Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Packet header designating cryptographically protected data
Reexamination Certificate
1999-09-21
2004-10-12
Moise, Emmanuel L. (Department: 2133)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Packet header designating cryptographically protected data
C713S190000, C709S223000, C709S227000
Reexamination Certificate
active
06804776
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to communications protocols, specifically packet encapsulation protocols for use in network communications.
2. Description of the Related Art
The global computer network, known today in one form as the “Internet,” consists of a large installed base of many types of switches, routers and other equipment and software employing multiple communications protocols. Among these is the well-known Internet Protocol (IP), which is a connectionless communications protocol that provides, among other things, transport services for packetized data. The Internet Protocol is described in Karanjit S. Siyan,
Inside TCP/IP
, New Riders Publishing 1997, incorporated herein by reference in its entirety. Networks relying on connection-oriented protocols, such as Frame Relay or Asynchronous Transfer Mode (ATM), are also currently installed. There is a generally recognized need to provide fast, efficient, and inexpensive data communications to users regardless of the form of the network and the protocols currently installed.
One problem seen among users of so-called “legacy” systems, for example the older time division multiplex (TDM), Frame Relay, and ATM connection-oriented systems, is the relative lack of compatibility with modern network elements that use IP. Many legacy ATM and Frame Relay networks are unable to inexpensively connect to IP networks while providing the speed and bandwidth required by their users.
One potential solution to this problem is the virtual private network (VPN). A virtual private network consists of a closed user group (CUG) that communicates across a backbone network. The backbone provides service isolation and security from other CUGs. The backbone network can be any type of physical network, such as the global Internet, a private extranet, or campus intranet. To the users within the CUG, each is connected to the others as if the backbone did not exist. In essence, the VPN allow a network manager with an installed base of networking equipment to provide seamless transport for users without revealing the types of underlying network protocols used to furnish that transport. However, existing protocols and methods of connecting CUG members on legacy systems are still subject to the above-noted problems of a lack of speed and bandwidth due to shortfalls in the legacy protocols themselves.
Another option known in the art is providing virtual path trunking using an IPX protocol “tunnel” through an existing Internet Protocol network. The process whereby a virtual path protocol establishes a tunnel is called “tunneling.” “Tunneling” generally refers to a user-transparent transport method of encapsulating one data form (the “payload,” in this case IPX packets) within another packet protocol (here, IP) so that the payload data can pass across the IP network. One form of tunneling, known as generic routing encapsulation (GRE), is described in Internet Requests For Comments (RFCs) 1701 and 1702, available on the Internet at the URL http://www.ietf.org/rfc.html, incorporated herein by reference in their entireties.
While methods such as GRE are known in the prior art, the complexities of these systems do not approach the wide applicability currently desired by users. Current tunneling schemes are computation-intensive, slow, and increase the complexity of the IP network itself. Additional shortcomings are a lack of sufficient security at the ingress and egress interfaces of the virtual circuit tunnel. Also, the GRE protocol (in particular) is not viewed as amenable to ultra-high speed processing.
What is needed is an inexpensive, flexible, and user-transparent method of providing virtual path communications for users employing any protocol currently known or conceivable. Furthermore, what is needed is a system that has no effect on the existing IP network carrying this system.
SUMMARY
Presently disclosed is a method for implementing a simple protocol, referred to as the universal transport interface (UTI), that can be used to create high speed Internet Protocol (IP) tunnels through a network for carrying a variety of different payloads. These payload packets may comprise any currently known packet protocol, including but not limited to IP packets, asynchronous transfer mode (ATM) cells, Packet-over-SONET/SDH (POS) packets, and Frame Relay frames. The universal transport interface protocol consists of a predefined set of encapsulations (or “mappings”) whereby any previously known protocol can be transformed into a universal transport encapsulation (UTE) packet format. UTE format packets are, by design, amenable to transport over an IP network without further modification beyond standard IP encapsulation. In this fashion, the UTI protocol creates a tunnel through an existing network that connects two user networks operating on a different protocol. A tunnel security key system prevents unauthorized use or interception of UTE packets on the network.
The UTI method, according to one embodiment of the present invention, comprises identification of the protocol used in the payload packet and determining the mapping function needed, if any, to translate the payload packet field ordering into the UTE format. This work is performed at the ingress interface to the UTI tunnel. The ingress interface device (e.g., a router) then performs a translation mapping on the payload packet and prepends the UTE header to the reformed packet. A tunnel security key that enables verification and validation of packet data sent through the UTI tunnel is included in the UTE header. On receipt of the transport packet thus conveyed through the tunnel, the receiving (egress) interface device validates the packet, strips off the UTE header, and reverses the mapping process. The reconstituted payload packet is then available for further routing within the receiving user network.
REFERENCES:
patent: 5444782 (1995-08-01), Adams, Jr. et al.
patent: 5917908 (1999-06-01), Takenaka et al.
patent: 6216164 (2001-04-01), Zaremba et al.
patent: 6324287 (2001-11-01), Angert
“Convergent Networks' Service-Enabling Architecture,” a publication of Convergent Networks, pp. 1-14.
Bates Anthony J.
Lothberg L. Peter J.
Campbell Stephenson Ascolese LLP
Cisco Technology Inc.
Moise Emmanuel L.
LandOfFree
Method for universal transport encapsulation for Internet... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method for universal transport encapsulation for Internet..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method for universal transport encapsulation for Internet... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3332828