Protocol for layer two multiple network links tunnelling

Patent metadata

Field	Value
Publication number	US-9369550-B2
Application number	US-201113881727-A
Country	US
Kind code	B2
Filing date	Nov 11, 2011
Priority date	Nov 11, 2011
Publication date	Jun 14, 2016
Grant date	Jun 14, 2016

Abstract

A method and system for using tunnel association information to allow network device to transfer and receive layer two packets through provide a layer two tunnel between different layer two networks through multiple network links. Layer 3 packets are used to encapsulate layer two packets. The tunnel association information includes a network link identification and a tunnel sequence number. The network link identification is used to identify the network link and virtual private tunnel said one or more layer three packets belonging to and the tunnel sequence number is used to identify the sequence of said one or mow layer three packets in a network link.

First claim

The invention claimed is:

1. A method for computer networking, the method comprising:
performing by one or more processors, one or more network interfaces, or a combination of one or more processors and one or more network interfaces in a first network device:
establishing a plurality of network links between the first network device and a second network device;
establishing a plurality of virtual private network (VPN) tunnels between the first network device and a second network device, wherein the plurality of VPN tunnels are implemented using one or more of the plurality of network links;
receiving a layer two packet through a local area network (LAN) interface;
creating a protocol header, wherein tunnel association information is stored in said protocol header, wherein said tunnel association information includes a network link identification, a tunnel sequence number, and a global sequence number;
encapsulating said layer two packet into one or more layer three packets with said protocol header, wherein said layer three packets have the same or different source addresses, wherein said layer three packets have the same or different destination addresses;
determining whether said one or more layer three packets are large enough to encapsulate the protocol header and said layer two packet; wherein when a layer three packet is not large enough to encapsulate the protocol header and said layer two packet, more than one layer three packet is used to encapsulate the protocol header and said layer two packet;
wherein when the protocol header and said layer two packet is considered as one payload, a first one of the more than one layer three packet contains the protocol header and a part of said layer two packet, and subsequent packets of the more than one layer three packet does not contain the protocol header and contains remaining parts of said layer two packet;
encrypting payload of said one or more layer three packets according to pre-defined rules;
delivering said one or more layer three packets through one or more said network interfaces, wherein the one or more said network interfaces are wide area network (WAN) interfaces;
wherein said network link identification, is used to identify the network link and virtual private tunnel said layer two packet belonging to;
wherein said tunnel sequence number is used to identify the sequence of said one or more layer three packets in a network link.

2. A method for computer networking, the method comprising:
performing by one or more processors, one or more network interfaces, or a combination of one or more processors and one or more network interfaces in a first network device:
receiving one or more layer three packets through one or more network interfaces from a second network device, wherein the one or more network interfaces are wide area network (WAN) interfaces, wherein said layer three packets may not have the same source addresses, wherein said layer three packets may not have the same destination addresses, wherein one or more VPN tunnels are established through the one or more network interfaces;

determining whether the one or more layer three packets belong to any virtual private network (VPN) tunnel; wherein the determining is performed by examining a port number of the one or more layer three packets;
when the port number of the one or more layer three packets matches a pre-defined port number, retrieving protocol header from said one or more layer three packet, wherein tunnel association information is stored in said protocol header, wherein said tunnel association information includes a network link identification and a tunnel sequence number;
when a payload of the one or more layer three packets is encrypted, reading encryption information from said protocol header and decrypting the payload;
decapsulating a layer two packet from said one or more layer three packets;
delivering said layer two packet through a local area network (LAN) interface;
wherein said network link identification is used to identify the network link and virtual private tunnel said layer two packet belonging to; and
wherein said tunnel sequence number is used to identify the sequence of said one or more layer three packets in a network link.

3. The method of claim 1 , wherein said tunnel association information includes a version indicator, a timestamp indicator, and an acknowledgement indicator.

4. The method of claim 1 or 2 , wherein said tunnel association information comprises initialization vector when the payload of said one or more layer three packets are encrypted.

5. The method of claim 1 or 2 , wherein the global sequence number and tunnel sequence number are reused again when lifetime of a network link is beyond a time period; wherein a global sequence number is used for arranging packets received through a VPN tunnel to a correct sequence by the network device; and wherein a tunnel sequence number is used to identify a sequence of said one or more layer three packets in a network link.

6. The method of claim 3 , wherein the time stamp indicator is used for calculating a time difference between the sending of said one or more layer three packet and the receival of said one or more layer three packet or to calculate round trip time between the sending of said one or more layer three packet and receival of a corresponding acknowledgement.

7. The method of claim 1 , wherein network link identification and tunnel sequence number are set to zero when said layer two packet is sent for the purpose of checking health status of a network link, checking health status of a VPN tunnel, or carrying non-payload information.

8. The method of claim 1 , wherein the protocol header is stored with encryption information.

9. The method of claim 8 , further comprising encrypting the protocol header and not encrypting the encryption information stored in the protocol header.

10. The method of claim 1 or 2 , wherein said one or more layer three packets are Internet Protocol packets.

11. The method of claim 1 or 2 , wherein said one or more layer three packets are delivered using User Datagram Protocol.

12. The method of claim 1 or 2 , wherein said network lurk identification is thirty-two bits long.

13. The method of claim 1 or 2 , wherein said tunnel sequence number is thirty-two bits long.

14. The method of claim 2 , further comprising: arranging said one or more layer three packets into correct order before said decapsulation.

15. A network device that transfers and receives communications data, comprising one or more local area networks network interfaces connected to one or more local area networks; one or more wide area networks network interfaces connected to one or more wide area networks; a processing engine coupled to said one or more local area networks network interfaces and said one or more wide area networks network interfaces comprising an encapsulation engine to encapsulate a received layer two packet in one or more to be delivered layer three packets, a decapsulation engine to decapsulate one or more received layer three packets to be delivered layer two packet, and a protocol engine to process tunnel association information, wherein tunnel association information includes a network link identification, a global sequence number, and a tunnel sequence number; a storage system to provide instructions to said processing engine for:
establishing a plurality of network links between the first network device and a second network device;
establishing a plurality of virtual private network (VPN) tunnels between the first network device and a second network devic

Assignees

• Sung Patrick Ho Wai
• Chan Alex Wing Hong
• Ng Kam Chiu
• Pismo Labs Technology Ltd

Inventors

• Sung Patrick Ho Wai
• Chan Alex Wing Hong
• Ng Kam Chiu

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L69/12 Primary

  Protocol engines · CPC title