Source: http://www.google.com/patents/US7839802?dq=5636223
Timestamp: 2017-12-18 03:29:01
Document Index: 335040671

Matched Legal Cases: ['§ 4', '§ 4', '§ 4', '§ 4', '§4', '§ 4', 'arts 1312', '§4']

Patent US7839802 - Methods, apparatus and data structures for segmenting customers using at ... - Google Patents
Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further,...http://www.google.com/patents/US7839802?utm_source=gb-gplus-sharePatent US7839802 - Methods, apparatus and data structures for segmenting customers using at least a portion of a layer 2 address header or bits in the place of a layer 2 address header
Publication number US7839802 B2
Application number US 11/003,963
Also published as US6850495, US8243627, US8264987, US20050157664, US20090168776, US20090225675, WO2002019585A1, WO2002019585A8
Publication number 003963, 11003963, US 7839802 B2, US 7839802B2, US-B2-7839802, US7839802 B2, US7839802B2
Inventors Robert T. Baum, Eric A. Voit
Original Assignee Verizon Communications Inc.
Patent Citations (89), Non-Patent Citations (6), Referenced by (8), Classifications (24), Legal Events (3)
Methods, apparatus and data structures for segmenting customers using at least a portion of a layer 2 address header or bits in the place of a layer 2 address header
US 7839802 B2
Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further, a particular quality of service may be indicated by at least a part of the unique bit string (or context information). The service provided to a group of customers, that group of customers being defined by at least a portion of the unique bit string (or context information), may be monitored. Multicast groups may be supported by checking at least a part of the unique bit string (or context information) to determine whether or not a customer associated with that port is permitted to join the multicast group.
1. A method for provisioning services to packets sourced from a number of client customer devices, the method comprising:
a) accepting, by communications system, a packet sourced from one of a number of client customer devices, wherein the packet has had at least a part of a layer 2 header, generated by the source client customer device, replaced with a unique bit string that is independent of any contents of the packet, wherein the at least a portion of the unique bit string corresponds to a virtual private network-INDEX;
b) determining, by the communications system, whether or not the packet is entitled to access a particular service using at least a portion of the unique bit string; and
c) if it is determined that the packet is entitled to access the particular service, then routing, by the communications system, the packet, otherwise denying, by the communications system, the packet access to the particular service.
2. The method of claim 1 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.
3. The method of claim 1 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.
4. The method of claim 1 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.
5. The method of claim 1 wherein the step of determining whether or not the packet is entitled to access a particular service using at least a portion of the unique bit string is a separate determination from determining whether or not the packet can be forwarded.
6. The method of claim 1 wherein the packet is routed only if it is determined that the packet is entitled to access the particular service.
7. A method for providing various quality of service levels to packets sourced from a number of client customer devices, the method comprising:
a) accepting, by the communications system, a packet sourced from one or a number of client customer devices, wherein the packet has had at least a part of a layer 2 header, generated by the source client customer device, replaced with a unique bit string that is independent of any contents of the packet, wherein the at least a portion of the unique bit string corresponds to a virtual private network-INDEX;
b) determining, by the communications system, a service level to which the packet is entitled using the unique bit string; and
c) forwarding, by the communications system, the packet to a particular one of a plurality of queues associated with the service level determined.
8. The method of claim 7 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.
9. The method of claim 7 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.
10. The method of claim 7 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.
11. The method of claim 7 wherein the service level is a quality of service level.
12. The method of claim 7 wherein the service level is a quality of service level represented by a plurality of bits.
13. A method for monitoring packets sourced from a group of client customer devices defining a subset of client customer devices, each of the packets having at least a part of a layer 2 header, generated by the source client customer device, replaced with a unique bit string, the method comprising:
a) determining, by the communications system, whether or not the packet belongs to the group of client customer devices using at least a portion of the unique bit string, wherein the at least a portion of the unique bit string corresponds to a virtual private network-INDEX; and
b) if it is determined that the packet does belong to the group of client customer devices, then
i) copying, by the communications system, the packet to generate a duplicate packet, and
ii) forwarding, by the communications system, the duplicate packet to a monitoring facility, wherein the monitoring facility monitors at least one of (A) service provided to a group of customers, and (B) security.
14. The method of claim 13 wherein at least a portion of the unique bit string represents one of a number of logical interfaces.
15. The method of claim 13 wherein at least a portion of the unique bit string corresponds to a virtual private network-organizational universal identifier.
16. The method of claim 13 wherein the unique bit string is independent of a layer 2 destination address.
17. The method of claim 13 wherein at least a portion of the unique bit string represents a logical port identifier including a geographic location identifier and a physical unit identifier.
This application is a continuation of U.S. patent application Ser. No. 09/652,750, titled “METHODS, APPARATUS AND DATA STRUCTURES FOR SEGMENTING CUSTOMERS USING AT LEAST A PORTION OF A LAYER 2 ADDRESS HEADER OR BITS IN THE PLACE OF A LAYER 2 ADDRESS HEADER,” filed on Aug. 31, 2000, now U.S. Pat. No. 6,850,495 and listing Robert T. Baum and Eric A. Voit as the inventors. That application is expressly incorporated herein by reference.
More specifically, referring to FIG. 6A, the four (4) bit version field 602 indicates the version number of the IP, in this case, version 4. The 4-bit Internet header length field 604 identifies the length of the header 412 in 32-bit words. The 8-bit type of service field 606 indicates the service level that the IP datagram 420 should be given. The 16-bit total length field 608 identifies the total length of the IP datagram 420 in octets. The 16-bit identification field 610 is used to help reassemble fragmented user data carried in multiple packets. The 3-bit flags field 612 is used to control fragmentation. The 13-bit fragment offset field 614 is used to reassemble a datagram 420 that has become fragmented. The 8-bit time to live field 616 defines a maximum time that the datagram is allowed to exist within the network it travels over. The 8-bit protocol field 618 defines the higher-level protocol to which the data portion of the datagram 420 belongs. The 16-bit header checksum field 620 permits the integrity of the IP header 412 to be checked. The 32-bit source address field 322,contains the IP address of the sender of the IP datagram 420 and the 32-bit destination address field contains the IP address of the host to which the IP datagram 120 is being sent. Options and padding 626 may be used to describe special packet processing and/or to ensure that the header 412 is a complete multiple of 32-bit words.
A TCP/IP packet is-communicated over the Internet (or any internet or intranet) via routers. Basically, routers in the Internet use destination address information (Recall fields 624 and 624′.) to forward packets towards their destination. Routers interconnect different networks. More specifically, routers accept incoming packets from various connected networks, use a look-up table to determine a network upon which the packet should be placed, and routes the packet to the determined network.
FIG. 14 is a high-level block diagram of an exemplary aggregation unit.
The IEEE 802.3 frame structure 1200 (or MAC Sublayer Protocol) is illustrated in FIG. 12. The source and destination addresses 1230 and 1240, respectively, may be six (6) bytes (or 48 bits) long. The second most significant bit is used to distinguish local addresses from global addresses. Thus, 46 bits are available for addresses (or about 7×1013 unique addresses). Accordingly, any device can uniquely address any other device by using the right 48-bit address—it is up to the network layer to figure out how to locate the device associated with the destination address. The 48-bit address will be discussed in greater detail in § 4.3.2.1.1 below.
The present invention may provide for various levels of service. In the example disclosed, two kinds of service levels are provided: i) quality of service; and ii) class of service. Quality of service (or “QoS”) defines the network requirements necessary to satisfy certain performance requirements associated with an IP application, for example voice over IP. Quality of service may be derived from layer 3 and/or 4 information in a received packet(s) and can therefore be thought of as a packet-dependent part of the context information. Class of service (or “CoS”) defines the priority that a customer's IP traffic has within a network. Class of service levels may be customer-selected and can be thought of as a service bundle or service level agreement (which may be ordered and, optionally, modified by the customer). Since class of service does not depend on information in a received packet(s), it can be thought of as a packet-independent part of the context information.
4.3.3.2.2 Examplary Protocol for Conveying a Customer's Service Levels
FIGS. 29 and 30 illustrate exemplary address tables 1060′ and 1060″, respectively, which may be generated, maintained, and used by the aggregation unit 1010. More-specifically, these tables 1060′ and 1060″ may be configured by the port configuration process 1012. The table of FIG. 29 may be used by the port aggregation process 1014, and the table of FIG. 30 may be used by the shared link de-aggregation process 1016.
In the following, an exemplary method that may be used to effect the logical port or interface configuration process 1012 is described in § 4.3.4.3.1 with reference to FIGS. 13 and 20. An exemplary method that may be used to effect the logical port or interface aggregation process 1014 is described in § 4.3.4.3.2 with reference to FIGS. 21 and 29. An exemplary method that may be used to effect the shared link de-aggregation process 1016 is described in § 4.3.4.3.3 with reference to FIGS. 22 and 30. Finally, an exemplary method that may be used to effect the multicast group monitoring process 1018 is described in §4.3.4.3.4 with reference to FIGS. 23 and 31. Generally speaking, processor(s), application specific integrated circuit(s), programmable logic array(s), and/or other hardware and/or software may be used to effect the processes of the access router.
Recall from the description of FIG. 13 in § 4.3.3 above that a common plan 1090′ may be used such that various values of at least some bits of the context information correspond to various services or customer service agreements. (Recall parts 1312 and class of service 1320 of FIG. 13.) FIG. 25 illustrates a data structure of an exemplary access control list 1083′ which may be used by the access router 812 to permit or deny access to services, locations, etc. More specifically, the list 1083′ includes a column 2510 which lists various values of at least some bits of the context information (Recall, e.g., FIG. 13.) which correspond to various services or customer service agreements. As shown, these services may include various services offered by the owner and/or operator of the LATA IP network, such as virtual private networks with or without Internet access, Internet access only, etc. This information may correspond to the VPN-OUI 3225, VPN-Index 3230, protocol 3235, L4 port 3240, type of service 3245 and service level 3250 columns of FIG. 32. Ranges of the layer 3 (e.g., IP) source addresses are depicted in the column 2520 (See source IP address 3205 and mask 3210 columns of FIG. 32.), and ranges of the layer 3 (e.g., IP) destination addresses are depicted in the column 2530 (See destination IP address 3215 and mask 3220 columns of FIG. 32.). Based on the service bit(s) in column 2510, the layer 3 source address and/or the layer 3 destination address, the access router 812 can permit or deny a packet, as indicated by column 2540. The access router 812 may use these permit/deny instructions to decide whether to route or drop a packet. As can be appreciated, in this way, various values of bit(s) of the context information (as well as the layer 3 source and/or destination address) may be used to permit or deny access to various services. The last instruction in the access control list may be a deny command (if the packet was not already permitted). An exemplary method that may be carried out the access router is described in §4.3.5.2 below.
Still referring to FIG. 19, at the access router 812′, an access control list (Recall, e.g., FIGS. 25 and FIG. 32.) policy may be applied as shown in block 1910, and the packet may be allowed or denied based on the access control list policy as shown by decision block 1912. Recall from FIG. 25 that the access control list may use at least a portion of the unique bit string (or context information) replacing the layer 2 header information (See, e.g., column 2510 of FIG. 25 and columns 3225 and 3230 of FIG. 32.) and/or at least a portion of the layer 3 address information (See, e.g., columns 2520 and 2530 of FIG. 25 and columns 3205, 3210, 3215 and 3220 of FIG. 32.). If the packet is denied access, it may be forwarded to a security port “M2” as indicated by block 1914. If, on the other hand, the packet is allowed, a type of service may be rewritten as a “service level” based on layer 2, 3, and/or 4 information as shown in block 1916. (See, e.g., column 3245 of FIG. 32 and field 3760 of FIG. 37.) Next, as shown in block 1918 and decision block 1920, a rate limiting policy may be applied and enforced. (See, e.g., column 3250 of FIG. 32.) If the customer (client) device is exceeding the rate specified in its class of service level agreement, the packet(s) may be forwarded to a service level agreement port “M1 ” as shown by block 1922. If, on the other hand, the customer (client) device is within the rate specified in its class of service level agreement, the packet may then be forwarded to an encapsulation interface as shown by block 1924.
US5088090 Jan 31, 1990 Feb 11, 1992 Rad Network Devices Ltd. Routing system to interconnect local area networks
US5758285 Nov 30, 1995 May 26, 1998 Lucent Technologies Inc. Increasing the capacity of a personal communication service system by multiple connections to individual telephone links
US5954829 Dec 30, 1996 Sep 21, 1999 Mci Communications Corporation System, method, and computer program product for digital cross connect testing
US5963543 Aug 5, 1997 Oct 5, 1999 Lsi Logic Corporation Error detection and correction apparatus for an asynchronous transfer mode (ATM) network device
US6058429 Dec 8, 1995 May 2, 2000 Nortel Networks Corporation Method and apparatus for forwarding traffic between locality attached networks using level 3 addressing information
US6243379 * Apr 4, 1997 Jun 5, 2001 Ramp Networks, Inc. Connection and packet level multiplexing between network links
US6304901 Sep 22, 2000 Oct 16, 2001 Cisco Technology, Inc. Multiple VLAN architecture system
US6377987 Apr 30, 1999 Apr 23, 2002 Cisco Technology, Inc. Mechanism for determining actual physical topology of network based on gathered configuration information representing true neighboring devices
US6421343 Aug 21, 1998 Jul 16, 2002 Electronics And Telecommunications Research Institute Asynchronous transfer mode host adapter apparatus with ability of shared media access
US6473403 Jan 11, 1999 Oct 29, 2002 Hewlett-Packard Company Identify negotiation switch protocols
US6546001 Aug 14, 1998 Apr 8, 2003 Samsung Electronics Co., Ltd. Medium access control message acknowledgment system and method of operation thereof
US6553029 Jul 9, 1999 Apr 22, 2003 Pmc-Sierra, Inc. Link aggregation in ethernet frame switches
US6574240 Jan 19, 2000 Jun 3, 2003 Advanced Micro Devices, Inc. Apparatus and method for implementing distributed layer 3 learning in a network switch
US6577600 Jan 11, 1999 Jun 10, 2003 Hewlett-Packard Development Company, L.P. Cost calculation in load balancing switch protocols
US6640251 Sep 17, 1999 Oct 28, 2003 Nortel Networks Limited Multicast-enabled address resolution protocol (ME-ARP)
US6643267 Jun 30, 1999 Nov 4, 2003 Cisco Technology, Inc. Method and apparatus for tracing a virtual connection
US6643287 Nov 24, 1999 Nov 4, 2003 Pluris, Inc. Apparatus and method for forwarding encapsulated data packets on a network having multiple links between nodes
US6674756 Feb 23, 2000 Jan 6, 2004 Alcatel Multi-service network switch with multiple virtual routers
US6751220 Jun 12, 2000 Jun 15, 2004 Nortel Networks Limited Apparatus and method of managing virtual private network routing data
US6757281 Dec 16, 1999 Jun 29, 2004 Xerox Corporation Route server
US6873618 Mar 16, 1999 Mar 29, 2005 Nortel Networks Limited Multipoint network routing protocol
US6993026 * Aug 31, 2000 Jan 31, 2006 Verizon Communications Inc. Methods, apparatus and data structures for preserving address and service level information in a virtual private network
US20020027906 Aug 23, 2001 Mar 7, 2002 Athreya Anand S. System and method for connecting geographically distributed virtual local area networks
US20040030804 May 23, 2003 Feb 12, 2004 Nortel Networks Limited Multi-cast enabled address resolution protocol (ME-ARP)
1 "Data Link Layer", Oct. 14, 1997, http://www.cs.panam.edu/~meng/Course/CS6345/Notes/chpt-4/node2.html.
2 "Data Link Layer", Oct. 14, 1997, http://www.cs.panam.edu/˜meng/Course/CS6345/Notes/chpt-4/node2.html.
3 Fox et al., "Virtual Private Networks Identifier", Network Working Group, Request for Comments 2685, Sep. 1999.
4 O'Hanlon, Piers, Notes from the 47th IETF meeting, Mar. 26 thru 31, 2000, IETF Meetings, pp. 1-13.
5 Valencia et al., "Cisco Layer Two Forwarding (Protocol) 'L2F'", May 1998, pp. 1-29.
6 Valencia et al., "Cisco Layer Two Forwarding (Protocol) ‘L2F’", May 1998, pp. 1-29.
US8121051 * Feb 26, 2007 Feb 21, 2012 Hewlett-Packard Development Company, L.P. Network resource teaming on a per virtual network basis
US20080205402 * Feb 26, 2007 Aug 28, 2008 Mcgee Michael Sean Network resource teaming on a per virtual network basis
U.S. Classification 370/256, 709/249, 370/465, 370/402
International Classification H04L12/28, H04L29/06, H04L12/46, H04L29/12
Cooperative Classification H04L69/22, H04L63/104, H04L61/35, H04L29/12009, H04L2463/102, H04L29/12783, H04L63/101, H04L12/4641, H04L63/0272
European Classification H04L29/12A, H04L29/12A6, H04L12/46V, H04L63/02C, H04L63/10A, H04L63/10C, H04L61/35
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BAUM, ROBERT T.;VOIT, ERIC A.;SIGNING DATES FROM 20001211 TO 20001213;REEL/FRAME:028020/0101