The present invention relates to digital networks, and in particular, to the problem of routing traffic in controller-based digital networks.
Modern digital networks operating under IEEE 803.2 and 802.11 standards are called upon to support a wide range of wired and wireless clients.
Such systems usually comprise one or more controllers, each controller supporting one or more access nodes which provide wireless and wired network services to clients. In modern wireless systems, such access nodes may be located at some distance from the controller, communicating with the controller through the routed network. In operation, such systems provide secure network connectivity.
In operation, traffic to and from client systems connected to an access node passes to the central controller, commonly through the use of a tunnel. As understood in the art, IP tunneling is a method of connecting two disjoint Internet Protocol (IP) networks using encapsulation. In such tunneling, every IP packet with addressing information of its source and destination IP networks, is encapsulated within another packet prior to being sent through the intermediate network. Such encapsulation allows traffic between, for example, the controller and an access node, to be routed through the larger switched network. As is known in the art, such tunnels may be encrypted, such as with GRE tunnels, providing additional security. Tunnels are described, for example, in RFC 1701, RFC 1702, RFC 2784, and RFC 2890.
While the use of tunnels allows remote access nodes to provide seamless access to services, this architecture does impose a price, routing all traffic through the (central) controller. If a remote user is connecting to a corporate server, the necessity of routing all that traffic through the controller does not impose much of a penalty. But if a user at a remote location is trying to send a large file, or open a multimedia stream such as SIP connection, to another remote user located ten feet away, the central controller architecture means that all that traffic must be routed through the central controller, introducing the potential for delays and bottlenecks.
What is needed is a way to maintain the benefits of the central controller architecture while not restricting local traffic.
The invention may be best understood by referring to the following description and accompanying drawings that are used to illustrate embodiments of the invention in which:
Embodiments of the invention relate to methods tunneling traffic in a digital network. A digital network has one or more central controllers to which a plurality of access nodes are connected. Each access node provides a combination of wireless and/or wired access to resources available through the central controller. The access nodes may be directly connected to the controller, or they may connect to the controller through routed networks such as the corporate Intranet, wider Internet, through private networks such as VPNs, or through a combination of wired and wireless backhaul.
In operation, the access nodes establish communications with the controller using tunnels. An example of a tunnel is a GRE tunnel. Traffic to and from clients connected to an access node is routed through the tunnel and through the central controller to which the access node is connected.
In accordance with the invention, a mobility controller process runs in the controller, monitoring traffic to and from clients. The set of access nodes known to the controller and other associated controllers is defined as the mobility domain. When the mobility controller recognizes that traffic is being sent from a first client in the mobility domain to a second client in the mobility domain, the mobility controller evaluates whether the traffic is eligible for peer-to-peer forwarding. If the traffic is eligible for peer-to-peer forwarding, the mobility manager instructs the access node to which the first client is connected to establish a peer-to-peer tunnel to the access node to which the second client is attached, and to direct the traffic through the peer-to-peer tunnel.
Peer-to-peer tunnels may be established between any two clients in the mobility domain, or may be established on an authenticated basis. Peer-to-peer tunnels may be limited or authenticated on a per-user basis, and may be limited to certain protocols, ports, and/or destinations. Peer-to-peer tunnels may be kept alive on a session basis, or may be aged and terminated automatically if unused for a predetermined period of time.
As shown in
Access nodes 400a, 400b, 400c, 400d provide wireless and possibly wired services to clients. As shown in
As shown in
Similarly, as understood by the art, access nodes 400a, 400b, 400c and 400d, are also purpose-built digital devices. These access nodes include CPU 410, memory hierarchy 420, wired interface 430, and wireless interface 440. As with controller 200, the CPU commonly used for such access nodes is a MIPS-class CPU such as one from Raza Microelectronics or Cavium Networks, although processors from other vendors such as Intel, AMD, Freescale, and IBM may be used. The memory hierarchy comprises read-only storage for device startup and initialization, fast read-write storage such as DRAM for holding operating programs and data, and permanent bulk file storage such as compact flash. Wireless access nodes 300 typically operate under control of purpose-built programs running on an embedded operating system such as Linux or VXWorks. Wireless interface 340 is typically an interface operating to the family of IEEE 802.11 standards including but not limited to 802.11a, b, g, and/or n. Multiple wired interfaces 430 may be provided, with one wired interface 430a being used to connect the access node to its controller, and the other wired interfaces 430b used to host wired devices as clients. While wired interfaces such as 802.3 Ethernet may be used, USB may also be used to support printers, mass storage devices, and wireless back-haul links such as 3G or WiMAX modems.
While
Routers 300 are also purpose-built digital devices, and similar to controller 200, they contain a CPU, memory hierarchy, and a plurality of interfaces. Routers typically run dedicated software devoted to the tasks required. Routers are commercially available from a number of companies such as Cisco-Linksys, Hewlett Packard, D-Link, and others.
Wireless clients 500 are also digital devices, similarly having CPU 510, memory hierarchy 520, wireless interface 530, and I/O devices 540. As examples, wireless device 500 may be a general purpose computer such as a laptop, or may be a purpose-built device such as a Wi-Fi phone or a handheld scanner. In a general-purpose computer, CPU 510 may be a processor from companies such as Intel, AMD, Freescale, or the like. In the case of purpose-built devices, Acorn or MIPS class processors may be preferred. Memory hierarchy 520 comprises the similar set of read-only memory for device startup and initialization, fast read-write memory for device operation and holding programs and data during execution, and permanent bulk file storage using devices such as flash, compact flash, and/or hard disks. Additional I/O devices 540 may be present, such as keyboards, displays, speakers, barcode scanners, and the like.
In operation and as shown in
Assume wireless client 500a is connected to access node 400a, and client 500b is connected to access node 400b. When client 500a establishes a connection to client 500b, traffic from client 500a passes through access node 400a, tunnel 600a, to controller 200. Controller 200 identifies the traffic destination as client 500b, and sends the traffic though tunnel 600b to access node 400b and client 500b.
This routing is performed by controller 200 using the IP addresses of clients 500a and 500b, as well as the MAC (media access controller) addresses of clients 500a, 500b and access nodes 400a and 400b. When client 500a wishes to send data to client 500b, it in essence forms an IP packet with client 500b's IP address as the destination, and with client 500a's IP address and MAC address as the source. This information is encapsulated and sent to controller 200.
Controller 200 keeps tables of all access nodes it controls, and all clients associated with those nodes, including IP and MAC addresses. In this way, when it examines the packet from client 500a, it can determine that client 500b, the destination, is connected to access node 400b, and direct the traffic through tunnel 600b to that access point, and the destination device.
Even if clients 500a and 500b are sitting in the same office suite, ten meters apart, traffic between them is routed through controller 200.
According to the present invention, mobility manager 280 is a process running in controller 200. By accessing controller 200's tables of access nodes and their clients, mobility manager 280 can detect when a client is exchanging data with another client in its mobility domain.
As shown in
A peer-to-peer tunnel may be established any time mobility manager 280 detects connections and data exchanges between clients in its mobility domain. Or, peer-to-peer tunnels may be evaluated and only established on an authenticated basis according to pre-established rules. Peer-to-peer tunnels may be limited by client identity, including but not limited to client IP address, client MAC address, client authentication, and the like, destination identity, port, traffic type, and so on. As an example, assume a high-speed printer is connected as a client to access node 400a. Appropriate rules for the establishment of peer-to-peer tunnels for a printer would be limited to ports and protocols needed for printer use for local authorized users, with no access allowed for guests. Similarly, traffic to e-mail servers would not be eligible for peer-to-per forwarding, so that such traffic would always pass through controller 280 and be subject to firewalling, virus detection, deep packet inspection, and the like. As another example, network time protocol traffic on port 123 would be eligible for peer-to-peer forwarding to reduce transit delays for time data.
It should be understood that which end of the traffic causes the tunnel to be established is immaterial. As an example, consider a user sending queries to a remote database server. It does not matter if the traffic triggering the formation of a peer-to-peer tunnel is the transmission of a query from the client to the database server, or the transmission of the query result from the database server to the client.
Peer-to-peer tunnels may be established on a session basis, or may be aged. As an example, for a device such as a high-speed printer, a peer-to-peer tunnel with a timeout of thirty seconds may be appropriate; if no activity passes through the tunnel for that predetermined period of time, the tunnel is discontinued. If bursts of traffic between two clients exceed the time-out period, the peer-to-peer tunnel will be discontinued, but the next traffic between the clients, which will once more be routed through controller 200, causes the peer-to-peer tunnel to be re-established.
Assume as an example file/database server 510b is connected via a wired connection to access node 400b. Peer-to-peer tunnels may be permitted for authorized users of the database for the specific protocols and ports used for database access, with all other traffic routed through controller 200 for filtering, firewalling, and authentication. As an example, while database traffic using port 3306 between server 510b and client 500a may be routed through a peer-to-peer tunnel 610, traffic on port 80 between client 500a and server 510b is still routed initially through controller 200.
When multiple controllers 200 are present within a mobility domain, mobility managers 280 operating in each controller may cooperate in supporting peer-to-peer tunneling within the mobility domain. In one embodiment, a mobility manager 280 broadcasts updates of connected clients to other mobility managers in the mobility domain. These updates may be made on a periodic basis, may be event-driven, such as on client connection or disconnection, or on a combination. By providing the ability for a mobility manager to identify clients attached to a different controller that are still within the mobility domain, peer-to-peer forwarding may be extended to cross controller boundaries.
In another embodiment involving multiple controllers, mobility managers 280 may send queries to other mobility managers within the domain to inquire if a destination is a client of another mobility manager within the mobility domain. It may be useful in some embodiments to apply additional authentication when controller boundaries are crossed. As an example, consider an enterprise network spread over many locations, perhaps over many time zones. While establishing a peer-to-peer tunnel between a streaming media device such as a security webcam and a monitoring station offloads that streaming traffic from passing through the controller, other policies may wish to restrict access to such cameras to only users connected to the controller at the particular site, not allowing access across controller boundaries, or only allowing access across controller boundaries to certain classes of users.
While the invention has been described in terms of various embodiments, the invention should not be limited to only those embodiments described, but can be practiced with modification and alteration within the spirit and scope of the appended claims. The description is this to be regarded as illustrative rather than limiting.
Number | Name | Date | Kind |
---|---|---|---|
6076168 | Fiveash et al. | Jun 2000 | A |
6580704 | Wellig et al. | Jun 2003 | B1 |
7130921 | Goodman et al. | Oct 2006 | B2 |
7206859 | Narayanan et al. | Apr 2007 | B2 |
7328280 | Takeda et al. | Feb 2008 | B2 |
7616613 | Sanzgiri et al. | Nov 2009 | B2 |
7639681 | Kelly et al. | Dec 2009 | B2 |
7852767 | Twiss | Dec 2010 | B2 |
8032652 | Iyer | Oct 2011 | B2 |
8085793 | Krishnan et al. | Dec 2011 | B2 |
RE43127 | Wentink | Jan 2012 | E |
20040185777 | Bryson | Sep 2004 | A1 |
20060018291 | Patel et al. | Jan 2006 | A1 |
20060190719 | Rao et al. | Aug 2006 | A1 |
20070008922 | Abhishek et al. | Jan 2007 | A1 |
20070025355 | Cohen et al. | Feb 2007 | A1 |
20070064605 | Ho et al. | Mar 2007 | A1 |
20070104138 | Rudolf et al. | May 2007 | A1 |
20070157303 | Pankratov | Jul 2007 | A1 |
20070253371 | Harper et al. | Nov 2007 | A1 |
20080181113 | Narayanan et al. | Jul 2008 | A1 |
20080291846 | Lu | Nov 2008 | A1 |
20090080441 | Krishnan et al. | Mar 2009 | A1 |
20090316687 | Kruppa | Dec 2009 | A1 |
20100067446 | Oulai et al. | Mar 2010 | A1 |
20100220738 | Sarikaya | Sep 2010 | A1 |
20100315992 | Turányi | Dec 2010 | A1 |
Entry |
---|
Hanks, Li, Farinacci & Traina, Network Working Group Request for Comments: 1701, Category: Informational, “Generic Routing Encapsulation (GRE)”, Oct. 1994, pp. 1-8. |
Hanks, Li, Farinacci & Traina, Network Working Group Request for Comments: 1702, Category: Informational, “Generic Routing Encapsulation over IPv4 Networks”, Oct. 1994, pp. 1-4. |
Farinacci et al., Network Working Group Request for Comments: 2784, Category: Standards Track, “Generic Routing Encapsulation (GRE)”, Mar. 2000, pp. 1-6. |
Dommety, Network Working Group Request for Comments: 2890, Category: Standards Track, “Key and Sequence Number Extensions to GRE”, Sep. 2000, pp. 1-7. |
U.S. Appl. No. 12/433,610, Non-Final Office Action, mailed Dec. 17, 2010. |
U.S. Appl. No. 13/233,976, Non-Final Office Action, mailed Apr. 3, 2012. |
U.S. Appl. No. 13/233,976, Final Office Action, mailed Sep. 12, 2012. |
Number | Date | Country | |
---|---|---|---|
20100275017 A1 | Oct 2010 | US |