Method And System For Integrating Remote Devices Into A Domestic VLAN

Abstract

A gateway network device may establish secure connections to a plurality of remote network devices using tunneling protocols to distribute to the remote network devices multimedia content received from one or more content providers. The consumption of the multimedia content may originally be restricted to local network associated with the gateway network device. The secure connections may be set up using L2TP protocol, and the L2TP tunneling connections may be secured using IPSec protocol. Use of multimedia content may be restricted based on DRM policies of the content provider. DRM policies may be implemented using DTCP protocol, which may restrict use of the multimedia content based on roundtrip times and/or IP subnetting. Each content provider may use one or more VLAN identifiers during communication of the multimedia content to the gateway network device, and the gateway network device may associate an additional VLAN identifier with each secure connection.

What is claimed is: 
     
         1 . A method comprising:
 at a gateway network device,
 receiving from a provider data defining multimedia content; 
 forming one or more packets including portions of the data defining the multimedia content, including:
 tagging the one or more packets with a first virtual local area network (VLAN) tag for secure distribution of the multimedia content to first local area network devices; 
 tagging the one or more packets with a second VLAN identifier for secure distribution of the multimedia content to second local area network devices; and 
 
 distributing the one or more packets. 
   
     
     
         2 . The method of  claim 1  wherein tagging the one or more packets with a first VLAN tag comprises adding a VLAN tag field to the one or more packets to limit the use of the multimedia content received from the provider to network devices in a first location. 
     
     
         3 . The method of  claim 2  wherein tagging the one or more packets with a first VLAN tag comprises adding a VLAN tag field to the one or more packets to limit the use of the multimedia content received from the provider to network devices communicatively coupled to the gateway network device. 
     
     
         4 . The method of  claim 2  wherein tagging the one or more packets with a second VLAN tag comprises adding a VLAN tag field to the one or more packets to extend the use of the multimedia content received from the provider to network devices in locations other than the first location. 
     
     
         5 . The method of  claim 2  wherein tagging the one or more packets with a second VLAN tag comprises adding a VLAN tag field to the one or more packets to extend the use of the multimedia content received from the provider to network devices located remotely from the gateway network device. 
     
     
         6 . The method of  claim 1  wherein the second VLAN tag defines a second VLAN group between the gateway network device and the second local area network devices while maintaining a first VLAN group between the gateway network device and the first local area network devices use by the provider to restrict use of the multimedia content to the first local area network devices. 
     
     
         7 . The method of  claim 1  further comprising:
 receiving data defining the first VLAN tag from the provider; 
 copying the data defining the first VLAN tag to the one or more packets. 
 
     
     
         8 . The method of  claim 7  further comprising:
 receiving one or more Ethernet frames including the data defining multimedia content and the data defining the first VLAN tag; 
 copying the data defining the first VLAN tag to the one or more packets to preserve the secure distribution of the multimedia content to the first local area network devices; and 
 adding to the one or more packets a second VLAN tag to expand secure distribution of the multimedia content to the second local area network devices. 
 
     
     
         9 . The method of  claim 1  further comprising:
 receiving one or more Ethernet frames including the data defining multimedia content and data defining the first VLAN tag; 
 formatting one or more packets including:
 copying the data defining the first VLAN tag to an inner VLAN tag field of the one or more packets; 
 adding data defining the second VLAN identifier to an outer VLAN tag field of the one or more packets. 
 
 
     
     
         10 . A system comprising:
 a gateway network device configured to receive, over a network from a provider, data defining multimedia content restricted to use by first network devices on a first network managed by the gateway network device and further configured to communicate to second network devices on a second network managed by the gateway network device double-tagged virtual local area network (VLAN) packets to distribute the restricted multimedia content for use by the second network devices.   
     
     
         11 . The system of  claim 10  wherein the gateway network device comprises:
 a plurality of communication interfaces configured for data communication with the network, the first network and the second network; 
 a communication subsystem in data communication with the plurality of communication interfaces and configured for packet transmission and packet reception via the plurality of communication interfaces; and 
 a processing subsystem in data communication with the communication subsystem and configured to manage communication by the gateway network device. 
 
     
     
         12 . The system of  claim 11  wherein the processing subsystem comprises a secure tunneling management module configured to format the double-tagged VLAN packets by managing extraction of VLAN identifiers from the received data defining multimedia content, reusing the extracted VLAN identifiers and adding a second VLAN identifier to format the double-tagged VLAN packets. 
     
     
         13 . The system of  claim 11  wherein a communication interface of the plurality of communication interfaces is configured to receive Ethernet frames over the network from the provider and wherein the processing subsystem is configured to extract from the received Ethernet frames VLAN identifiers associated with the first network to permit use of the restricted multimedia content by the first network devices on the first network managed by the gateway network device and to format a transmission packet with the extracted VLAN identifiers. 
     
     
         14 . The system of  claim 10  wherein the gateway network device is configured to format the double-tagged VLAN packets with a first VLAN tag received from the provider and with a second VLAN tag which is operative to enable secure communication of the double-tagged VLAN packets to the second network devices. 
     
     
         15 . The system of  claim 14  wherein the gateway network device is further configured to designate a particular connection to a particular second network device as a secure connection and further configured to a particular second VLAN tag to a value associated with the secure particular connection. 
     
     
         16 . The system of  claim 14  wherein the gateway network device is configured to format the double-tagged VLAN packets with the first VLAN tag to limit the use of the multimedia content received from the provider to network devices in a first location and to format the double-tagged VLAN packets with the second VLAN tag to extend the use of the restricted multimedia content for use by the second network devices locations other than the first location. 
     
     
         17 . A method comprising:
 at a gateway network device,   establishing one or more secure connections between the gateway network device and one or more remote network devices, the secure connections configured to distribute multimedia content from the gateway network device to the one or more remote network devices;   receiving multimedia content from a provider;   establishing a virtual local area network (VLAN) group including the gateway network device and a first group of devices to restrict consumption of the received multimedia content to one or more devices communicatively coupled to a local network;   associating one or more different VLAN identifiers with each of the one or more secure connections;   packetizing the multimedia content into one or more packets for communication via the one or more secure connections;   tagging the one or more packets with a different VLAN identifier of the one or more different VLAN identifiers corresponding to a particular secure connection of the one or more secure connections to implement VLAN grouping between the gateway network device and one or more remote network devices of the particular secure connection; and   communicating the one or more packets via the particular secure connection to the one or more remote network devices over the particular secure connection while maintaining VLAN grouping used to restrict consumption of distributed multimedia content.   
     
     
         18 . The method of  claim 17  wherein receiving multimedia content from a provider comprises receiving multimedia content for which the use of which is restricted based on a Digital Rights Management (DRM) policy of the provider to the VLAN group. 
     
     
         19 . The method of  claim 18  wherein communicating the one or more packets to the one or more remote network devices comprises:
 communicating the one or more packets to devices which were not originally authorized under the DRM policy to consume said multimedia content; and 
 simulating requirements of the DRM policy which otherwise limit distribution of the multimedia content to the VLAN group. 
 
     
     
         20 . The method of  claim 17  wherein establishing the one or more secure connections between the gateway network device and one or more remote network devices comprises setting up one or more secure connections using one of layer 2 tunneling protocol (L2TP) and Internet Protocol Security (IPSec).