Broadband access for virtual private networks

Abstract

An apparatus receives an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type. The apparatus authenticates the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification. The apparatus determines whether the apparatus recognizes the destination option type of the upper layer packet. The apparatus discards the upper layer packet on a condition that the apparatus does not recognize the destination option type. The apparatus decapsulates the upper layer packet into a lower layer packet and transmits the decapsulated packet to a destination on a condition that the apparatus recognizes the destination option type.

What is claimed is: 
     
         1 . A method comprising:
 determining, by a first interface device of a virtual private network (VPN), a destination address of a destination device, the destination address being within a data packet, the first interface device comprising one or more processors;   determining, by the first interface device, whether the destination address is mapped to a second interface device of the VPN;   generating, by the first interface device, an encapsulated packet by encapsulating the data packet and by adding an address to the encapsulated packet based on whether the destination address is mapped to the second interface device; and   adding, by the first interface device, a VPN identification to the encapsulated packet.   
     
     
         2 . The method of  claim 1 , wherein generating the encapsulated packet comprises:
 encapsulating the data packet in a multicast packet and adding a multicast address of the VPN to the multicast packet, when the destination address is not mapped to the second interface device.   
     
     
         3 . The method of  claim 1 , wherein generating the encapsulated packet comprises:
 encapsulating the data packet in a unicast packet and adding a unicast address of the second interface device to the unicast packet, when the destination address is mapped to the second interface device.   
     
     
         4 . The method of  claim 1 , further comprising:
 receiving the data packet from a source device over a broadband access link.   
     
     
         5 . The method of  claim 1 , further comprising:
 transmitting the encapsulated packet to a multicast destination or an egress line interface.   
     
     
         6 . The method of  claim 1 , wherein the VPN identification comprises a unique identification number assigned to the source device, and
 wherein the unique identification number marks the encapsulated packet as belonging to a VPN comprising the source device and the destination device.   
     
     
         7 . The method of  claim 1 , wherein the VPN identification comprises at least four bytes or a VPN hop count. 
     
     
         8 . The method of  claim 1 , further comprising:
 adding a destination option type to the encapsulated packet,   wherein the destination option type includes a value indicating to discard the encapsulated packet based on whether an interface device recognizes the destination option type.   
     
     
         9 . The method of  claim 1 , further comprising:
 associating the first interface device with at least one line interface, each line interface being associated with a source device.   
     
     
         10 . The method of  claim 1 , further comprising:
 caching a mapping of the source device with a line interface.   
     
     
         11 . A first interface device of a virtual private network (VPN), the first interface device comprising one or more processors and configured to:
 determine a destination address of destination device, the destination address being within a data packet, the first interface device comprising one or more processors;   determine whether the destination address is mapped to a second interface device of the VPN;   generate an encapsulated packet by encapsulating the data packet and by adding an address to the encapsulated packet based on whether the destination address is mapped to the second interface device; and   add a VPN identification to the encapsulated packet.   
     
     
         12 . The first interface device of  claim 11 , wherein the first interface device generates the encapsulated packet by:
 encapsulating the data packet in a multicast packet and adding a multicast address of the VPN to the multicast packet, when the destination address is not mapped to the second interface device.   
     
     
         13 . The first interface device of  claim 11 , wherein the first interface device generates the encapsulated packet by:
 encapsulating the data packet in a unicast packet and adding a unicast address of the second interface device to the unicast packet, when the destination address is mapped to the second interface device.   
     
     
         14 . The first interface device of  claim 11 , wherein the first interface device is configured to:
 receive the data packet from a source device over a broadband access link.   
     
     
         15 . The first interface device of  claim 11 , wherein the first interface device is configured to:
 transmit the encapsulated packet to a multicast destination or an egress line interface.   
     
     
         16 . The first interface device of  claim 11 , wherein the VPN identification comprises a unique identification number assigned to the source device, and
 wherein the unique identification number marks the encapsulated packet as belonging to a VPN comprising the source device and the destination device.   
     
     
         17 . The first interface device of  claim 11 , wherein the VPN identification comprises at least four bytes or a VPN hop count. 
     
     
         18 . The first interface device of  claim 11 , wherein the first interface device is configured to:
 add a destination option type to the encapsulated packet,   wherein the destination option type includes a value indicating to discard the encapsulated packet based on whether an interface device recognizes the destination option type.   
     
     
         19 . The first interface device of  claim 11 , wherein the first interface device is configured to:
 associate the first interface device with at least one line interface, each line interface being associated with a source device.   
     
     
         20 . The first interface device of  claim 11 , wherein the first interface device is configured to:
 cache a mapping of the source device with a line interface.