CN1976317B - 桥接加密vlan - Google Patents

桥接加密vlan Download PDF

Info

Publication number
CN1976317B
CN1976317B CN2006101502922A CN200610150292A CN1976317B CN 1976317 B CN1976317 B CN 1976317B CN 2006101502922 A CN2006101502922 A CN 2006101502922A CN 200610150292 A CN200610150292 A CN 200610150292A CN 1976317 B CN1976317 B CN 1976317B
Authority
CN
China
Prior art keywords
vlan
port
frame
bridger
mark
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN2006101502922A
Other languages
English (en)
Other versions
CN1976317A (zh
Inventor
丹尼斯·迈克尔·沃尔帕诺
新华·J·赵
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Microsoft Technology Licensing LLC
Original Assignee
Microsoft Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Microsoft Corp filed Critical Microsoft Corp
Publication of CN1976317A publication Critical patent/CN1976317A/zh
Application granted granted Critical
Publication of CN1976317B publication Critical patent/CN1976317B/zh
Anticipated expiration legal-status Critical
Expired - Fee Related legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/4645—Details on frame tagging
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/467—Arrangements for supporting untagged frames, e.g. port-based VLANs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明包含IEEE 802.1Q VLAN桥接模型的三种扩展。第一扩展为在汇聚链接上的VLAN加密分离。本发明中引入一称为封装LAN区段的LAN区段类型。此区段上所有的帧均根据一加密和认证码方案进行封装。第二扩展为将汇聚端口分为入站端口与出站端口。第三扩展是一种为桥接VLAN中的各个出站端口自动推断该端口的一组LAN区段类型的协议，其可最小化在桥接VLAN中传递一帧所要求的在封装与未封装区段之间进行传送的数量。

Description

桥接加密VLAN
技术领域
本发明涉及VLAN。具体而言，本发明涉及一种桥接加密VLAN。
背景技术
基本VLAN概念
图1展示一简单的基于端口的VLAN 10，其包含两个VLAN，即VLAN A 13和VLANB 15。在一端口处所接收的一未标记帧所属的VLAN是由分配给所述接收端口的端口VLAN ID(PVID)来判定的，或由所述帧中所携带的与链路层协议相关联的VLAN ID(VID)判定(参见IEEE Std 802.1v-2001，Virtual Bridged Local AreaNetworks-Amendment 2：VLAN Classification by Protocol and Port)。需存在一个在桥接器12、14之间转运VLAN信息的方法，其原因在于所述桥接器12与14经由一可携带来自多个VLAN的帧的汇聚链接16而连接在一起。出于此原因，一VLAN标记被添加到每个帧。此类帧被称为VLAN标记型帧。
汇聚链接
一汇聚链接是一个用于在VLAN桥接器之间进行VLAN多路复用的LAN区段(参见IEEE Std 802.1v-2001，Virtual Bridged Local Area Networks-Amendment 2：VLANClassification by Protocol and Port)。每个连接到汇聚链接的装置必须为可识别VLAN的(VLAN-aware)。此即意味着其了解VLAN的成员资格和VLAN帧格式。汇聚链接上的所有帧(包括端站帧在内)均为VLAN标记的，即意味着其携带有非空VID。汇聚链接上不能有不可识别VLAN的端站。
图1中的汇聚链接16是一个由两个桥接器12、14共享的多路复用LAN区段。一般而言，可将许多可识别VLAN的桥接器连接到一汇聚链接。
存取链路11是无法将VLAN多路复用的LAN区段。实情是，每个存取链路都携带属于单一VLAN的未标记帧或VLAN标记型帧。如果帧为经标记的，那么所述区段上的所有的帧都携带相同的VID并且所述LAN区段上的端站必须为可识别VLAN的。
在VLAN技术的当前发展状态下遇到了各种限制。一个问题是汇聚链接上的VLAN加密分离。引入解决此问题的方案自身提供了在代表单一VLAN的加密与未加密LAN区段之间进行有效率的帧传送的机会。
发明内容
本发明包含IEEE 802.1Q VLAN桥接模型的三种扩展(参见IEEE Std 802.1Q-1998，IEEE Standards for Local and Metropolitan Area Networks：Virtual Bridged Local AreaNetworks)。第一扩展为在汇聚链接上的VLAN加密分离。本发明中引入一种在本文中称为封装区段类型的新LAN区段类型。此区段上所有的帧均根据一加密和认证码方案受到封装。第二扩展为将汇聚端口分为入站汇聚端口与出站汇聚端口。第三扩展为一种在本文中称为传送点协议(TPP)的协议，其为一桥接VLAN中的各个出站汇聚端口自动地推断端口的一组LAN区段类型，其可最小化在所述桥接VLAN中传递一个帧所要求的在封装与未封装区段之间进行传送的数量。
附图说明
图1为展示一个基于端口的VLAN的方框示意图；
图2为展示根据本发明的一桥接加密VLAN的方框示意图；
图3为展示根据本发明的一个转发组的构造的流程图；
图4为展示根据本发明的一个具有两个无线汇聚链接的桥接加密VLAN的方框示意图；
图5为展示根据本发明的一个桥接加密VLAN中的出站端口的对称标签的方框示意图；
图6为展示根据本发明的一个桥接加密VLAN中的出站端口的非对称标签的方框示意图；
图7为展示根据本发明的一个桥接加密VLAN中的一纯封装汇聚链接的方框示意图。
图8为根据本发明展示当图7的桥接器1起始一个用于该VLAN的通告帧时的TPP消息交换的流程图；
图9为根据本发明展示在交换了图7的桥接器1和2之后，出站端口的标签的方框示意图；和
图10为根据本发明展示在含有一具有三个汇聚端口的桥接器的桥接加密VLAN中的出站端口的标签的方框示意图。
具体实施方式
LAN区段类型
以下三种LAN区段类型均可代表一虚拟局域网(VLAN)：未标记区段、标记区段和封装区段。IEEE 802.1Q标准仅论述了标记区段和未标记区段类型(参见IEEE Std802.1Q-1998，IEEE Standards for Local and Metropolitan Area Networks：Virtual BridgedLocal Area Networks)。该标准所规定的桥接语义(bridging semantics)仅适用于在代表相同VLAN的标记区段与未标记区段之间的通信量传送。本发明提供一种将桥接语义延伸为涵盖在相同VLAN的一未封装区段(标记或未标记)与一封装区段之间的通信量传送。一般来说，可引入任何数量的LAN区段类型。
代表VLAN的各区段类型均具有一种帧类型。一个桥接加密VLAN中具有三种类型的帧：未标记型帧、VLAN标记(也称作标记)型帧和封装型帧。前两种帧类型属于IEEE 802.1Q标准(参见IEEE Std 802.1Q-1998，IEEE Standards for Local and MetropolitanArea Networks：Virtual Bridged Local Area Networks)。封装型帧是经加密封装的。每个封装型帧也具有一个VLAN标记。然而，所述标记不同于在属于VLAN的标记型帧中所使用的标记。两个独特的VLAN标记与每个VLAN相关：VID-T(用于VLAN的标记型帧内)和VID-E(用于VLAN的封装型帧内)。
对于每个VLAN来说，存在一个独特的安全关联(security association)，其包含一个加密认证码密钥以检查(check)被标记为属于所述VLAN的帧的完整性与真实性和一个加密密钥以确保属于所述VLAN的所有帧的私密性。
优选的封装方案为“encrypt-then-MAC(加密然后MAC)”方案。在此方案中，将帧的数据负载加密且然后由所得密文和所述帧的序号计算出一消息认证码。此方案具有两个主要优势：当其与某些分组密码及操作模式一同使用时，其可方便前向纠错(forwarderror correction)；且其允许无需解密的帧认证。
一个标记端口组、一个未标记端口组和一个封装端口组与每个VLAN相关联。VLAN的安全关联可用于验证被标记为属于所述VLAN并在所述VLAN的封装组中的一端口处所接收的每个帧的真实性和完整性。端口的入口过滤规则(ingress-filtering rule)判定是否要进行验证。所述关联也可用于在将属于VLAN的标记型帧和未标记型帧从所述VLAN的封装组中的一端口发出之前，将其加密地封装。
汇聚端口
每个汇聚端口具有一个入站端口和一个出站端口。两个汇聚端口P1与P2之间的汇聚链接将P1的入站端口连接到P2的出站端口，并将P1的出站端口连接到P2的入站端口。因此，一个入站端口所属的LAN区段类型组正是其所连接的出站端口的LAN区段类型组。因此，为将一桥接的VLAN中的所有汇聚端口全都分配至LAN区段类型组，只需将出站端口分配至所述LAN区段类型组即可。
汇聚端口的入站端口和出站端口可属于不同的LAN区段类型组。例如，一汇聚端口的出站端口可属于VLAN的标记组，且其入站端口可属于所述VLAN的封装组，在此情形中，在该入站端口上仅接收所述VLAN的封装型帧，而从该出站端口仅发送标记型帧。
与存取端口不同，汇聚端口的入站端口或出站端口可同时属于VLAN的标记组与封装组。
在802.1Q标准中并未提供将一汇聚端口划分为入站端口和出站端口的内容(参见IEEE Std 802.1Q-1998，IEEE Standards for Local and Metropolitan Area Networks：VirtualBridged Local Area Networks)，在该标准中，实际上所述入站端口与出站端口是相同的端口。因此，对于802.1Q中的给定汇聚端口来说，入站和出站帧类型总是相同的。
图2说明一桥接加密VLAN。端口P1(20)和P2(21)为存取端口，一个对应于VLAN A 28而另一个对应于VLAN B 29，VLAN A和B具有存取链路30、31。一汇聚链接16经由汇聚端口P3(22)和P4(23)而将两个桥接器12a、14a连接在一起。P3具有入站端口P3i和出站端口P3o，P4具有入站端口P4i和出站端口P4o。P4i连接到P3o且P4o连接到P3i。在P4处接收的帧到达入站端口P4i并且从P4发出的帧经由出站端口P4o离开。在P3处接收的帧到达入站端口P3i并且从P3发出的帧经由出站端口P3o离开。
端口P5(24)和P6(25)连接到无线存取链路30。在优选实施例中，其实际上是共享单一无线电接口(存取点)的虚拟端口，所述帧就是通过所述单一无线电接口而经由RF(射频)发送并接收。尽管VLAN A 28和B 29共享相同的RF媒介，其却可由不同的封装区段代表。VLAN A中的端站(例如)可接收但无法译解(decipher)任何属于VLAN B的帧。因此，可为A与B显示出截然不同的存取链路32、33，尽管两链路间的物理区别仅为加密的不同。
假定P1仅接收未标记型帧且P2仅接收标记型帧。此外，假定所述汇聚链接在两个方向上均传送标记型帧，并且所述无线存取链路仅传送封装型帧。那么，对于VLAN A，未标记组为{P1}，标记组为{P3o，P3i，P4o，P4i}且封装组为{P5}；而对于B，所述组分别为{  }、{P2，P3o，P3i，P4o，P4i}和{P6}。
如果P5处的入口过滤规则规定要检查真实性，则使用VLAN A的安全关联来认证于P5处接收到的帧。如果认证成功，则所述帧被判定为A的封装区段的成员(member)。假定必须将所述帧转发到P4。则桥接器2使用相同的安全关联将所述帧拆封。所述桥接器将拆封的帧转发到P4o，并将其标记用标记A-T予以替换，从而将所述帧从A的封装区段传送到其标记区段。相反，使用A的安全关联将到达P4i且目的地为P5的帧加以封装。用标记A-E替换标记A-T，这将所述帧从A的标记区段传送到其封装区段。
图2的实例存在多种变形。例如，可能仅需要保护VLAN B上的通信量。在此情况下，P5不属于A的封装组。仅须认证于P6处接收到的帧(即，具有标记B-E的帧)，并且仅须封装在P4i处接收到的且目的地为P6的B的标记型帧。
桥接语义
就具有多个端口的VLAN桥接器来说。假定在端口P处接收到一帧。其被以多种方式之一分配至一个VLAN。如果P是汇聚端口，则所述帧必须带有VID-T或VID-E形式(其各自可识别一VLAN)的VLAN标记，即VID。否则，所述帧会被丢弃。如果P不是汇聚端口，则可使用基于端口或基于协议的VLAN分类来将所述帧分配到一VLAN(参见IEEE Std 802.1v-2001，Virtual Bridged Local Area Networks-Amendment 2：VLANClassification by Protocol and Port)。
入口过滤
如果P是汇聚端口且并不处于VID的标记或封装组中，则所述帧会被丢弃。端口的入口过滤规则可规定针对某些VLAN的认证和完整性检查。如果P是一个其入口过滤规则要求针对VLAN VID进行认证和完整性检查的端口，则在P处接收到的帧必须具有VLAN标记VID-E。否则，所述帧会被丢弃。在优选实施例中，通过使用VID的安全关联由所接收的帧的密文和序号计算出认证码。如果计算出的认证码与所述帧中接收到的认证码不相匹配，则所述帧会被丢弃。否则所述帧被判定为属于VID的封装区段。
如果P并非处于VID的标记组中，但其连接到VLAN标记存取链路，则所接收的帧会被丢弃。
转发过程
转发过程开始于构造目标端口组Q。这是属于一个特定VLAN的帧必须被转发到的端口组。假定于端口P接收到的帧属于VLAN VID。如果必须用所述帧进行淹没操作(flood)，则Q包含任何是VID的标记组、未标记组或封装组的成员的出站端口或存取端口。下一步骤为：当且仅当P是属于VID的标记组与封装组两者的汇聚端口的入站端口时，缩减Q。在此情况下，如果所接收的帧为标记型帧，则将在VID的封装组中却不属于VID的标记组的每个端口均从Q移除，或者如果所接收的帧为封装型帧，则将在VID的标记组或未标记组中却不属于VID的封装组的每个端口均从Q移除。由于入站端口属于VID的LAN区段类型组中的两者，入站端口必须接收各个LAN区段类型的帧，因而有理由缩减目标端口组。传送点协议的特性保证了缩减过程决不会导致空的目标端口组。缩减到空的目标组意味着桥接器接收了不该接收的帧。
转发过程中的下一步骤是针对接收到的帧构造一个转发组。此即由于在端口P处接收到属于VID的帧而要转发的一组帧。它们是将通信量从VLAN的一个LAN区段传送到另一LAN区段所必需的帧。图3中所示的表被用来构造转发组。在P处接收到的帧属于VID的K类LAN区段(标记、未标记或封装)。类似地，Q中的每个端口均属于一类LAN区段，即，其所属的VID端口组类型。汇聚端口可具有两类组：标记与封装。对于Q中的每一端口q，根据图3表中的规则(K，K′)将一帧添加到转发组，其中K′为q所属的一类VID端口组。
用于针对所接收的帧构造转发组的规则如下：
(1)将所接收的帧添加到转发组。
(2)将VLAN标记VID-T添加到所接收的帧；将所得结果添加到转发组。
(3)使用VID的安全关联将所接收的帧加密地封装；用VID-E VLAN标记所得帧并将其添加到转发组。
(4)从所接收的帧中移除VID-T；将未标记的帧添加到转发组。
(5)使用VID的安全关联将所接收的帧的密文解密；所得帧未加标记并被添加到转发组。
(6)使用VID的安全关联将所接收的帧的密文解密；用VID-T标记所得帧并将其添加到转发组。
在当前的优选实施例中，在任何转发组中可至多有三个帧，以对应于可代表一VLAN的三类不同的LAN区段。转发过程按如下方式转发所述转发组的帧：
(1)转发过程将转发组中的未标记型帧(如果有的话)排队，以供在Q中的属于VID的未标记组的每个端口处进行传输。
(2)转发过程将转发组中的VLAN标记型帧(如果有的话)排队，以供在Q中的属于VID的标记组的每个端口处进行传输。
(3)转发过程将转发组中的封装型帧(如果有的话)排队，以供在Q中的属于VID的封装组的每个端口处进行传输。
帧传送
在一桥接加密VLAN内，采取措施以消除在表示相同VLAN的LAN区段之间的冗余传送过程。例如，在桥接VLAN中需要避免不止一次地将未封装帧传送到VLAN的封装区段，原因在于每次传送都要求加密。封装过程应仅进行一次，并为所有桥接器的属于VLAN的封装组的所有出口端口(egress port)所共享。类似地，希望避免经过桥接器时反复的拆封，因为每次都要求解密。
例如，就图4的桥接LAN来说。假定无线汇聚链接43所连接到的桥接器1(41)和2(42)的端口属于VLAN B 44的封装组。如果汇聚链接45仅传送VLAN标记型帧，则属于VLAN B且于桥接器1处所接收的帧必须在桥接器1和2处被封装。然而，如果汇聚链接传送封装型帧，则仅需要在桥接器1处进行封装而桥接器2可共享其。
仍存在在桥接LAN中封装过程进行地过早从而毫无必要地经由汇聚链接发送封装型帧的情况。对于每个VLAN均存在一个可将加密操作减至最少的封装与拆封的传送点。传送点协议(下文将论述)推断出区段之间的此传送点。
传送点协议
最小生成树算法可将任何桥接LAN简化为一生成树，所述生成树的节点为桥接器且其边缘为汇聚链接。生成树导出桥接器的偏序(partial order)。例如，假设偏序为B1＜B2，其中在所述生成树中桥接器B1为B2的父节点。最小的桥接器为所述生成树的根。桥接器组与偏序一同定义一个完整的偏序集(partially ordered set)。桥接器的每个非空子集都具有一个最小上界。
就在生成树根部接收到的帧来说，要求接收到的VLAN帧属于代表所述VLAN的LAN区段之一的所有桥接器的最小上界即为将所接收帧转换成该LAN区段的帧的传送点。
传送点协议(TPP)包含两个链路层协议，TPP-T用于将出站汇聚端口添加到VLAN的标记组，而TPP-E用于将出站汇聚端口添加到VLAN的封装组。所述汇聚端口遍布于桥接所述VLAN的所有桥接器中。例如，TPP-E判定了将图4中的桥接器1连接到桥接器2的出站汇聚端口必须是VLAN B的封装组的一个成员。以此方式，桥接器2处的无线汇聚端口可共享由桥接器1为其出站无线汇聚端口所执行的封装。
TPP假设每个存取链路端口在执行之前都已被分配至VLAN的标记、未标记或封装组，原因在于TPP要使用此信息来推断桥接VLAN中的出站汇聚端口所属的组。TPP-E可将一出站汇聚端口分配至VLAN的封装组，而TPP-T可将相同的出站端口分配至VLAN的标记组。
TPP具有两种帧类型：通告帧与应答帧。每一所述帧皆含有一个VLAN ID与一个源桥接器路由选择通路，其中所述通路中的每一项是含有一个桥接器MAC地址及三个比特(其中每个比特用于每一LAN区段类型，即，标记、未标记和封装)的独特对组。当且仅当定址于所述对组中的桥接器具有一处于所述帧中所特定指出的VLAN的标记组中的存取端口时，所述标记比特才为高。以类似方式设定所述未标记和封装比特。
一桥接器针对其所知的每个VLAN经由其每个出站汇聚端口将一TPP通告帧(例如，GARP PDU)发送到一TPP组地址(例如，GARP应用地址)。当一桥接器接收到一通告帧，其将其自身的有关所接收的指定VLAN的对组附加到通路右侧，并将所述帧转发到其除了接收汇聚端口之外的每个启用的出站汇聚端口。如果其不具有其它此类端口，则其将最终路由选择通路和所接收的VID置于一TPP应答帧中发送到在路由选择通路中先于其的MAC地址。通告帧的起始桥接器创建一个仅由其自身的对组所组成的通路。当桥接器在一入站汇聚端口上接收到一TPP应答帧时，其将该应答帧转发到在通路中先于其的桥接器MAC地址。如果没有，则所述帧会被丢弃。
TPP-E
当一桥接器在汇聚端口上接收到一TPP应答帧时，其将汇聚端口的出站端口添加到所述帧中的VID的封装组，此操作的条件为：当且仅当在路由选择通路中其后的桥接器B的封装比特为高，且
a)接收桥接器具有所述VID的标记或未标记存取端口，且在路由选择通路中于所述桥接器之后(直至且包括B)没有任何桥接器具有高的标记或未标记比特；或
b)接收桥接器具有所述VID的封装存取端口，或在路由选择通路中在所述接收桥接器之前为一具有高封装比特的桥接器。
TPP-T
当一桥接器在汇聚端口上接收到一TPP应答帧时，其将所述汇聚端口的出站端口添加到所述帧中的VID的标记组，此操作的条件为：当且仅当在路由选择通路中其后的桥接器B的标记或未标记比特为高，且
a)接收桥接器具有所述VID的封装存取端口，且在路由选择通路中于所述桥接器之后(直至且包括B)没有任何桥接器具有高的封装比特；或
b)接收桥接器具有所述VID标记或未标记存取端口，或在路由选择通路中在所述接收桥接器之前为一具有高的标记或未标记比特的桥接器。
                               实例
                               实例1
就桥接单一VLAN来说。假定每个存取端口皆属于此VLAN。因而，在实例中省略了端口的VLAN标签。而是出站汇聚端口被标签为LAN区段类型，即T(标记)、U(未标记)和E(封装)。如果一出站端口被标签为(例如)U，则所述端口属于VLAN的未标记组。
最初，根据VLAN的每个存取端口所属的组类型而为其加标签(label)。汇聚端口最初是未标签的。TPP负责为所述汇聚端口推断标签。图5展示VLAN 50的桥接，其中两个桥接器51、52通过汇聚链接53而彼此相连接。每个桥接器具有两个存取端口。因为每个桥接器具有未标记与封装存取端口，所以TPP推断所述汇聚链接的出站端口属于VLAN的标记和封装组两者。各个入站端口也属于这些组。
各个出站端口为根据TPP-T(b)规则的标记组的成员。当各个桥接器起始一TPP通告帧时，其推断出此事实。因此，由每个桥接器所执行的加密与解密均可与另一桥接器共享。
                               实例2
在图6中，桥接器1(61)具有一未标记存取端口，且桥接器2(62)具有一封装存取端口。因此，桥接器1的出站端口63为根据TPP-E(a)规则的封装组的成员，而桥接器2的出站端口64为根据TPP-T(a)规则的标记组的成员。
                               实例3
图7说明一纯封装汇聚链接。该链接上的所有的帧均经封装，然而，在桥接器2或3处并未进行加密。
图8展示当图7的桥接器1(71)向VLAN起始通告帧时(假定其在此实例中称为“B”)，桥接器1(71)、2(72)和3(73)之间的TPP消息交换。
                          实例4
如果互换图7中桥接器1(71)和2(72)，则结果得到图9的桥接加密VLAN。
                          实例5
图10展示具有三个汇聚端口的桥接器82，各个汇聚端口连接到另一桥接器81、83、84。从桥接器4(84)的汇聚端口的出站端口属于标记和封装组，而连接到桥接器4的入站端口的桥接器2(82)的出站端口仅为封装组的成员。
TPP可重复地运行以推断传送点的变化。其运行频率及其所影响桥接器的数量取决于存取链路的移位。例如，如果一端站为无线的，则所述端站相对于所述桥接LAN的移动可引起其封装存取链路被重定位。直至重新运行TPP，VLAN都会有冗余传送。
一桥接VLAN可由不参与TPP的桥接器组成。一般而言，可能存在一或多个具有连接到传统VLAN桥接器的汇聚端口的加密VLAN桥接器。如果相反地将各个此类汇聚端口看作虚拟标记存取端口(一端口对应每个可经由汇聚链接发送的VLAN标记)的集合，则仍可运行TPP以在参与桥接器之间推断传送点。然而，在整个桥接LAN上可能存在冗余的传送。例如，如果一未参与的核心交换机将两个加密VLAN桥接器(各具有一个在相同VLAN的封装组中的存取端口)相分离，则在这些封装区段之间的通信量一旦进入所述核心交换机会被解密且接着在离开之后会被重新加密。可观察到：如果核心交换机中没有任何属于VLAN的标记或未标记组的存取端口，则无需加密或解密步骤。在此情形中，TPP可将用于各个VLAN标记的虚拟存取端口当作一封装存取端口而非标记存取端口。而后，两个封装区段之间的所有通信量均可作为封装型帧透明地穿过核心交换机，因为每个封装型帧都是VLAN-标记型帧。
群组安全性
一个加密VLAN v定义为具有独特安全关联的m个站之群组。所述关联由下述内容组成：
a)一加密密钥Kv；
b)一认证码密钥K′v；
c)一分配密钥K″v；及
d)m个随机值R1、R2、...Rm。
所述加密密钥为由可识别v的桥接器(v-aware bridge)和v的站用来加密并解密属于v的帧的对称密钥。所有可识别v的桥接器和v的站均使用K′v对v的经加密帧进行认证码计算和验证。
m个站中的每个站都有一个随机值。所述群组的第j个站了解除了Rj之外的所有的m个随机值。其所知的m-1个随机值是由可识别v的桥接器传递给其的。通过使用分配密钥K″v的加密来确保所述随机值的私密性，同时由使用认证码密钥K′v对所得密文进行计算得的认证码来确保其真实性。
加入一个加密VLAN
加入一个加密VLAN是由一个两步规程来实现：
将一个新的站添加入所述群组；并且
启用所述群组中的所有其它站以随后消除所述新的站。
一个用户的站通过一个双向认证协议而加入一加密VLAN v，所述双向认证协议在用户(经由所述站)与驻留在可识别v的桥接器上的认证器(authenticator)之间执行。如果双向认证成功，则在所述桥接器与新的站之间创建一个安全短暂信道(secureephemeral channel)以将Kv、K′v及R1、R2...Rm安全地从桥接器传送到所述站。接着，执行所述加入规程的第二步骤。否则，所述规程立即终止。在所述第二步骤中，相同的可识别v的桥接器为新的站选择一个新的随机值Rm+1，并将其置于一个广播帧中分配到所有可识别v的桥接器和组成v的站，该广播帧根据K″v加密并携带有使用K′v对密文进行计算所得的认证码。而后，桥接器为v创建一个新的分配密钥并将其置于一个广播帧中分配到所有可识别v的桥接器及v的成员(包括所述新站)，该广播帧根据Kv加密并携带有使用K′v对密文进行计算所得的认证码。
尽管所述新站可验证含有其自身随机值Rm+1的广播的真实性，但是由于所述新站不拥有密钥K″v，因而无法解密所述广播。
离开加密VLAN
所述站的子群(subgroup)可同时(可能偶然地)离开加密VLAN v。假定一个群组的站1，...，k离开。当此情况产生时，一个可识别v的桥接器侦测此情况且而后经由单一广播帧来通告站1，...，k的离开，所述单一广播帧包括使用K′v对所述帧进行计算所得的认证码。此广播将站1，...，k的离开通报给每个可识别v的桥接器和所述群组中的每个站。而后，每个此类桥接器和站试图将v的加密密钥、认证码密钥和分配密钥进行密钥更新(rekey)，该等密钥各自作为旧密钥和随机值R1，...Rk的函数。结果，v中的每个可识别v的桥接器和所有剩余站将共享新的安全关联，并包括较少的k个随机值。
与站不同，每个可识别v的桥接器总是具有v的当前分配密钥。因此每个此类桥接器总是具有任何离开v的子群的的随机值的全集，从而允许其总可将v的密钥进行密钥更新。然而，对于所述站来说，情形不同。密钥更新是这些站所不具有的离开的站的随机值的函数。因此，其无法进行密钥更新。此外，保证了转发机密(forward secracy)。由于随后进行的密钥更新，一已离开的站无法再次成为v的组成部分。其原因在于密钥更新是当前密钥的函数，此意味着此后到达的所有密钥将总是此站所未知的随机值的函数。仅可通过再加入v才能使此站再次成为v的成员。
尽管已参考优选实施例对本发明加以描述，但是所属领域技术人员易了解：在不脱离本发明的精神及范畴的前提下，其它应用可替代本文中所陈述应用。因此，本发明应仅由上文所包括的权利要求所限定。

Claims (1)

1.一种用于在桥接加密VLAN中发送帧的方法，其包含如下步骤：
提供根据IEEE802.1Q VLAN桥接模型的一未标记型帧和一标记型帧；
提供一加密封装型帧，所述封装型帧是一标记型帧，其具有一VLAN标记，所述VLAN标记不同于属于所述VLAN的未加密标记型帧中所使用的所有标记；
提供一汇聚端口，所述汇聚端口被分为入站汇聚端口与出站汇聚端口；
为表示一桥接加密VLAN的每个区段提供所述未标记、标记和封装帧类型中的一个类型；和
基于未封装区段和封装区段各自的VLAN标记，在一相同VLAN的一未封装区段与一封装区段之间传送通信量。
CN2006101502922A 2002-11-01 2003-10-30 桥接加密vlan Expired - Fee Related CN1976317B (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US10/286,634 US7120791B2 (en) 2002-01-25 2002-11-01 Bridged cryptographic VLAN
US10/286,634 2002-11-01

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
CN2003801024431A Division CN1708940B (zh) 2002-11-01 2003-10-30 桥接加密vlan

Publications (2)

Publication Number Publication Date
CN1976317A CN1976317A (zh) 2007-06-06
CN1976317B true CN1976317B (zh) 2010-07-21

Family

ID=32312079

Family Applications (2)

Application Number Title Priority Date Filing Date
CN2003801024431A Expired - Fee Related CN1708940B (zh) 2002-11-01 2003-10-30 桥接加密vlan
CN2006101502922A Expired - Fee Related CN1976317B (zh) 2002-11-01 2003-10-30 桥接加密vlan

Family Applications Before (1)

Application Number Title Priority Date Filing Date
CN2003801024431A Expired - Fee Related CN1708940B (zh) 2002-11-01 2003-10-30 桥接加密vlan

Country Status (6)

Country Link
US (3) US7120791B2 (zh)
EP (1) EP1556990B1 (zh)
JP (1) JP4447463B2 (zh)
CN (2) CN1708940B (zh)
AU (1) AU2003294242A1 (zh)
WO (1) WO2004042984A2 (zh)

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7986937B2 (en) 2001-12-20 2011-07-26 Microsoft Corporation Public access point
US7120791B2 (en) * 2002-01-25 2006-10-10 Cranite Systems, Inc. Bridged cryptographic VLAN
US7188364B2 (en) * 2001-12-20 2007-03-06 Cranite Systems, Inc. Personal virtual bridged local area networks
US7546458B1 (en) * 2002-05-04 2009-06-09 Atheros Communications, Inc. Method for organizing virtual networks while optimizing security
US7567510B2 (en) * 2003-02-13 2009-07-28 Cisco Technology, Inc. Security groups
US7640359B1 (en) * 2003-09-19 2009-12-29 At&T Intellectual Property, I, L.P. Method, system and computer program product for facilitating the design and assignment of ethernet VLANs
US20050144459A1 (en) * 2003-12-15 2005-06-30 Zeewaves Systems, Inc. Network security system and method
US20050138171A1 (en) * 2003-12-19 2005-06-23 Slaight Thomas M. Logical network traffic filtering
US20050141567A1 (en) * 2003-12-29 2005-06-30 Abed Jaber Extending Ethernet-over-SONET to provide point-to-multipoint service
US8838963B2 (en) * 2005-02-04 2014-09-16 Apple Inc. Security enhancement arrangement
US8654777B2 (en) * 2005-03-31 2014-02-18 Alcatel Lucent Methods and apparatus for realizing a configurable multi-bridge
US7822982B2 (en) * 2005-06-16 2010-10-26 Hewlett-Packard Development Company, L.P. Method and apparatus for automatic and secure distribution of a symmetric key security credential in a utility computing environment
US20070002737A1 (en) * 2005-06-29 2007-01-04 Manoj Paul Access control dissemination
CN1333565C (zh) * 2005-10-20 2007-08-22 华为技术有限公司 一种报文转发的实现方法、接入网及网络设备
US8000344B1 (en) * 2005-12-20 2011-08-16 Extreme Networks, Inc. Methods, systems, and computer program products for transmitting and receiving layer 2 frames associated with different virtual local area networks (VLANs) over a secure layer 2 broadcast transport network
US20070204158A1 (en) * 2006-02-28 2007-08-30 Symbol Technologies, Inc. Methods and apparatus for encryption key management
US7953089B1 (en) * 2006-05-16 2011-05-31 Cisco Technology, Inc. Systems and methods for multicast switching in a private VLAN
CN101090403B (zh) * 2006-06-15 2010-12-29 中兴通讯股份有限公司 一种在聚合端口的访问控制列表的装置及其实现方法
FR2902587B1 (fr) * 2006-06-16 2008-10-17 Alcatel Sa Dispositif de mise en communication de reseaux locaux par un commutateur exclusif et systeme de mise en communication correspondant ainsi qu'un support d'informations et un programme d'ordinateur
US20080184332A1 (en) * 2007-01-31 2008-07-31 Motorola, Inc. Method and device for dual authentication of a networking device and a supplicant device
US8358591B2 (en) * 2007-06-06 2013-01-22 Hewlett-Packard Development Company, L.P. Network traffic monitoring in a server network environment
US8693372B2 (en) * 2009-01-29 2014-04-08 Qualcomm Incorporated Methods and apparatus for forming, maintaining and/or using overlapping networks
CN101807998A (zh) * 2009-02-13 2010-08-18 英飞凌科技股份有限公司 认证
US8806190B1 (en) 2010-04-19 2014-08-12 Amaani Munshi Method of transmission of encrypted documents from an email application
CN103416025B (zh) * 2010-12-28 2016-11-02 思杰系统有限公司 用于经由云桥添加vlan标签的系统和方法
US9531567B2 (en) * 2012-07-03 2016-12-27 Mitsubishi Electric Corporation Network system
US9019967B2 (en) * 2012-07-30 2015-04-28 Dell Products L.P. VLAN advertisement and automated configuration
CN102932229B (zh) * 2012-11-20 2015-08-12 成都卫士通信息产业股份有限公司 一种对数据包进行加解密处理的方法
US8874898B2 (en) * 2012-12-14 2014-10-28 Intel Corporation Power line based theft protection of electronic devices
US10382228B2 (en) * 2014-06-26 2019-08-13 Avago Technologies International Sales Pte. Limited Protecting customer virtual local area network (VLAN) tag in carrier ethernet services
WO2016026112A1 (zh) 2014-08-21 2016-02-25 华为技术有限公司 一种频率复用方法及相关装置
US9710675B2 (en) 2015-03-26 2017-07-18 Intel Corporation Providing enhanced replay protection for a memory
US9792229B2 (en) * 2015-03-27 2017-10-17 Intel Corporation Protecting a memory
US10523636B2 (en) * 2016-02-04 2019-12-31 Airwatch Llc Enterprise mobility management and network micro-segmentation
US10404648B2 (en) * 2016-02-26 2019-09-03 Nokia Of America Corporation Addressing for customer premises LAN expansion
US20220038443A1 (en) * 2020-08-03 2022-02-03 KELVIN r. FRANKLIN Methods and systems of a packet orchestration to provide data encryption at the ip layer, utilizing a data link layer encryption scheme
CN113098856B (zh) * 2021-03-29 2023-01-17 绿盟科技集团股份有限公司 一种透明模式下的虚拟专用网络vpn实现方法及安全设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1312631A (zh) * 2000-03-02 2001-09-12 阿尔卡塔尔互联网运行公司 数据通信交换机的优先权重新映射
CN1333613A (zh) * 2000-07-07 2002-01-30 冲电气工业株式会社 能够发送标记帧的虚拟局域网系统
US6414956B1 (en) * 1999-12-17 2002-07-02 Texas Instruments Incorporated VLAN tag transport within a switch
CN1356806A (zh) * 2001-12-31 2002-07-03 刘军民 实现局域网虚通道传送的数据转发方法

Family Cites Families (100)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4919545A (en) * 1988-12-22 1990-04-24 Gte Laboratories Incorporated Distributed security procedure for intelligent networks
EP0520709A3 (en) * 1991-06-28 1994-08-24 Digital Equipment Corp A method for providing a security facility for remote systems management
US5577209A (en) * 1991-07-11 1996-11-19 Itt Corporation Apparatus and method for providing multi-level security for communication among computers and terminals on a network
US5963556A (en) * 1993-06-23 1999-10-05 Digital Equipment Corporation Device for partitioning ports of a bridge into groups of different virtual local area networks
US5550984A (en) * 1994-12-07 1996-08-27 Matsushita Electric Corporation Of America Security system for preventing unauthorized communications between networks by translating communications received in ip protocol to non-ip protocol to remove address and routing services information
US5764890A (en) * 1994-12-13 1998-06-09 Microsoft Corporation Method and system for adding a secure network server to an existing computer network
US5790800A (en) * 1995-10-13 1998-08-04 Digital Equipment Corporation Client application program mobilizer
US6035105A (en) * 1996-01-02 2000-03-07 Cisco Technology, Inc. Multiple VLAN architecture system
US5822431A (en) * 1996-01-19 1998-10-13 General Instrument Corporation Of Delaware Virtual authentication network for secure processors
US6085238A (en) * 1996-04-23 2000-07-04 Matsushita Electric Works, Ltd. Virtual LAN system
US5918019A (en) * 1996-07-29 1999-06-29 Cisco Technology, Inc. Virtual dial-up protocol for network communication
JP2974280B2 (ja) * 1996-09-11 1999-11-10 日本電気通信システム株式会社 ネットワーク接続のブリッジ装置における仮想グループ情報管理方法
US6311218B1 (en) * 1996-10-17 2001-10-30 3Com Corporation Method and apparatus for providing security in a star network connection using public key cryptography
JPH10136438A (ja) 1996-10-24 1998-05-22 Oki Electric Ind Co Ltd 簡易型携帯無線システムおよびその基地局制御方法
US6157647A (en) * 1996-11-06 2000-12-05 3Com Corporation Direct addressing between VLAN subnets
US6041358A (en) 1996-11-12 2000-03-21 Industrial Technology Research Inst. Method for maintaining virtual local area networks with mobile terminals in an ATM network
US6070243A (en) * 1997-06-13 2000-05-30 Xylan Corporation Deterministic user authentication service for communication network
FI117366B (fi) * 1997-06-30 2006-09-15 Sonera Smarttrust Oy Menetelmä tietoturvallisen palveluyhteyden muodostamiseksi tietoliikennejärjestelmässä
US6061796A (en) * 1997-08-26 2000-05-09 V-One Corporation Multi-access virtual private network
US5978378A (en) * 1997-09-11 1999-11-02 3Com Corporation Method and apparatus for VLAN support
US6047325A (en) * 1997-10-24 2000-04-04 Jain; Lalit Network device for supporting construction of virtual local area networks on arbitrary local and wide area computer networks
US6035405A (en) * 1997-12-22 2000-03-07 Nortel Networks Corporation Secure virtual LANs
US6226751B1 (en) * 1998-04-17 2001-05-01 Vpnet Technologies, Inc. Method and apparatus for configuring a virtual private network
US6898791B1 (en) * 1998-04-21 2005-05-24 California Institute Of Technology Infospheres distributed object system
US6728249B2 (en) * 1998-06-27 2004-04-27 Intel Corporation System and method for performing cut-through forwarding in an ATM network supporting LAN emulation
US6181699B1 (en) * 1998-07-01 2001-01-30 National Semiconductor Corporation Apparatus and method of assigning VLAN tags
US6304973B1 (en) * 1998-08-06 2001-10-16 Cryptek Secure Communications, Llc Multi-level security network system
CA2345241A1 (en) * 1998-09-22 2000-03-30 Science Applications International Corporation User-defined dynamic collaborative environments
US6839759B2 (en) * 1998-10-30 2005-01-04 Science Applications International Corp. Method for establishing secure communication link between computers of virtual private network without user entering any cryptographic information
US6615357B1 (en) * 1999-01-29 2003-09-02 International Business Machines Corporation System and method for network address translation integration with IP security
US6636898B1 (en) * 1999-01-29 2003-10-21 International Business Machines Corporation System and method for central management of connections in a virtual private network
US6081900A (en) * 1999-03-16 2000-06-27 Novell, Inc. Secure intranet access
US6970459B1 (en) * 1999-05-13 2005-11-29 Intermec Ip Corp. Mobile virtual network system and method
US6847620B1 (en) * 1999-05-13 2005-01-25 Intermec Ip Corp. Mobile virtual LAN
US6675225B1 (en) * 1999-08-26 2004-01-06 International Business Machines Corporation Method and system for algorithm-based address-evading network snoop avoider
US6917614B1 (en) * 1999-09-17 2005-07-12 Arris International, Inc. Multi-channel support for virtual private networks in a packet to ATM cell cable system
JP2001160828A (ja) * 1999-12-03 2001-06-12 Matsushita Electric Ind Co Ltd セキュリティ・ゲートウェイ装置におけるｖｐｎ通信方法
US6970941B1 (en) * 1999-12-10 2005-11-29 Sun Microsystems, Inc. System and method for separating addresses from the delivery scheme in a virtual private network
US6697943B1 (en) * 1999-12-17 2004-02-24 Cisco Technology, Inc. Use of cyclic redundancy checking for segregating control traffic
GB2364477B (en) * 2000-01-18 2003-11-05 Ericsson Telefon Ab L M Virtual private networks
US6639901B1 (en) * 2000-01-24 2003-10-28 3Com Corporation Apparatus for and method for supporting 802.1Q VLAN tagging with independent VLAN learning in LAN emulation networks
US6961762B1 (en) * 2000-02-14 2005-11-01 Sygate Technologies, Inc. Automatic switching network points based on configuration profiles
US7173923B2 (en) * 2000-03-17 2007-02-06 Symbol Technologies, Inc. Security in multiple wireless local area networks
US7181542B2 (en) * 2000-04-12 2007-02-20 Corente, Inc. Method and system for managing and configuring virtual private networks
US6978364B1 (en) * 2000-04-12 2005-12-20 Microsoft Corporation VPN enrollment protocol gateway
US6981041B2 (en) * 2000-04-13 2005-12-27 Aep Networks, Inc. Apparatus and accompanying methods for providing, through a centralized server site, an integrated virtual office environment, remotely accessible via a network-connected web browser, with remote network monitoring and management capabilities
US20020022483A1 (en) 2000-04-18 2002-02-21 Wayport, Inc. Distributed network communication system which allows multiple wireless service providers to share a common network infrastructure
US6651573B2 (en) * 2000-05-26 2003-11-25 Bombardier Motor Corporation Of America Personal watercraft
US7055171B1 (en) * 2000-05-31 2006-05-30 Hewlett-Packard Development Company, L.P. Highly secure computer system architecture for a heterogeneous client environment
JP3585422B2 (ja) 2000-06-01 2004-11-04 シャープ株式会社 アクセスポイント装置及びその認証処理方法
GB2363548A (en) * 2000-06-15 2001-12-19 Int Computers Ltd Computer systems, in particular virtual private networks
US7054329B2 (en) * 2000-07-07 2006-05-30 Koninklijke Philips Electronics, N.V. Collision avoidance in IEEE 802.11 contention free period (CFP) with overlapping basic service sets (BSSs)
US7151762B1 (en) * 2000-07-14 2006-12-19 At&T Corp. Virtual streams for QoS-driven wireless LANs
US20020143960A1 (en) * 2000-08-02 2002-10-03 Erez Goren Virtual network generation system and method
US6904054B1 (en) * 2000-08-10 2005-06-07 Verizon Communications Inc. Support for quality of service and vertical services in digital subscriber line domain
US7088714B2 (en) * 2000-08-24 2006-08-08 Tasman Networks, Inc System and method for connecting geographically distributed virtual local area networks
US6954790B2 (en) * 2000-12-05 2005-10-11 Interactive People Unplugged Ab Network-based mobile workgroup system
KR100565157B1 (ko) * 2000-12-06 2006-03-30 닛본 덴끼 가부시끼가이샤 가상 사설망
US7673133B2 (en) * 2000-12-20 2010-03-02 Intellisync Corporation Virtual private network between computing network and remote device
US6912592B2 (en) * 2001-01-05 2005-06-28 Extreme Networks, Inc. Method and system of aggregate multiple VLANs in a metropolitan area network
US7209479B2 (en) * 2001-01-18 2007-04-24 Science Application International Corp. Third party VPN certification
US20020174335A1 (en) * 2001-03-30 2002-11-21 Junbiao Zhang IP-based AAA scheme for wireless LAN virtual operators
GB0109299D0 (en) 2001-04-12 2001-05-30 British Telecomm Hybrid network
US7174390B2 (en) * 2001-04-20 2007-02-06 Egenera, Inc. Address resolution protocol system and method in a virtual network
US7061899B2 (en) * 2001-05-01 2006-06-13 Hewlett-Packard Development Company, L.P. Method and apparatus for providing network security
US7003662B2 (en) * 2001-05-24 2006-02-21 International Business Machines Corporation System and method for dynamically determining CRL locations and access methods
US20020178240A1 (en) * 2001-05-24 2002-11-28 International Business Machines Corporation System and method for selectively confirming digital certificates in a virtual private network
US20020199021A1 (en) * 2001-06-26 2002-12-26 Niels Beier Method and apparatus for using the type/length field in an ethernet mac header for carrying generic tags/labels
US7107464B2 (en) * 2001-07-10 2006-09-12 Telecom Italia S.P.A. Virtual private network mechanism incorporating security association processor
US6981259B2 (en) * 2001-08-02 2005-12-27 Hewlett-Packard Development Company, L.P. System and method for generating a virtual device
US7130904B2 (en) * 2001-08-16 2006-10-31 Intel Corporation Multiple link layer wireless access point
US20030037258A1 (en) * 2001-08-17 2003-02-20 Izchak Koren Information security system and method`
US7194622B1 (en) * 2001-12-13 2007-03-20 Cisco Technology, Inc. Network partitioning using encryption
US7120791B2 (en) * 2002-01-25 2006-10-10 Cranite Systems, Inc. Bridged cryptographic VLAN
US7188364B2 (en) 2001-12-20 2007-03-06 Cranite Systems, Inc. Personal virtual bridged local area networks
US7313135B2 (en) 2002-01-31 2007-12-25 Mosaid Technologies, Inc. Trunking in a matrix
US7203957B2 (en) * 2002-04-04 2007-04-10 At&T Corp. Multipoint server for providing secure, scaleable connections between a plurality of network devices
US7277442B1 (en) 2002-04-26 2007-10-02 At&T Corp. Ethernet-to-ATM interworking that conserves VLAN assignments
US7042852B2 (en) * 2002-05-20 2006-05-09 Airdefense, Inc. System and method for wireless LAN dynamic channel change with honeypot trap
US7086089B2 (en) * 2002-05-20 2006-08-01 Airdefense, Inc. Systems and methods for network security
US7058796B2 (en) * 2002-05-20 2006-06-06 Airdefense, Inc. Method and system for actively defending a wireless LAN against attacks
US7113498B2 (en) 2002-06-05 2006-09-26 Broadcom Corporation Virtual switch
US7093027B1 (en) * 2002-07-23 2006-08-15 Atrica Israel Ltd. Fast connection protection in a virtual local area network based stack environment
US7062566B2 (en) * 2002-10-24 2006-06-13 3Com Corporation System and method for using virtual local area network tags with a virtual private network
US7284062B2 (en) * 2002-12-06 2007-10-16 Microsoft Corporation Increasing the level of automation when provisioning a computer system to access a network
US7478427B2 (en) * 2003-05-05 2009-01-13 Alcatel-Lucent Usa Inc. Method and apparatus for providing adaptive VPN to enable different security levels in virtual private networks (VPNs)
EP1692595A2 (en) * 2003-11-04 2006-08-23 Nexthop Technologies, Inc. Secure, standards-based communications across a wide-area network
US7164912B2 (en) * 2004-01-07 2007-01-16 Research In Motion Limited Apparatus, and associated method, for facilitating selection by a mobile node of a network through which to communicate using a hierarchical selection process
US20050226257A1 (en) * 2004-03-30 2005-10-13 Adc Broadband Access Systems, Inc. Virtual local area network
US20050283604A1 (en) * 2004-06-21 2005-12-22 Ipolicy Networks, Inc., A Delaware Corporation Security association configuration in virtual private networks
JP4407452B2 (ja) * 2004-09-29 2010-02-03 株式会社日立製作所 サーバ、ｖｐｎクライアント、ｖｐｎシステム、及びソフトウェア
US7292592B2 (en) * 2004-10-08 2007-11-06 Telefonaktiebolaget Lm Ericsson (Publ) Home network-assisted selection of intermediary network for a roaming mobile terminal
US7434047B2 (en) 2004-12-30 2008-10-07 Nokia, Inc. System, method and computer program product for detecting a rogue member in a multicast group
CN100377548C (zh) 2005-07-15 2008-03-26 华为技术有限公司 一种实现虚交换的方法和装置
US7746892B2 (en) 2005-11-02 2010-06-29 Nortel Networks Limited Method and apparatus for transporting ethernet services
US20070271606A1 (en) * 2006-05-17 2007-11-22 Amann Keith R Apparatus and method for establishing a VPN tunnel between a wireless device and a LAN
US7693985B2 (en) 2006-06-09 2010-04-06 Cisco Technology, Inc. Technique for dispatching data packets to service control engines
US8181009B2 (en) 2009-03-03 2012-05-15 Harris Corporation VLAN tagging over IPSec tunnels
US8098656B2 (en) 2009-06-26 2012-01-17 Avaya, Inc. Method and apparatus for implementing L2 VPNs on an IP network
US8837281B2 (en) * 2010-09-10 2014-09-16 Futurewei Technologies, Inc. Use of partitions to reduce flooding and filtering database size requirements in large layer two networks

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6414956B1 (en) * 1999-12-17 2002-07-02 Texas Instruments Incorporated VLAN tag transport within a switch
CN1312631A (zh) * 2000-03-02 2001-09-12 阿尔卡塔尔互联网运行公司 数据通信交换机的优先权重新映射
CN1333613A (zh) * 2000-07-07 2002-01-30 冲电气工业株式会社 能够发送标记帧的虚拟局域网系统
CN1356806A (zh) * 2001-12-31 2002-07-03 刘军民 实现局域网虚通道传送的数据转发方法

Also Published As

Publication number Publication date
JP2006505222A (ja) 2006-02-09
US7120791B2 (en) 2006-10-10
US20030145118A1 (en) 2003-07-31
US20080022390A1 (en) 2008-01-24
EP1556990A4 (en) 2011-08-17
US20110033047A1 (en) 2011-02-10
US7818796B2 (en) 2010-10-19
CN1708940A (zh) 2005-12-14
WO2004042984A3 (en) 2004-12-23
WO2004042984A2 (en) 2004-05-21
EP1556990A2 (en) 2005-07-27
AU2003294242A1 (en) 2004-06-07
CN1708940B (zh) 2011-12-14
JP4447463B2 (ja) 2010-04-07
US8347377B2 (en) 2013-01-01
CN1976317A (zh) 2007-06-06
AU2003294242A8 (en) 2004-06-07
EP1556990B1 (en) 2017-02-22

Similar Documents

Publication Publication Date Title
CN1976317B (zh) 桥接加密vlan
US7703132B2 (en) Bridged cryptographic VLAN
CN101741547B (zh) 节点间保密通信方法及系统
CN101141241B (zh) 实现mac安全的方法以及网络设备
CN102130768B (zh) 一种具有链路层加解密能力的终端设备及其数据处理方法
US7979693B2 (en) Relay apparatus for encrypting and relaying a frame
US8379638B2 (en) Security encapsulation of ethernet frames
CN101843031A (zh) 用于提供安全网络通信的系统和方法
CN102035845B (zh) 支持链路层保密传输的交换设备及其数据处理方法
CN101103593B (zh) 鉴别多播消息的方法
US7039190B1 (en) Wireless LAN WEP initialization vector partitioning scheme
CN110383280A (zh) 用于为时间感知的端到端分组流网络提供网络安全性的方法和装置
CN105611529A (zh) Capwap dtls报文加解密的芯片实现方法
CN107306198A (zh) 报文转发方法、设备和系统
CN101854244A (zh) 一种三段式安全网络架构建立和保密通信方法及其系统
CN116015943A (zh) 一种基于多级隧道混淆的隐私保护方法
CN101834722A (zh) 一种加密设备和非加密设备混合组网的通信方法
US20240015009A1 (en) AUTOMATIC IN-BAND MEDIA ACCESS CONTROL SECURITY (MACsec) KEY UPDATE FOR RETIMER DEVICE
CN114567478A (zh) 通信方法及装置
CN110650016A (zh) 一种实现交直流控制保护系统网络数据安全的方法
JP2004104500A (ja) 通信方法、ブリッジ装置及び端末装置

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 1100111

Country of ref document: HK

ASS Succession or assignment of patent right

Owner name: MICROSOFT CORP.

Free format text: FORMER OWNER: CLAYTON KNIGHT SYSTEM HOUSE

Effective date: 20090508

C41 Transfer of patent application or patent right or utility model
TA01 Transfer of patent application right

Effective date of registration: 20090508

Address after: Washington State

Applicant after: Microsoft Corp.

Address before: San Jose, California, USA

Applicant before: Cranite Systems Inc.

C14 Grant of patent or utility model
GR01 Patent grant
REG Reference to a national code

Ref country code: HK

Ref legal event code: GR

Ref document number: 1100111

Country of ref document: HK

ASS Succession or assignment of patent right

Owner name: MICROSOFT TECHNOLOGY LICENSING LLC

Free format text: FORMER OWNER: MICROSOFT CORP.

Effective date: 20150506

C41 Transfer of patent application or patent right or utility model
TR01 Transfer of patent right

Effective date of registration: 20150506

Address after: Washington State

Patentee after: Micro soft technique license Co., Ltd

Address before: Washington State

Patentee before: Microsoft Corp.

CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20100721

Termination date: 20181030