Extended Private LAN

Abstract

A virtual private network is provided across a Provider Link State Bridging (PLSB) network between a first node connected to a private LAN and a second node connected to a roaming device. The roaming device is authenticated. A successful authentication results in a Service Identifier for the VPN being sent to the second node. Connectivity between members of the VPN service instance is maintained as part of the PLSB Link State process for forwarding table maintenance, rather than by any form of explicit signalling. A single Customer Virtual Bridge/Virtual Switch Instance can be located at the first node to provide point-to-point connectivity to each roaming device. A virtual Residential Gateway function can be combined with the Customer Virtual Bridge/Virtual Switch Instance.

1 . In a Provider Link State Bridging (PLSB) network, a method of providing an instance of a virtual private Ethernet switching service between a private LAN attached to a first node of the PLSB network and at least one roaming device attached to a respective second node of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different network users, a first I-SID identifier being allocated to traffic of the virtual private Ethernet switching service instance, the method comprising:
 receiving a request to authenticate the roaming device for access to the virtual private Ethernet switching service from the second node;   sending the first I-SID to the second node upon a successful authentication.   
     
     
         2 . The method according to  claim 1 , the method further comprising authenticating the roaming device for access to the virtual private Ethernet switching service. 
     
     
         3 . The method according to  claim 2 , wherein the step of authenticating the roaming device uses a standard authentication protocol that has been adapted to return an I-SID. 
     
     
         4 . The method according to  claim 3 , wherein the authentication protocol is one of: RADIUS, DIAMETER. 
     
     
         5 . The method according to  claim 2 , wherein the step of authenticating the roaming device is performed at an authentication server. 
     
     
         6 . The method according to  claim 5 , wherein the first I-SID is sent to the second node from the authentication server. 
     
     
         7 . The method according to  claim 1 , wherein the step of sending the first I-SID to the second node comprises sending the first I-SID in the form of a parameter to enable the attachment of the roaming device to the network. 
     
     
         8 . The method according to  claim 1 , the method further comprising providing a virtual bridging function at the first node. 
     
     
         9 . The method according to  claim 8 , the method further comprising bridging traffic at the virtual bridging function between the private LAN and the PLSB path to each second node. 
     
     
         10 . The method according to  claim 8 , further comprising:
 providing a Virtual Residential Gateway as a virtual port attached to the virtual bridging function, the Virtual Residential Gateway providing access to a Layer 3 network; and   routing traffic of the virtual private Ethernet switching service instance, which is destined for the Layer 3 network, through the Virtual Residential Gateway.   
     
     
         11 . The method according to  claim 10  wherein the Layer 3 network is the Internet. 
     
     
         12 . The method according to  claim 8 , the method further comprising:
 providing a further service for any of: the private LAN and the at least one roaming device, the further service being provided as a virtual port attached to the virtual bridging function.   
     
     
         13 . The method according to  claim 12  wherein the further service comprises at least one of: video-on-demand, Voice over Internet Protocol (VoIP), Internet Protocol Television (IPTV). 
     
     
         14 . The method according to  claim 1  wherein the private LAN serves a private premises and the roaming device is a device associated with the private premises. 
     
     
         15 . Apparatus for providing an instance of a virtual private Ethernet switching service between a private LAN attached to a first node of a PLSB network and at least one roaming device attached to a respective second node of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different network users, a first I-SID identifier being allocated to traffic of the virtual private Ethernet switching service instance, the apparatus being configured to:
 receive a request to authenticate the roaming device for access to the virtual private Ethernet switching service from the second node; and   send the first I-SID to the second node upon a successful authentication.   
     
     
         16 . The apparatus according to  claim 15 , wherein the apparatus comprises the first node of the PLSB network. 
     
     
         17 . The apparatus according to  claim 16 , wherein there is a virtual bridging function at the first node for bridging traffic of the virtual private Ethernet switching service instance. 
     
     
         18 . The apparatus according to  claim 17 , further comprising a Virtual Residential Gateway attached to the virtual bridging function which is arranged to provide a gateway to a Layer 3 network for traffic of the virtual private Ethernet switching service. 
     
     
         19 . A non-transitory computer readable medium on which is stored instructions which, when executed by a processor, cause the processor to perform the method of  claim 1 . 
     
     
         20 . In a Provider Link State Bridging (PLSB) network, a method of adding a roaming device to a virtual private Ethernet switching service instance for a private LAN connected to a first node of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different service instances, a first I-SID identifier being allocated to traffic of the virtual private Ethernet switching service instance, the method comprising establishing a PLSB path labeled by the first I-SID between the first node and a second node by, at the second node:
 receiving a request for authentication of the roaming device at the second node;   forwarding the request for authentication of the roaming device for access to the virtual private Ethernet switching service; and   receiving the first I-SID when the roaming device is authenticated.   
     
     
         21 . The method of  claim 20 , further comprising adding the first I-SID to a list of I-SIDs to be advertised into the PLSB network by the second node. 
     
     
         22 . The method of  claim 21 , further comprising advertising the first I-SID from the second node into the PLSB network via the control plane of the PLSB network to initiate establishment of the PLSB path. 
     
     
         23 . The method of  claim 22 , further comprising binding the roaming device to a PLSB UNI interface at the respective second node using the first I-SID. 
     
     
         24 . The method of  claim 20 , further comprising:
 connecting the PLSB UNI to an attachment sub-network; and   forwarding the request for authentication of the roaming device by relaying authentication messaging from the attachment sub-network.   
     
     
         25 . In a Provider Link State Bridging (PLSB) network, apparatus for adding a roaming device to a virtual private Ethernet switching service instance for a private LAN connected to a first node of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different service instances, a first I-SID identifier being allocated to traffic of the virtual private Ethernet switching service instance, the apparatus comprising, at the second node:
 an access network termination through which the roaming device can connect to the PLSB network; and   a controller operable:
 to receive a request for authentication from the roaming device at the second node; 
 to forward the request for authentication of the roaming device for access to the virtual private Ethernet switching service; and 
 to receive the first I-SID when the roaming device is authenticated. 
   
     
     
         26 . The apparatus of  claim 25 , wherein the controller is further operable to add the first I-SID to a list of I-SIDs to be advertised into the PLSB network by the respective second node. 
     
     
         27 . The apparatus of  claim 26 , wherein the controller is further operable to advertise the first I-SID into the PLSB network via the control plane of the PLSB network to initiate establishment of the PLSB path. 
     
     
         28 . The apparatus of  claim 27 , wherein the controller is further operable to bind the roaming device to a PLSB UNI interface at the respective second node using the first I-SID. 
     
     
         29 . The apparatus of  claim 25 , wherein the controller is further operable:
 to connect the PLSB UNI to an attachment sub-network; and   to forward the request for authentication of the roaming device by relaying authentication messaging from the attachment sub-network.   
     
     
         30 . In a Provider Link State Bridging (PLSB) network, a method of providing an instance of a virtual private Ethernet switching service between a private LAN connected to a first node of the PLSB network and roaming devices connected to respective second nodes of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different service instances, a respective I-SID being allocated to traffic of each virtual private Ethernet switching service instance, the method comprising:
 providing at the first node a respective virtual bridging function for each instance of the virtual private Ethernet switching service served by the first node;   receiving at the first node an I-SID advertised by a respective second node, the advertised I-SID being allocated to traffic of a virtual private Ethernet service instance served by the first node;   determining that the received I-SID was sent by a respective second node not previously associated with the virtual private Ethernet service instance at the first node; and   associating the respective second node with the virtual private Ethernet service instance at the first node.   
     
     
         31 . The method of  claim 30 , comprising establishing at the first node for an instance of the virtual private Ethernet service served by the first node a respective PLSB path between the virtual bridging function at the first node and each respective second node to establish a hub and spoke configuration between the first node and the respective second nodes for the instance of the virtual private Ethernet switching service. 
     
     
         32 . The method of  claim 30 , wherein:
 the advertising received at the first node from the respective second nodes indicates no multicast interest;   establishing a respective PLSB path comprises establishing a point-to-point path between the virtual bridging function at the first node and the respective second node; and   the first node replicates received multicast frames and unicasts the replicated frames to respective second nodes.   
     
     
         33 . The method of  claim 30 , wherein:
 the advertising received at the first node from the respective second nodes indicates multicast interest; and
 the first node multicasts received multicast frames in a split horizon mode. 
   
     
     
         34 . In a Provider Link State Bridging (PLSB) network for providing an instance of a virtual private Ethernet switching service between a private LAN connected to a first node of the PLSB network and roaming devices connected to respective second nodes of the PLSB network, the PLSB network comprising a control plane and a data plane, data packets in the PLSB network carrying I-SID identifiers to differentiate traffic of different service instances, a respective I-SID being allocated to traffic of each virtual private Ethernet switching service instance, apparatus at the first node comprising:
 an access network termination through which the private LAN can connect to the PLSB network; and   a controller operable:
 to provide a respective virtual bridging function for each instance of the virtual private Ethernet switching service served by the first node; 
 to receive an I-SID advertised by a respective second node, the advertised I-SID being allocated to traffic of a virtual private Ethernet service instance served by the first node; 
 to determine that the received I-SID was sent by a respective second node not previously associated with the virtual private Ethernet service instance at the first node; and 
 to associate the respective second node with the virtual private Ethernet service instance at the first node. 
   
     
     
         35 . The apparatus of  claim 34 , wherein the controller is operable to establish at the first node for an instance of the virtual private Ethernet service served by the first node a respective PLSB path between the virtual bridging function at the first node and each respective second node to establish a hub and spoke configuration between the first node and the respective second nodes for the instance of the virtual private Ethernet switching service. 
     
     
         36 . The apparatus of  claim 34 , wherein:
 the advertising received at the first node from the respective second nodes indicates no multicast interest; and
 the controller is operable: 
 to establish a respective PLSB path by establishing a point-to-point path between the virtual bridging function at the first node and the respective second node; 
 to replicate received multicast frames; and 
 to unicast the replicated frames to respective second nodes. 
   
     
     
         37 . The apparatus of  claim 34 , wherein:
 the advertising received at the first node from the respective second nodes indicates multicast interest; and
 the controller is operable to multicast received multicast frames in a split horizon mode. 
   
     
     
         38 . The apparatus of  claim 34 , further comprising an access router through which the private LAN can connect to a Layer 3 network. 
     
     
         39 . The apparatus of  claim 38 , wherein the access router is operable to connect the private LAN to an Internet Protocol (IP) network.