Patent Application
20190215265
N/A
Software-defined networking (SDN) is a general term which includes a number of networking technologies. SDN aims to separate the control plane of the network from the data plane of the network to create an agile and flexible network. In a software-defined network, the switch(es) or other components that form the physical topology of the network can communicate with the controller to determine how frames should be directed within the network. In this way, the controller can create, modify, or remove connections between two endpoints to dynamically provision services between the endpoints.
During this provisioning of services, it is important to note that the physical topology of the network remains unchanged. Instead, to provision a service between two endpoints (e.g., between a user's home and an edge switch of a provider), the controller will typically employ knowledge of the network topology including how the endpoints are physically interconnected, current traffic on the network, and any quality of service requirements (among possible other factors) to select and create a virtual network between the endpoints. This is accomplished by programming the appropriate switches or other components to forward frames pertaining to the service so that they traverse a selected path to reach their endpoint. In some implementations, only components located at the edge of the network topology may implement this software-defined networking technique.
Various protocols and techniques exist for provisioning services in this manner. For example, a software-defined network may be configured to employ VLAN tags (or other identifiers) within the frames to define to which service the frames pertain. By accessing the VLAN tag in a frame it receives, a switch can determine, based on its programmed rules, how to forward the frame so that the frame traverses the path that was defined for that service. In this type of environment, frames pertaining to multiple services can be transferred over the same physical wire but remain isolated due to the VLAN tags they include.
In one example, a streaming video provider network 140a (e.g., Netflix, Hulu, Sling, etc.), an internet service provider network 140b, and a security provider network 140n can each be connected to a particular port of edge switch 132. Additionally, a user's premises (e.g., a home or business location) includes a smart TV 100a, a PC 100b, and a security system 100n.
The user may desire to employ smart TV 100a, PC 100b, and security system 100n to receive services over network 130. To connect smart TV 100a, PC 100b and security system 100n (or any other network connectable device) to network 130, the user can employ gateway 110. Gateway 110 includes an outbound (or wide area network (WAN)) port 112 by which it connects to a switch (e.g., switch 131c) of network 130. Gateway 110 also includes a number of inbound (or local area network (LAN)) ports 111a-111n by which the end user may connect the various devices to gateway 110.
An important distinction between a software-defined network and a typical internet connection is that a software-defined network allows a user to access a service independent of the internet. For example, in an internet-based scenario, if the user desires to subscribe to Netflix, the user must first subscribe to an internet service provider (e.g., Comcast, Verizon, Time Warner, AT&T, etc.) to access Netflix. In this scenario, the user accesses Netflix over the internet. In contrast, with a software-defined network and assuming streaming video provider network 140a is Netflix, controller 131 can provision the delivery of Netflix to the user's premises independent of any internet access.
As mentioned above, architecture 100 may use layer two identifiers (hereinafter generally “IDs”) to distinguish between different services that have been provisioned over network 130. For example, a streaming video service that has been provisioned for the end user could be assigned an ID of 1234. In such a case, any frame that the streaming video provider sends to the end user will be labeled with 1234. On the service side, this labeling of frames is performed at the edge switch by which the provider's network is connected to network 130. Therefore, edge switch 132 would label a frame that is intended for the end user with 1234 if that frame is received over the port associated with streaming video provider network 140a.
As mentioned above, gateway 110 includes multiple inbound ports 111a-111n. This is necessary to enable multiple services to be delivered to the user's premises via gateway 110. In particular, as part of provisioning a service to the user's premises, controller 131 can instruct gateway 110 to deliver incoming frames that have a particular ID to one of ports 111a-111n. Similarly, controller 131 can instruct gateway 110 to assign the particular ID to any outgoing frame that is received at the same port. In other words, each service delivered to the user's premise requires its own inbound port on gateway 110.
Accordingly, in
Although this one-to-one relationship between services and ports provides service isolation, it also creates various practical difficulties. For example, to use a service on a device, the device will have to be connected to the appropriate port. In
The present invention extends to methods, systems and computer program products for isolating services across a single physical network interface. A gateway that is installed at the user's premises can include a single inbound port over which multiple services can be provided to the premises. The gateway can evaluate all outbound frames that are received at the port to identify to which service they pertain and then label the frames with an identifier assigned to the service. This labeling will enable the frames to be delivered to the intended service provider. When the gateway receives an inbound frame, it can strip the identifier from the frame and forward it over the single inbound port regardless of the service to which it pertains. In this way, multiple services that are provided to the user's premises can remain isolated on the wide area network even though they are provided over the same physical medium on the user's local area network.
In one embodiment, the present invention is implemented by a networking device that is connected to switches of a network as a method for modifying frames to include a service-specific identifier. The networking device maintains an ID table that includes entries that associate IDs with matching criteria. The ID table includes a first entry that associates a first ID with a first set of criteria and a second entry that associates a second ID with a second set of criteria. A first frame is received via a port of the networking device. The networking device evaluates contents of the first frame and compares the contents of the first frame against the entries of the ID table. Upon determining that the contents of the first frame match the first set of criteria, the networking device modifies the first frame to include the first ID and forwards the modified first frame to the one or more switches of the network. A second frame is received via the port. The networking device evaluates contents of the second frame and compares the contents of the second frame against the entries of the ID table. Upon determining that the contents of the second frame match the second set of criteria, the networking device modifies the second frame to include the second ID and forwards the modified second frame to the one or more switches of the network.
In another embodiment, the present invention is implemented as computer storage media storing computer executable instructions which, when executed by a gateway that connects one or more user devices to a network, implement a method for modifying frames to include a service-specific identifier. The method includes: receiving, via a port of the gateway, a first frame; evaluating contents of the first frame; comparing the contents of the first frame against entries of an ID table; determining that the contents of the first frame match a first set of criteria defined in a first entry of the ID table; modifying the first frame to include a first ID defined in the first entry; and forwarding the modified first frame over the network.
In another embodiment, the present invention is implemented as a software-defined network architecture that includes: a gateway with an inbound port to which one or more user devices are connected and an outbound port by which the gateway connects to one or more switches of a network; and an edge switch that connects multiple service provider networks to the one or more switches of the network. The gateway includes an ID table that defines entries each of which associates a unique ID with matching criteria. The gateway is also configured to evaluate frames that are received from the user devices via the inbound port against the entries in the ID table such that, when contents of a particular frame matches the matching criteria of a particular entry, the gateway modifies the particular frame to include the associated unique ID before forwarding the frame over the outbound port.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter.
In order to describe the manner in which the above-recited and other advantages and features of the invention can be obtained, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:
In this specification and the claims, a gateway should be construed as an electronic device that includes at least one outbound port for coupling to a WAN and at least one inbound port for coupling to a LAN. The term “layer two” should be construed as the data link layer of the OSI model, while the term “layer three” should be construed as the network layer of the OSI model. A layer two identifier (or ID) should encompass any of the various types of identifiers that can be added to a frame including, for example, a VLAN tag, an MPLS label, or a Segment Routing segment label. The present invention should not be limited to any particular layer two protocol. For illustrative purposes only, the 802.1Q or 802.1ad protocol could be used in embodiments of the present invention. The term “port” should be construed as a physical layer two interface and should not be confused with logical ports at the transport layer.
In contrast to
Turning now to
With the virtual network implemented, the user can commence receiving streaming video services at smart TV 100a (or another device connected to gateway 210 assuming corresponding entries have been created in ID table 300). For example, in
Importantly, gateway 210 will receive this frame via port 211—the same port by which gateway 210 would receive frames pertaining to other services to which the user has subscribed (e.g., internet communications, security communications, etc.). To direct frames to the intended provider network, gateway 210 can modify outbound frames it receives to include the proper ID. This is accomplished using ID table 300. For example, in step 5 and in response to receiving the frame from smart TV 100a in step 4, gateway 210 can evaluate the frame and compare its contents to the matching criteria associated with each ID. In this case, gateway 210 will determine that the frame has a source MAC address of MAC1 and a destination IP address of IP1. With this information, gateway 210 can search ID table 300 to determine that a match exists and that ID1 is associated with this criteria. As a result, gateway 210 will add ID1 to the frame.
IDs can be added to frames in accordance with various different protocols. For example, the IDs may be in the form of a VLAN tag in accordance with the 802.1Q or 802.1ad protocols, in the form of a label in accordance with the MPLS protocol, or in any other format. Once gateway 210 has added the proper ID, it can forward the modified frame over network 130 via port 212 as represented in step 6.
It is noted that, in some cases, gateway 210 may modify a frame to include a default ID when the frame does not match any criteria in table 300. Therefore, whenever gateway 210 or any other gateway in the network receives a frame that does not match any criteria, the frame may be modified to include the default ID and then forwarded over the network. In short, gateway 210 selectively modifies frames based on the frame's contents matching an entry or not matching any entry in ID table 300.
Once gateway 210 forwards the frame with the added ID of ID1 over network 130, the frame will be forwarded towards edge switch 132. In step 7, edge switch 132 will receive the frame and can employ the ID to determine how to forward the frame. In particular, edge switch 132 will maintain a table that associates one or more IDs with each of its inbound ports. In this example, ID1 will be associated with the inbound port by which streaming video provider network 140a is connected to edge switch 132. Edge switch 132 will therefore forward the frame to streaming video provider network 140a.
In some embodiments, edge switch 132 may strip the ID from the frame prior to forwarding it over an inbound port. By removing the ID at edge switch 132, the components of streaming video provider network 140a will not need to be configured to process such IDs. In other words, the use of the IDs is transparent to the components of the provider's network as well as to the user's devices.
To better illustrate how the present invention isolates services that are provided via the same port,
In summary, gateway 210 can maintain an ID table (or some other data structure) which associates any combination of criteria with a particular ID. The combination of criteria can include layer two information, layer three information, or any other information that can be extracted from a frame that gateway 210 receives from a user's device and that identifies a particular service to which the frame is directed. By evaluating the frames, gateway 210 can add the appropriate ID to each frame to cause the frame to be delivered to the intended service provider when the frame is received at the corresponding edge switch.
Method 500 includes an act 501 of maintaining, at the networking device, an ID table that includes entries that associate IDs with matching criteria, the ID table including a first entry that associates a first ID with a first set of criteria and a second entry that associates a second ID with a second set of criteria. For example, gateway 210 can maintain ID table 300.
Method 500 includes an act 502 of receiving, via a port of the networking device, a first frame. For example, gateway 210 can receive a frame from smart TV 100a that is intended for the streaming video provider.
Method 500 includes an act 503 of evaluating contents of the first frame. For example, gateway 210 can examine a MAC address, IP address, a VLAN tag, a TCP port, etc. of the frame.
Method 500 includes an act 504 of comparing the contents of the first frame against the entries of the ID table. For example, gateway 210 can evaluate the contents of the frame against entries in ID table 300.
Method 500 includes an act 505 of, upon determining that the contents of the first frame match the first set of criteria, modifying the first frame to include the first ID. For example, gateway 210 could add ID1 as a VLAN tag or other type of ID to the frame when it determines that the frame has a source MAC address of MAC1 and a destination IP address of IP1.
Method 500 includes an act 506 of forwarding the modified first frame to the one or more switches of the network. For example, gateway 210 can forward the frame with ID1 over port 212.
Method 500 includes an act 507 of receiving, via the port, a second frame. For example, gateway 210 can receive a frame from security system 100n that is intended for the security service provider.
Method 500 includes an act 508 of evaluating contents of the second frame. For example, gateway 210 can examine a MAC address, IP address, a VLAN tag, a TCP port, etc. of the frame.
Method 500 includes an act 509 of comparing the contents of the second frame against the entries of the ID table. For example, gateway 210 can evaluate the contents of the frame against entries in ID table 300.
Method 500 includes an act 510 of, upon determining that the contents of the second frame match the second set of criteria, modifying the second frame to include the second ID. For example, gateway 210 could add ID2 as a VLAN tag or other type of ID to the frame when it determines that the frame has a source MAC address of MAC2 and a destination IP address of IP2.
Finally, method 500 includes an act 511 of forwarding the modified second frame to the one or more switches of the network. For example, gateway 210 can forward the frame with ID2 over port 212.
Embodiments of the present invention may comprise or utilize special purpose or general-purpose computers including computer hardware, such as, for example, one or more processors and system memory. Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system.
Computer-readable media is categorized into two disjoint categories: computer storage media and transmission media. Computer storage media (devices) include RAM, ROM, EEPROM, CD-ROM, solid state drives (“SSDs”) (e.g., based on RAM), Flash memory, phase-change memory (“PCM”), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other similarly storage medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Transmission media include signals and carrier waves.
Computer-executable instructions comprise, for example, instructions and data which, when executed by a processor, cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language or P-Code, or even source code.
Those skilled in the art will appreciate that the invention may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, tablets, pagers, routers, switches, and the like.
The invention may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks. In a distributed system environment, program modules may be located in both local and remote memory storage devices. An example of a distributed system environment is a cloud of networked servers or server resources. Accordingly, the present invention can be hosted in a cloud environment.
The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description.
