Patent Application
20230188875
The instant invention relates to computer networks and more particularly to optical data network traffic routing to multiple users in a local area.
Nowadays a wide variety of entities are moving towards the use of Passive Optical Networks (“PON”) and benefit from the interconnectivity provided by local and wide area networks, and connection to the Internet. Many entities depending on their purpose have many types of devices connected to the network including personal computers, wireless controllers, application servers, printers, scanners, ambient control systems, security cameras and sensors, phone systems, gaming consoles and television sets. The digital signals carried by the PON include converged voice, data and video signal content traffic.
Many individual and business users send and receive digital information which is intended to remain private and can be confidential to the individual users. Such users can be businesses located in the same office building as co-tenants, guests located in a hotel, users located in a commercial, local, state, federal or similar entity, subscribers in a residential entity such as owners or tenants. In the past, reasonable privacy and security can be accomplished by each user connecting directly to a secure service provider carrier using a dedicated headend located in the entity space including a modem, workgroup switches and routing equipment. This equipment typically requires its own cooling equipment. Often the connection throughout the local network and to the carrier is through copper wiring which, due to its electrical resistance, can generate additional heat requiring cooling. All this equipment and cooling capability is often multiplied by the number of individual tenants in a building, leading to high power consumption.
A typical limiting factor using copper wiring for digital connection lines is bandwidth. Thus, a particular business tenant may elect to upgrade its individual local network and its connection to the carrier using high bandwidth equipment. Increasing the bandwidth often requires additional copper wiring, and more air conditioning.
With the development of optical fiber technology, photonic networks which are typically referred to a Passive Optical Networks can deliver significantly higher bandwidth and lower power consumption. This need for increased speed and sustainability by reduced power consumption has promoted the accelerated adoption of PON in most commercial and residential sectors.
The higher available bandwidth has led to network designs where one or more PON interface routers can distribute data streams to a multiplicity of users through an Optical Line Terminal (“OLT”). Further, this can eliminate the need for a dedicated router for each user. Unfortunately however, this creates an increased cyber-security risk for all those users connected to the PON interface routers since the global routing table can be surreptitiously accessed by a nefarious user, or some cyber-entity mimicking a user on the PON.
The instant invention results from efforts to provide an improved passive optical networking system that addresses one or more of the above problems.
The primary and secondary objects of the invention are to provide an improved optical networking system. These and other objects are achieved by providing an optical network interface router including at least one virtual routing table for each of a plurality of optical network units to which the interface router is connected.
In some embodiments there is provided a multi-user optical data network apparatus comprises: a plurality of network service carrier lines connected to a passive optical network interface router; at least one uplink connecting said interface router to an optical line terminal; said optical line terminal being connected to a number of passive optical network feeds for carrying a common data feed to a plurality of optical network units each supporting at least one of a plurality of private user devices; said interface router being configured to have at least one virtual routing table for each one of said plurality of optical network units; and, wherein each of said optical network units is adapted to extract data packets intended for a supported one of said devices.
In some embodiments said interface router is a premise router.
In some embodiments said interface router is further configured to have a routing table routine generating said at least one virtual routing table for each one of said plurality of optical network units.
In some embodiments each of said optical network units provides service to a separate number of private users.
In some embodiments said uplink carries data including digitized voice and video data.
In some embodiments there is provided a multi-user optical data network apparatus comprises: a plurality of network service carrier lines connected to a plurality of passive optical network interface routers; a plurality of uplinks connecting said interface routers to an optical line terminal; said optical line terminal being connected to a number of passive optical network feeds for carrying a common data feed to a plurality of optical network units each supporting at least one of a plurality of private user devices; wherein each of said interface routers is configured to have at least one virtual routing table for each one of said plurality of optical network units to which said each of said interface routers is connected; and, wherein each of said optical network units is adapted to extract data packets intended for a supported one of said devices.
In some embodiments there is provided a digital data network communication method comprises: accepting a plurality of private data streams into a passive optical network interface router serving a plurality of private users through a plurality of optical network units; aggregating said private data streams into a combined data feed; routing said data feed to at least two of said plurality of optical network units; extracting from said data feed a first one of said private data streams; wherein said routing comprises: generating an independently unique virtual routing table for each of said plurality of optical network units; tagging ethernet frames intended for a first one of said plurality of optical network units according to entries in a first one of said virtual routing tables associated with a first one of said optical network units; distributing said tagged ethernet frames according to said first one of said virtual routing tables.
In some embodiments said distributing comprises associating destinations listed in said first one of said virtual routing tables with said first one of said optical network units.
In some embodiments each of said optical network units provides service to a separate number of private users.
In some embodiments said accepting comprises: interfacing a plurality of service provider data lines through a single headend.
In some embodiments said interfacing comprises: utilizing at least one premise router and a radio frequency video converter; and, feeding an output of said at least one premise router through an optical line terminal.
In some embodiments said interfacing further comprises: feeding an output of said converter through said optical line terminal.
In some embodiments said aggregating comprises using an enterprise aggregating switch.
The text of the original claims is incorporated herein by reference as describing features in some embodiments.
Referring now to the drawing, there is illustrated in
As shown in
The system relies upon a collection of standards-based technologies that are designed and implemented to provide a point-to-multipoint networking through a single aggregation switch that is capable of providing thousands of IP voice, data, and video connection ports.
In a basic configuration, the aggregate downstream rate can be 2.5 Gbps, while the upstream rate can be 1.25 Gbps. Each of the connections can be adapted to support high-bandwidth multimedia applications on a single optical fiber over a distance of 20 km or more. Telecommunications service traffic that includes Internet, public switched telephone networks, and broadcast/cable television 108, 110, 112 for the building are provided by one or more commercial carriers 114, 116, 118. The telecommunications services carrier lines 120,122,124 enter the building 100 at a Main Point Of Entry (MPOE) room 126 and terminate into headend equipment 128. From the headend equipment, the voice, video and data content traffic can distributed to each of the tenants 102, 104, 106 over data feeds carried by fiber optic cabling 130, 132, 134.
As shown in
The headend equipment 128 receives the plurality of telecommunications service carrier lines 120,122,124 from the separate carrier providers 114, 116, 118. An RF-based video signal can be supplied by one or more of the carriers to the headend equipment via a broadband coaxial cable 130. The interface to the carrier lines within the headend equipment is the premise router 140.
The premise router 140 can be configured with Virtual Routing and Forwarding (VRF) as described in RFC 4381 and RFC 4382, and utilizes Virtual Local Area Network (VLAN) tagging to separate and manage the distribution of the voice, video and data content traffic to each of the users. The VLAN-tagged voice, video, and data content traffic is connected to the Optical Line Terminal (OLT) 146 through an uplink 142 that provides primary communication. Optionally, a secondary uplink 144 may be employed as a backup communication path.
The OLT 146 can be powered by dual 48 VDC power feeds 148, 150 from rectifier modules 152, 154 that are attached to separate AC Mains 156, 158 through an uninterruptible power supply 160. The OLT has a minimum of eight optical ports, but can have well over fifty such ports. Each port delivers a beam of light that contains the aggregated data for a multiplicity of users. The aggregated data may or may not be encrypted based on the type of PON.
The OLT 146 takes the VLAN-tagged voice, video, and data content traffic 142, 144 and processes each of the ethernet frames by first optionally encrypting them, then converting them into light, and outputting them as a photonic broadcast stream to the appropriate initial passive optical network feeds 162, 164, 166, 168, 170 that connects to an optical distribution patch panel 172. The optical distribution patch panel 172 is used to provide the ability for cross-connecting the initial feeds 162, 164, 166, 168, 170 to the distribution feeds 174, 176, 178, 180 that traverse the distance to the remotely located tenants 102, 104, 106. A tenant 106 requiring larger bandwidth can accept multiple distribution feeds 178, 180.
In the case where a carrier provider 114 supplies an RF-based video signal 130, the headend equipment 128 receives the RF-based video signal and converts it into light by processing the electrical analog signal and using it to modulate a laser which outputs the equivalent video photonic stream. This new video photonic stream is then combined with an initial feed 162 which results in a modified initial feed 164 that contains a photonic broadcast stream that contains the voice, video and data content traffic that is then fed into the optical distribution patch panel 172. Of course in some instances the initial feed can contain digitized voice, video and data in which case no bypass of the OLT is necessary.
As shown in
Thus, the premise router processor 410 gets and puts the tenant-specific routing information through the routing table routine 412 into the appropriate virtual routing tables 420, 422, 424, 426. The updated virtual routing tables are used to uniquely VLAN-tag the voice, video, and data content traffic that is sent and received through the uplinks 142, to the OLT 146.
In this way, the overlapping IP address on a single PON infrastructure allows each tenant connected to the infrastructure to transmit and receive information to any of the carriers. Thus all the tenants in a building can simply connect to the PON infrastructure without the need for their own dedicated headend.
A configuration file loaded into the premise router contains the commands to implement the virtual routing tables for each of the ONUs providing service to the tenant users. By way of example, the following pseudo-code implements independent virual routing tables for two ONUs serving two users, namely “Tenant A” and “Tenant B”. Comment lines begin with an exclamation point (“!”):
The above example shows that the premise router 140 can be programmed to create an independent virtual routing table for each user ONU. Thus, each user is effectively encased within its own separate routing environment, vastly restricting access by cyber attackers to the PON.
Each splitter 308 can replicate the incoming photonic broadcast stream equally over each of it's drop lines 320, 322, 324. The splitter 308 can attach to the simplex, single-mode fiber from the OLT 146 and can passively redistribute the incoming light stream up to 64 times. The splitter is a Planar Lightwave Circuit (PLC) that is constructed using silica glass waveguide circuits and aligned fiber optic pigtails that are all integrated inside of a single package. The attenuation of the light signal through the PLC of the splitter 308 is symmetrical in both directions. The signal loss from a 1×8 PLC splitter is expected to be less than one dB greater than what would be expected from a perfect splitter, approximately 10 dB. A typical 1×32 PLC splitter shall have approximately 17 dB or less.
Each of the outputs from the optical splitter can be an individual simplex, single-mode fiber called a drop line 320, 322, 324. The drop lines can be routed and fed into the appropriate tenant physical space 102, 104, 106 and terminated into the tenant's dedicated Optical Network Unit (ONU) 330, 332, 334.
Each ONU 330, 332, 334 is operated so that it utilizes the VLAN-tagging to select those of the incoming ethernet frames assigned to the particular tenant, and then removes the encryption from the selected ethernet frames. Thus, each ONU strips out or extracts only those incoming frames that are intend for the particular tenant. The decrypted ethernet frames 301, 303, 305 are then made available 340, 342, 344 for the tenant's IP/ethernet end-user equipment. Those frames not assigned to the particular tenant are ignored and cannot be decrypted by the particular tenant. In other words, a first subset of the frames can be associated a first piece of end-user equipment and a second subset of the frames is associated with a second piece of end-user equipment. The first and second pieces of equipment can be common to a single tenant or can be split among separate tenants.
In other words, for example, tenant A 102 gets supplied to its ONU 330 all incoming encrypted frames 300, 302, 304, 306 via its drop line 320 including those frames that are intended for it 300,306 and those frames that are unintended for it 302, 304. The ONU strips out its intended encrypted frames 300, and 306 and decrypts them to form its intended decrypted frames 301 which it makes available to Tenant A's dedicated, private data line 340. The ONU also encrypts outgoing frames.
As shown in
The OLT 146 equipment can be a chassis having multiple slots used to host circuit boards that perform various functions. Operations of the OLT are managed and controlled by a processor 500. A backplane 502 of the OLT can provide the communication path for all of the control, management, and data signals between the circuit boards installed within the OLT. A network interface 504 provides the interface to/from the primary uplink 142 and backup uplink 144 connections to the premise router 140. A switching fabric component 506 can be used to encrypts the VLAN-tagged ethernet frames using the appropriate symmetric key for a specific tenant and sends the result to an optical conversion component 508 for transmission to the tenant. The content traffic on the switching fabric component 506 is encrypted for each tenant location before being transmitted over the shared optical distribution network. Encryption of the layer-2 ethernet frames is used to provide the confidentiality of each tenant's signal traffic.
A symmetric-key algorithm can be used for the encryption of the ethernet frame data packets. This particular implementation utilizes a fixed block size of 128-bits and a key size of 128-bits that operate on a 4×4 column-major order matrix of bytes. It performs 10 cycles of transformation rounds that convert the input plaintext into the final output of ciphertext. Each round can consists of:
a. First, a byte substitution function is performed where each byte in the state matrix is replaced using an 8-bit substitution.
b. Next, each of the rows of the state are shifted by a certain number of steps. The first row is left unchanged. Each byte of the second row is shifted one to the left. Similarly, the third and fourth rows are shifted by offsets of two and three respectively. Row n is shifted left circular by n−1 bytes.
c. Finally, the columns of the state are mixed by combining the four bytes in each column. The four bytes of each column of the state are combined using linear transformation. Encryption is used to specifically prevent man-in-the-middle attacks. Additionally, the PON configuration also supports IEEE 802.1x authentication in order to provide provide port based Network Access Control to limit network access, with features like IP//MAC address limiting to secure the network from unauthorized/malicious users.
The optical conversion component 508 of the OLT 146 can convert the electrical signals of the encrypted VLAN-tagged ethernet frames and output them over the initial feeds 162, 166, 168, 170 as modulated optical signals.
In the case where a carrier provider 114 supplies an RF-based video signal 130 to the headend equipment 128, the signal is connected to a laser transmitter 520 where the input broadband signal is used to modulate a laser. The modulated output of the laser is a low-level photonic light stream. The photonic light stream is sent to an erbium-doped fiber amplifier 522, where the signal is increased to approximately 30 dBmV. The resulting amplified video signal is then overlayed on an initial feed 162 through the use of a wave division multiplexor combiner 524. The output from the wave division multiplexor combiner 524 is a feed line 164 that contains encrypted VLAN-tagged ethernet frames and a laser-modulated, RF-based video signal.
As shown in
In this way, the above described system empowers a multi-tenant building 100 with an environment to securely host individual tenant data traffic with overall network flexibility. This ability of the system allows it to leverage the high bandwidth and energy efficiency of passive optical network equipment for the entire building. Because optical bandwidth is comparatively unlimited, existing systems often do not utilize this capacity. Thus, the high bandwidth capability of optical fiber can be leveraged to route all traffic optically and uniformly throughout the building on an aggregated feed. Each tenant can extract its share of the traffic from the feed. In this way, a single headend having reduced air conditioning requirements can be located at the building's main pint of entry, and no additional air conditioning is needed at the individual tenant spaces for what would have been headend-type network equipment.
While the preferred embodiment of the invention has been described, modifications can be made and other embodiments may be devised without departing from the spirit of the invention and the scope of the appended claims.
This is a continuation of co-pending U.S. patent application Ser. No. 17/377,223, filled 2021 Jul. 15, which is a continuation of U.S. patent application Ser. No. 17/128,042, filled 2020 Dec. 19, which is a continuation of U.S. patent application Ser. No. 16/600,302, filed 2019 Oct. 11, now U.S. patent Ser. No. 10/904,649, issued 2021 Jan. 26, which is a continuation of pending U.S. patent application Ser. No. 16/431,602, filed 2019 Jun. 4, which is a continuation-in-part of U.S. patent application Ser. No. 15/351,315, filed 2016 Nov. 14, which is a continuation-in-part of U.S. patent application Ser. No. 14/419,092, filed 2015 Feb. 2, which is a 371 of International Application Serial No. PCT/US2013/053389, filed 2013 Aug. 2, which claims the benefit of U.S. Provisional Patent Application Ser. No. 61/678,977, filed 2012 Aug. 2 all of which are incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 61678977 | Aug 2012 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17377223 | Jul 2021 | US |
| Child | 18105557 | US | |
| Parent | 17128042 | Dec 2020 | US |
| Child | 17377223 | US | |
| Parent | 16600302 | Oct 2019 | US |
| Child | 17128042 | US | |
| Parent | 16431602 | Jun 2019 | US |
| Child | 16600302 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 15351315 | Nov 2016 | US |
| Child | 16431602 | US | |
| Parent | 14419092 | Feb 2015 | US |
| Child | 15351315 | US |
