Techniques for routing data between network areas

The present disclosure relates to network communication. More specifically, the present disclosure relates to techniques for routing data between network areas.

[Cross-reference for related applications] This patent application relates to US Patent Application No. 11 / 899,118, filed September 4, 2007. It is hereby incorporated by reference and is fully incorporated herein by reference.

The network can be logically subdivided into virtual private networks (VPNs), virtual local area networks (VLANs) or other logical subnets (network areas or regions). For example, a VLAN can be further logically subdivided into multiple user VLANs or VPNs by the user. Provider Backbone Bridging (PBB) and / or Provider Link State Bridging (PLSB) is a corporate domain that uses an additional MAC (Media Access Control) address header for Ethernet frames. Can be used to separate from one or more user areas. PLSBs can make it possible to improve said sharing of Layer 2 information by using link-state protocols.

<p> However, Layer 2 VPNs may terminate the (UNI: User Network Interface) port at the user network interface. Routing between these user VPNs requires a connection between the actual ports. Establishing this kind of port-to-port connection requires connecting the VPN UNI port to an external router. As the number of user VPNs increases, this type of routing becomes more difficult to scale and manage.</p><p> Another approach for providing routing connectivity between user VPNs is for external routing capabilities to handle the conversion between Layer 2 VPNs and PLSB Layer 2 VPNs. This approach requires additional connections to external routers. The external router requires that it handle the translation between the Layer 2 VPN and the PLSB Layer 2 VPN for multiple Layer 2 PLSB VPNs terminating on the VLAN UNI port. Therefore, this approach requires external routing, adds additional overhead, and adds complexity.</p><p> As mentioned above, it can be understood that the current technology for routing data between network areas has major problems and drawbacks.</p>

<p> A technique for routing data between network areas is disclosed. In a typical embodiment, the technique is a method for routing data between Layer 2 network areas of a backbone bridge and is an internally terminated inter-network interface for multiple network areas. A step of receiving data in a network element including NNI), a step of identifying a destination address associated with the data, a step of determining the network area of a plurality of network areas associated with the data, and the inside of the data. It is implemented in a manner that comprises performing one or more data flow processes related to the data using a terminally terminated inter-network interface (NNI).</p>

<figref num="1">It is a figure which shows the system of the data routing between network areas according to the Example of this disclosure.</figref><figref num="2">It is a figure which shows the system of the data routing between network areas according to the Example of this disclosure.</figref><figref num="3">It is a flow which represents the method for routing data between network areas according to the Example of this disclosure.</figref>

According to other aspects of the particular embodiment, the step of performing one or more data flow processes associated with the data routes the data to the determined network area.

Performing one or more data flow processes related to the data according to a further aspect of the particular embodiment is at least one of network traffic monitoring; firewall function; network traffic measurement; and network intrusion detection; Including one.

According to a further aspect of the particular embodiment, the network area includes virtual private networks (VPNs).

According to a further aspect of the particular embodiment, the network area includes virtual local area networks (VLANs).

According to a further aspect of the particular embodiment, the virtual local area network is associated with a service instance VLAN ID (I-SID).

According to a further aspect of the particular embodiment, the steps in which the network element is associated with a plurality of service instance VLAN IDs and the one or more data flow processes are performed are at least the plurality of service instance VLAN IDs. Use one.

According to a further aspect of the particular embodiment, the destination address includes a backbone medium access control (B-MAC) address.

According to a further aspect of the particular embodiment, the step of determining the network area associated with the data utilizes the service instance VLAN ID (I-SID) associated with the data to determine the network area. Includes steps to do.

According to a further aspect of the particular embodiment, the technology is a computer of instructions configured to be read by at least one processor to instruct at least one processor to perform a computer process to perform the method. Implemented as at least one processor readable storage medium for storing programs.

In a further aspect of the particular embodiment, the technology is a product for routing data between Layer 2 network areas of a backbone bridge, with at least one processor readable storage medium and at least one processor described above. It has instructions stored on a readable medium, said instructions being configured to be read from at least one storage medium by at least one processor, whereby the at least one processor is due to multiple network areas. Receiving data on network elements, including internally terminated inter-network interfaces (NNIs), identifying destination addresses associated with the data, and of multiple network areas associated with the data. Operates to determine the network area and to perform one or more data flow operations related to the data using the internally terminated inter-network interface (NNI). It is realized by the product.

In a further aspect of the particular embodiment, the technology is a system for routing data between network areas, having one or more processors communicatively connected to a network element, said network element. , Multiple network elements associated with the data, receiving data at a network element containing an internally terminated inter-network interface (NNI) for multiple network areas, identifying the destination address associated with the data, and associated with the data. The network area is configured to determine the network area and use the internally terminated inter-network interface (NNI) to perform one or more data flow processes related to the data. Realized by the system.

According to a further aspect of the particular embodiment, the step of performing one or more data flow processes associated with the data routes the data to the determined network area.

Performing one or more data flow processes related to the data according to a further aspect of the particular embodiment is at least one of network traffic monitoring; firewall function; network traffic measurement; and network intrusion detection; Including one.

According to a further aspect of the particular embodiment, the network area includes virtual private networks (VPNs).

Includes virtual local area networks (VLANs) according to a further aspect of the particular embodiment.

According to a further aspect of the particular embodiment, the virtual local area network is associated with a service instance VLAN ID (I-SID).

According to a further aspect of the particular embodiment, the fact that the network element is associated with a plurality of service instance VLAN IDs and that one or more data flow processes are performed is at least one of the plurality of service instance VLAN IDs. Use one.

According to a further aspect of the particular embodiment, the destination address includes a backbone medium access control (B-MAC) address.

To determine the network area associated with the data according to a further aspect of the particular embodiment, the service instance VLAN ID (I-SID) associated with the data is used to determine the network area. Includes network elements to do.

The present disclosure is described in more detail with respect to exemplary embodiments thereof, as shown in the accompanying drawings. The exemplary embodiments of the present disclosure are described below, but it should be understood that the present disclosure is not limited thereby. Those skilled in the art who understand the specification of the present application will recognize additional realizations, modifications and examples, and other areas of use. And that is within the scope of the present disclosure described herein. In that regard, the present disclosure is a valid source of information.

The accompanying drawings are referenced to facilitate a more complete understanding of the current disclosure. Similar reference numerals are given to similar elements. These drawings should not be construed as limiting this disclosure and should be understood as an example.

<p> [Detailed description of exemplary examples] See Figure 1. A system 100 for routing data between network areas according to the embodiments of the present disclosure is shown. FIG. 1 is a simplified view of the system 100. And it may include additional elements (not shown). In system 100, network elements 108, 110, 112, 114, 116, 118, 120, and 122 are communicatively connected as part of network 106. The network 106 can be logically subdivided. For example, network 106 may be an IPv4-based network subnetted to one or more areas or areas (eg, network areas 102 and 104). Each of the network elements 108, 110, 112, 114, 116, 118, 120, and 122 is communicatively connected to one or more of the network areas 102 and 104. One or more of the network elements 108, 110, 112, 114, 116, 118, 120, and 122 may be communicatively connected to additional network areas (not shown). As shown, the network elements 110, 112 and 114 are communicatively connected to the network area 102. The network elements 118, 120 and 122 are communicatively connected to the network area 104. Network elements 108 and 116 are communicatively connected to network areas 102 and 104.</p><p> Network 106 is between virtual local area networks (VLANs), backbone VLANs (BVLANs), or network elements 108, 110, 112, 114, 116, 118, 120, and 122 and other devices communicated to network 106. It may be another logical network structure that enables communication. According to one or more embodiments, the network 106 may be a network service provider VLAN implemented using Provider Link State Bridging (PLSB) or IEEE802.laq. Network 106 can be logically implemented over IEEE802.lah or the Provider Backbone Bridge (PBB). The provider backbone bridge can implement MAC-IN-MAC or can use an additional medium access control (MAC) address of the Ethernet frame for the provider core backbone routing ( For example, the backbone MAC address or B-MAC address can be used to encapsulate the customer MAC Ethernet frame). Additional Ethernet headers can include source and destination backbone addresses, virtual LAN IDs (B-VLANs) and 24 bit service instance VLAN IDs (I-SIDs). Network 106 can implement a link-state routing protocol (eg, a standard IS-IS (Intermediate System to Intermediate System) routing protocol, and knows network information (eg, B-MAC address and I-SID value). To deliver.</p><p> Network areas 102 and 104 may be logical parts of network 106 (eg, VLAN or VPN). The network area may be associated with 24 BitService Instance VLAN IDs (I-SIDs). In one or more embodiments, the network areas 102 and 104 may be customer VLANs. Although two network areas are shown, the user can implement more network areas (eg, additional VLANs).</p><p> Network elements 108, 110, 112, 114, 116, 118, 120, and 122 may be routers, switches, or other devices that communicate to network 106. Network elements 108, 110, 112, 114, 116, 118, 120, and 122 may connect to networked resources such as servers, databases and / or network storage. Network elements 108, 110, 112, 114, 116, 118, 120, and 122 may be network edge devices (eg, provider edge devices). This can then provide connectivity to one or more end users.</p><p> As mentioned above, in one or more embodiments, some of the network elements 108, 110, 112, 114, 116, 118, 120, and 122 relate to multiple network areas (eg, network areas 102 and 104). You may be. For example, network element 116 and / or network element 108 may be associated with network area 102 and network area 104. These network areas may be associated with specific 24 bit service instance VLAN IDs (I-SIDs). For example, network area 102 may be associated with I-SID 102, and network area 104 may be associated with I-SID 104. For example, in response to a request from a user connected via network element 120, the server associated with network element 110 may return a response. The network element (eg, network element 108) can receive the data sent from the network element 110.</p><p> According to one or more embodiments, routing can be performed by a routing function performed on a PLSB NNI (Network to Network Interface) interface. The NNI may be the interface between network area 102 and network area 104 and can be implemented at network element 108. The routing function can identify the 24 bit service instance VLAN IDs (I-SIDs) of the Ethernet frame and can identify the network area 104 as related to the I-SID. Therefore, the network element 108 can send a portion of the data received from the network element 110 to the network element 120 via the network area 104.</p><p> Network element 108 may perform alternative and / or additional functions such as data flow processing (eg, one or more data flow processing performed at layers 4-7 of a standard OSI (Open System Interconnection) model). it can. For example, network element 108 can perform network traffic monitoring, firewall functions, network traffic measurement and network intrusion detection. The routing function includes the following parts, but is a higher level protocol such as ARP (Address Resolution Protocol), RIP (Routing Information Protocol), OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol). Can be supported. It should be noted that the present invention is not limited to these.</p><p> See Figure 2. A system 200 for routing data between network areas according to an embodiment of the present disclosure is shown. FIG. 2 is a simplified view of the system 200. This may include elements not shown. In system 200, the elements of system 100 are incorporated and numbered the same.</p><p> Computers 202, 204, 206, and / or 208 may be desktop computers, laptop computers, servers, databases, hosts or other computers that connect to network elements associated with network 106 in communication. As shown, computers 202 and 206 may be associated with network area 102. And it can be identified by I-SID 102. Computers 204 and 208 may be associated with a network area 104 that can be identified by I-SID 104. The data received by the network elements is examined to determine if the data (eg, incoming Ethernet frames) needs to be bridged or routed.</p><p> According to some embodiments, routing can be performed between two network areas by means of a routing function performed on an internally terminated PLSB network interface (NNI). For example, network element 116 can include a virtual routing instance 210 that utilizes NNI between two network areas. The NNI between network area 102 and network area 104 may be associated with network element 116 and can support routing instances capable of performing one or more data flow operations. For example, the data received from computer 202 by network element 116 is examined to determine the destination MAC address. If the destination MAC address is associated with computer 206, network element 116 can determine that computer 206 is associated with the same network area (ie, network area 102 identified by I-SID 102). .. Network element 116 can bridge data to network element 114. Network element 116 may bridge or route data. This is done depending on whether this data was received from the network area of network 106 or from a device that is communicatively connected to a user network interface (UNI) port. The network element 116 can handle, for example, data containing one MAC address in a frame, or encapsulated MAC-in-Mac data.</p><p> If the destination MAC address is associated with the NNI of network element 116, network element 116 can determine to route traffic to network area 104 identified by I-SID 104. Network element 116 is on the NNI between two network areas to perform one or more data flow processes (eg, data flow processes performed at layers 4-7 of a standard OSI (Open System Interconnection) model). A virtual routing instance 210 can be used. For example, network element 116 can send data to network area 104. Network element 116 can also perform other actions such as network traffic monitoring, firewall functions, network traffic measurement and network intrusion detection. The routing function can support higher level protocols including the following parts: That is, ARP (Address Resolution Protocol), RIP (Routing Information Protocol), OSPF (Open Shortest) Path First) and BGP (Border Gateway Protocol) can be mentioned. It should be noted that the present invention is not limited to these.</p><p> See Figure 3. A method 300 for routing data between network areas according to the embodiments of the present disclosure is shown. At block 302, the method begins.</p><p> At block 304, method 300 can include identifying multiple segmented network areas arriving from network nodes. For example, multiple VPNs or VLANs are identified. According to one or more embodiments, the network element (eg, the router on Method 300 to implement the network) can utilize Provider Link State Bridging (PLSB) or IEEE802.laq. Method 300 may implement a link-state routing protocol, such as an IS-IS (Intermediate System to Intermediate System) routing protocol. This acquires and distributes network information such as B-MAC address and I-SID value. Network elements (eg routers and switches) can use the network information received from the IS-IS routing protocol to identify multiple network areas (eg VLANs associated with I-SID values).</p><p> At block 306, method 300 can include a step of receiving network traffic at the network element. For example, network element 116 can receive data from computer 206 associated with a network area (eg, VLAN or especially customer VLAN).</p><p> At block 308, method 300 can include identifying the segmented network area associated with the customer MAC (CMAC) address of the received network traffic. The customer MAC address may be associated with a network area (eg, VLAN).</p><p> At block 310, method 300 can determine if the destination network area is the same as the current network area. For example, if the CMAC is the MAC address of the current node (eg, network element 116), then an internal logical routing interface with an internally terminated NNI (eg, virtual routing instance 210) will have the CMAC of network traffic. To router NNI (destined) You may judge whether it is to). In that case, network traffic is routed at block 314. If the CMAC of the network traffic is not the MAC address associated with the NNI, the network traffic can be bridged at block 312. Other data flow processes can be performed on behalf of or in addition to routing. For example, routing of traffic can be denied by a firewall. The routing function can support higher level protocols including the following parts: That is, ARP (Address Resolution Protocol), RIP (Routing Information Protocol), OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol) can be mentioned. It is not limited to these. According to one or more embodiments, routing and / or other data flow processing can be performed on the PLSB NNI interface between two network areas (eg, VLANs).</p><p> At block 316, the method ends.</p><p> It should be noted that the routing between the logical network subnets according to the present disclosure as described above can process input data and generate output data to some extent. This input data processing and output data generation can be performed by hardware or software. For example, certain electronic components may be used in routers or similar related circuits that implement data flow control and related functionality between network areas in accordance with the above disclosure. Alternatively, one or more processors operating in accordance with instructions can implement functions associated with data flow control between network areas in accordance with the present disclosure described above. In this case, instructions of this type can be stored on a medium that can be read by one or more processors (eg, a magnetic disk or other storage medium). Alternatively, transmission to one or more processors via one or more signals from one or more carrier waves is within the scope of the present disclosure.</p><p> The specific embodiments described herein do not limit this disclosure to the technical extent. In fact, in addition to the disclosures described herein, various other embodiments of the present disclosure and modifications thereof will be apparent to those skilled in the art from the aforementioned and accompanying drawings. Therefore, other examples and modifications are intended to be within the scope of this disclosure. Further, the present disclosure is described herein by the context of a particular implementation of a particular environment for a particular purpose, but its usefulness is not limited thereto. Those skilled in the art will recognize that this disclosure can be beneficially implemented for any purpose and in any environment. Therefore, as described herein, the claims described below must be construed in the light of the full disclosure and spirit of the present disclosure.</p>