    One embodiment of the present invention provides a method for implementing a VPN configuration service, including: 
         [0017]    receiving a VPN configuration request message at a network side and performing a verification on the VPN configuration request message with a directory service table; and 
         [0018]    updating the directory service table after the verification is passed and performing a VPN configuration, according to the directory service table updated. 
         [0019]    Another embodiment of the present invention provides a system for implementing a VPN configuration service, including a customer edge device, a provider edge device, and a provider device, the provider edge device being connected with at least one customer edge device and connected with other provider edge device or provider device, wherein the system further includes a directory server adapted to: 
         [0020]    store a directory service table at least including a VPN ID and VPN policy information for verifying a VPN configuration request message and/or configuring VPN configuration information; and 
         [0021]    perform a verification on the VPN configuration request message according to the directory service table, when the VPN configuration request message is received at a network side, and update the directory service table and implement a VPN configuration according to the directory service table updated, after the verification is passed. 
         [0022]    Another embodiment of the present invention provides a directory server, including a verification module, a configuration module, and a storage unit; 
         [0023]    the storage unit is adapted to store a directory service table; 
         [0024]    the verification module is adapted to perform a verification on a VPN configuration request message according to the directory service table and send a configuration request message to the configuration module; and 
         [0025]    the configuration module is adapted to update the directory service table, according to the configuration request message received. 
         [0026]    According to the present invention, the VPN configuration service is implemented based on the directory service and the VPN member information and the VPN policy information are stored in the directory service table. When a user requests to change the VPN configuration information, a VPN operation, such as adding or deleting a VPN member and changing the configuration of the VPN policy, is implemented rapidly by inquiring the directory service table. Thus, the efficiency of the VPN service is improved. Through configuring the VPN policy information, the VPN connection request of the user is limited within a closed user group, and the VPN connection request of the user is controlled. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0027]      FIG. 1  is a schematic diagram showing that the VPN service is implemented by a NMS system; 
           [0028]      FIG. 2  is a schematic diagram showing the system for implementing the VPN configuration service, according to the present invention; 
           [0029]      FIG. 3  is a schematic diagram showing the structure of the directory server, according to the present invention; and 
           [0030]      FIG. 4  is a schematic diagram showing the method for implementing the VPN configuration service, according to the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS  
       [0031]    With reference to the figures, embodiments of the present invention are described as below. 
         [0032]    In the present invention, the VPN configuration is implemented via the directory service. In the system according to the present invention, the network includes a directory server, located on a separate computer outside the network or on a transport device in the network, such as the PE device and the P device. The directory server maintains a table showing the relationship between the VPN ID and the VPN member ID in the form of directory, and the table is the directory service table. Thus, an auto-registration and maintenance of the VPN configuration information is implemented via the directory service. The information for maintaining the VPN by the user is transported through the interaction between the CE and PE devices. The VPN member information and the VPN policy information in the directory service table (including the policy information based on the CE and the policy information based on the VPN) are dynamically added, deleted, and modified via the interaction between the PE device and the directory server. When a user requests to establish, delete, or maintain a VPN connection via the network, the user first queries the directory service table to verify whether the request accords with corresponding VPN member and whether the request accords with corresponding VPN policy information. The VPN policy information includes: the requested maximum bandwidth value, Service Level Agreement (SLA) attribute value, and so on. When the verification is passed, the network may respond to the request and provide corresponding VPN configuration service. Thus, the VPN information may be configured flexibly and the VPN service is provided rapidly. 
         [0033]    The VPN member ID in the directory service table may be configured with the following two methods. 
         [0034]    Transport Network Assigned Address (TNA): In this method, the port number may also be added. The TNA is a global unique address assigned for the physical link of the user device access network by the transport network. With the TNA, the operator may identify the data bearer link of the user device access network. When one TNA corresponds to a plurality of data bearer links, a data bearer link of the user device access network may be identified with the TNA and the port number. 
         [0035]    &lt;CPI, PPI&gt;: This method uses the &lt;CPI, PPI&gt; combination to identify a VPN member. The CPI is the port ID for accessing the VPN network by a CE device and the PPI is the port ID for connecting the CE device with the PE device. The combination of the two port IDs can identify a VPN member uniquely. 
         [0036]    The technical solution of the present invention is further described with the process in which the VPN member is dynamically maintained in the VPN as an example. 
         [0037]      FIG. 2  is a diagram showing the system for implementing the VPN configuration service. In  FIG. 2 , CE  1  and CE  2  indicate CE devices belonging to the same VPN network. The CE device may be a Layer 1, Layer 2, or Layer 3 device, such as TDM cross connection device, Layer2 exchanger, and router. The network nodes PE  1  and PE  2  are the PE devices in the VPN network. The PE device may be a TDM exchanger, an Optic Cross Connect System (OXC) device, a Fiber switch (FXC) device, or a device capable of mapping an Ethernet signal to an Ethernet lease line device connected in Layer 1. The network node P 1  and P 2  are internal devices in the network and devices P 1  and P 2  are Layer 1 devices, such as TDM exchanger, OXC device, and FXC device. The transport nodes such as PE 1 , PE 2 , P 1 , and P 2  are interconnected with lines based on the TDM technology, such as SDH links. The system also includes a directory server. The control plane of the whole network runs the GMPLS protocol. The interface between CE  1  and PE  1  and the interface between PE 2  and CE  2  are user-network interfaces (UNIs). The process in which the UNI is used for communication is described in the UNI 1.0 Standard. The UNI defines a number of addresses including: an internally transported network address, which is the address of an internal node in the operator network and is used as an internal routing for the network management and will not be exposed to the user; a user address, which is the address of the user node in the user network and is not exposed to the operator; and a TNA address, which is a global unique address of at lease one data bearer link for UNI Signaling Agent-Network (UNI-N) and UNI Signaling Agent-Client (UNI-C) assigned by the network. In  FIG. 2 , the TNA address of node CE 1  assigned by the network is  101  and the TNA address of node CE  2  assigned by the network is  102 . 
         [0038]      FIG. 3  shows the basic structure of the directory server. The directory server includes a verification program module  301 , a configuration program module  302 , and a storage  303 . The verification program module  301  performs a verification on the VPN configuration request message according to the directory service table, and sends a configuration message to the configuration program module  302  if the verification is passed. The configuration program module  302  processes the VPN configuration request message after receiving the VPN configuration request message, including adding a VPN member, deleting a VPN member, modifying a VPN policy, and updating a directory service table stored in the storage. The directory service table may use the format as shown in Table 1. 
         [0000]    
       
         
               
               
               
               
             
           
               
                 TABLE 1 
               
               
                   
               
               
                   
                 VPN member ID 
                   
                   
               
               
                   
                 (TNA address/port 
               
               
                 VPN ID 
                 number) 
                 Per-CE Policy 
                 Per-VPN Policy 
               
               
                   
               
             
             
               
                 1 
                 101/10 
                 Policy 11 
                 Policy 1 
               
               
                 1 
                 102/10 
                 Policy 12 
               
               
                 1 
                 103 
                 Policy 13 
               
               
                 2 
                 201 
                 Policy 21 
                 Policy 2 
               
               
                 2 
                 202/11 
                 Policy 22 
               
               
                 . . . 
                 . . . 
                 . . . 
                 . . . 
               
               
                   
               
             
          
         
       
     
         [0039]    Optionally, the VPN member ID may also be the TNA address, the TNA and the port number, or &lt;CPI, PPI&gt;. Table 1 only shows an example of the present invention and cannot be considered as any constraint on the present invention. 
         [0040]      FIG. 4  is a schematic diagram showing the method for implementing the VPN configuration service, according to one embodiment of the present invention. The method includes the following processes. 
         [0041]    S 401 : The network receives the VPN configuration request message. 
         [0042]    S 402 : The VPN configuration request message is verified, according to the directory service table. 
         [0043]    S 403 : The directory service table is updated to complete the VPN configuration, after the verification is passed. 
         [0044]    S 404 : If the verification is not passed, a negative response is returned. 
         [0045]    In the method for implementing the VPN configuration service according to one embodiment of the present invention, the VPN ID and part or all of policy information based on the VPN are preconfigured on the directory server, including the maximum number of the member nodes which are allowed to dynamically access the VPN. 
         [0046]    The dynamical maintenance for the VPN member through the directory service may be implemented with two methods as below. 
       EMBODIMENT 1  
       [0047]    When a CE device initiates a VPN configuration request message, i.e. requests to add, delete VPN member, or modify VPN policy information, the CE device sends a corresponding request message to the PE device via a UNI interface. The PE device forwards the request message to the directory server and the directory server inquires a directory server to perform a verification on the request message. After the verification is passed, the VPN information is updated on the directory server and the VPN configuration is completed. When two CE devices need to communicate with each other, the PE device inquires the directory server, according to the VPN connection request message forwarded by the CE device, so as to perform a verification on the VPN connection request message. When the verification is passed, a VPN connection may be established between the source CE device and the destination CE device. Thus, the source CE device and the destination CE device can only communicate with the VPN members with the same VPN ID on the premise of the permission of the corresponding VPN policy. 
         [0048]    With reference to  FIG. 2 , the process for maintaining the VPN member is described as below. 
         [0049]    1. The VPN member is added as follows. 
         [0050]    1) The device CE 1  sends the request message for requesting to add a VPN member to the device PE 1  via a UNI interface. The request message includes VPN ID 1 , VPN member ID  101 , and VPN policy information Policy 11 based on the device CE 1 , such as the allowed maximum bandwidth BWmax. The VPN ID and the VPN member ID shall be included, while the VPN policy information based on the device CE 1  is optional. 
         [0051]    2) After the PE 1  receives the request message, the PE 1  forwards the request message to the directory server F. 
         [0052]    3) The directory server verifies whether the message is legal by inquiring the directory service table through the two following methods. 
         [0053]    a) It is verified whether the VPN ID 1  exists in the directory service table. 
         [0054]    a1) If the VPN ID 1  does not exist in the directory service table, a negative response is returned to refuse to add CE  1  as the VPN member. 
         [0055]    a2) If the VPN ID 1  exists in the directory service table, it is further determined whether the VPN member ID  101  exists in the table item corresponding to the VPN ID  1 . 
         [0056]    a21) If the VPN member ID  101  exists in the table item corresponding to the VPN ID  1 , a negative response is returned to refuse to add the device CE  1  because the device CE  1  exists in the directory service table. 
         [0057]    a22) If the VPN member ID  101  does not exist in the table item corresponding to the VPN ID  1 , the verification is passed and a positive response is returned. The VPN member ID  101  and other VPN information included in the request message, such as policy information based on the device CE 1 , is added into corresponding table item of the directory service table. 
         [0058]    b) It is verified whether the VPN ID 1  exists in the directory service table. 
         [0059]    b1) If the VPN ID 1  does not exist in the directory service table, a negative response is returned to refuse to add CE  1  as the VPN member. 
         [0060]    b2) If the VPN ID 1  exists in the directory service table, it is further determined whether the VPN member ID  101  exists in the table item corresponding to the VPN ID  1 . 
         [0061]    b21) If the VPN member ID  101  exists in the table item corresponding to the VPN ID  1 , a negative response is returned to refuse to add the device CE  1  because the device CE  1  exists in the directory service table. 
         [0062]    b22) If the VPN member ID  101  does not exist in the table item corresponding to the VPN ID  1 , it is further determined whether the policy information based on the VPN in corresponding table item in the directory service table is satisfied. For example, in the policy information Policy 1 based on the VPN in corresponding table item, the maximum number of the node members which are allowed to dynamically access is 3. 
         [0063]    b221) If the number of the members in the VPN is 0, 1 or 2, the verification is passed and a positive response is returned. The VPN member ID  101  and other VPN information included in the request message, such as policy information based on the device CE 1 , is added into corresponding table item of the directory service table. 
         [0064]    b222) If the number of the members in the VPN is 3, the device CE 1  is refused to be added as the VPN member and a negative response is returned. 
         [0065]    2. The VPN member is deleted as follows. 
         [0066]    1) The device CE 1  sends a request message including VPN ID 1  and VPN member ID  101  of a VPN member to be deleted to PE 1  for deleting the VPN member. 
         [0067]    2) PE 1  forwards the request message, including VPN ID 1  and VPN member ID  101  of the VPN member to be deleted, to the directory server. 
         [0068]    3) The directory server verifies whether the request message is legal after receiving the request message. In other words, it is verified whether a table item whose VPN ID is  1  and whose VPN member ID is  101  exists in the directory service table. 
         [0069]    a) If the table item exists, it is verified whether the policy information in the table item allows a VPN member to exit dynamically. 
         [0070]    a1) If the VPN member is allowed to exist dynamically, the verification is passed and a positive response is returned. The VPN connections related to the node are deleted and the corresponding &lt;VPN ID, VPN member ID&gt; item &lt;1, 100/10&gt; is deleted from the corresponding directory service table item. 
         [0071]    a2) If the VPN member is not allowed to exist dynamically, a negative response is returned. 
         [0072]    b) If the table item does not exist, a negative response is returned. 
         [0073]    3. The VPN policy is modified as follows. 
         [0074]    1) The device CE 1  sends a request message, including VPN ID 1 , VPN member ID  101 , and policy information based on the CE or the VPN to PE 1 , for modifying the VPN policy. 
         [0075]    2) PE 1  forwards the request message, including VPN ID 1 , VPN member ID  101 , and policy information based on the CE or the VPN, to the directory server. 
         [0076]    3) The directory server verifies whether the VPN ID and the VPN member ID are legal after receiving the request message. In other words, it is verified whether a table item whose VPN ID is  1  and whose VPN member ID is  101  exists in the directory service table. 
         [0077]    a) If the table item exists, it is further verified whether the policy information in the table item allows a VPN member to dynamically modify the policy information. 
         [0078]    a1) If the policy information in the table item does not allow a VPN member to dynamically modify the policy information, a negative response is returned. 
         [0079]    a2) If the policy information in the table item allows a VPN member to dynamically modify the policy information, the verification is passed and a positive response is returned. The policy information in the directory service table is updated to the policy information included in the request message. 
         [0080]    b) If the table item whose VPN ID is  1  and whose VPN member ID is  101  does not exist, a negative response is returned. 
         [0081]    4. The VPN connection is established as follows. 
         [0082]    1) The device CE 1  sends a request message including VPN ID 1  of the VPN member to be established a connection, source VPN member ID  101 / 10 , destination VPN member ID  102 / 10  and related request parameters, such as bandwidth and protection attribute. 
         [0083]    2) PE 1  forwards the request message for establishing the VPN connection to the directory server. 
         [0084]    3) The directory server performs a verification on the VPN ID, the source VPN member ID and the destination VPN member ID according to the directory service table, and performs the verification on related request parameters according to the policy information based on CE and the policy information based on VPN. If the verification is not passed, a negative response is returned. 
         [0085]    If the verification is passed, a VPN connection between CE 1  and CE 2  is established and a positive response is returned. 
         [0086]    The implementation of the single domain is described as above and the implementation of the multi-domain is similar to that of the single domain. 
       EMBODIMENT 2  
       [0087]    The directory service table is not only stored on the directory server but also downloaded to each PE device, and the PE device does not need to store the directory service table items of all VPNs and only needs to store the directory service table items related to the VPN where the PE device locates. 
         [0088]    The directory server updates the directory service table of the PE device under the following three conditions. 
         [0089]    1) The directory server updates the directory service table of each PE node periodicity according to the update-time interval configured by the NMS. 
         [0090]    2) When a VPN member is added or deleted or VPN policy information is modified, the directory server updates the directory service table of each PE device. 
         [0091]    3) When a PE device requests the directory server to update the directory service table, the directory server returns an updated directory service table to the PE device. 
         [0092]    During establishing the VPN connection, the PE node only needs to inquire the directory service table of the PE node and does not need to send a request to the directory server, as shown in  FIG. 2 . 
         [0093]    The VPN member is added/the VPN member is deleted/the VPN policy is modified as follows. 
         [0094]    1) The device CE 1  sends a corresponding VPN configuration request message including the VPN information to the device PE 2 . Except that the destination of the request is the PE 1  other than the directory server, the process is similar to that in Embodiment 1. 
         [0095]    2) The device CE 1  inquiries other directory service table and performs a verification on the request message and the verification process is similar to that of Embodiment 1. 
         [0096]    When the verification is passed, a corresponding VPN configuration is implemented and the PE sends a message to the directory server to update the directory service table of the directory server. 
         [0097]    Otherwise, a negative response is returned. 
         [0098]    3) The directory server sends a message for updating the directory service table to other related PE. 
         [0099]    The VPN connection between the devices CE 1  and CE 2  may be established as follows. 
         [0100]    The device PE 1  in the network receives a VPN connection request message from the device CE 1  and inquires the directory service table in B to verify the VPN connection request message. 
         [0101]    If the verification is passed, the VPN connection is established. 
         [0102]    Otherwise, a negative response is returned. 
         [0103]    Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described herein. Accordingly, various modifications and variations may be made without departing from the scope of the invention as defined by the appended claims and their equivalents.