Layer-2 Bridged Network Point-to-Multipoint Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Layer-2 bridged networks face challenges in providing efficient point-to-multipoint connectivity while preventing direct communication between customer premises, as current solutions like MAC-Forced Forwarding and PPPoE are limited in scalability and complexity, and do not support efficient multicast.
Innovation Solution
Configuring switches in a Layer-2 bridged network with distinct interface types (hub and spoke) to label and forward frames, allowing only hub-type frames to be transmitted through all interfaces while preventing spoke-type frames from being transmitted between spoke interfaces, thus maintaining multipoint-to-multipoint connectivity and preventing direct communication between customer premises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC-Forced Forwarding or PPPoE is used to prevent direct communication between customer premises, then security is improved, but device complexity and provisioning complexity increase
Solution Approach 1:
The patent segments the network into hierarchical levels (access network, aggregation network, core network) and applies different forwarding rules to each segment. Access network switches use simplified forwarding based on ingress port rather than full MAC address learning, while other segments maintain traditional bridging. This segmentation reduces provisioning complexity while maintaining security.
Solution Approach 2:
The patent introduces an intermediary mechanism where all traffic between customer premises must pass through designated aggregation network switches rather than allowing direct peer-to-peer communication. This intermediary approach enforces security policies while simplifying the forwarding logic at access switches.
2Adaptability or versatility
If traditional MAC bridging is used to provide multipoint-to-multipoint connectivity, then connectivity is improved, but direct communication between customer premises cannot be prevented
Solution Approach 1:
The patent applies different forwarding qualities to different network locations. Access network switches implement restricted forwarding that prevents direct customer premises communication, while aggregation and core network switches implement full multipoint-to-multipoint bridging. This local differentiation maintains both security and connectivity.
Solution Approach 2:
The patent implements dynamic forwarding behavior that changes based on the ingress port and traffic type. Frames entering from customer premises ports are forwarded differently than frames entering from aggregation network ports, allowing the system to adapt connectivity behavior to security requirements while maintaining versatility.
3Reliability
If PPPoE is used to separate customer premises, then security is improved, but multicast efficiency deteriorates due to frame replication requirements
Solution Approach 1:
The patent segments multicast traffic handling between access network switches and aggregation network switches. Access switches perform simple port-based forwarding for multicast frames without replicating at the MAC layer, while aggregation switches handle efficient multicast replication. This segmentation maintains security while improving multicast efficiency.
Solution Approach 2:
The patent replaces the mechanical PPPoE session-based replication mechanism with a port-based forwarding mechanism that natively supports efficient multicast distribution. This substitution eliminates the inefficiencies of PPPoE-based multicast while maintaining the security benefits of customer premises separation.
4Reliability
If VLANs are created for each customer premises network, then security is improved, but scalability deteriorates due to limited VLAN IDs and increased provisioning complexity
Solution Approach 1:
The patent segments the security enforcement function from the customer premises identification function. Instead of using VLANs to identify customer premises, it uses ingress port identification combined with a forwarding database that maps customer premises to aggregation network switches. This segmentation eliminates VLAN ID limitations and reduces provisioning complexity while maintaining security.
Solution Approach 2:
The patent changes the fundamental parameter used for network segmentation from VLAN ID to ingress port identification. This parameter change allows for unlimited customer premises scalability since port-based identification is not constrained by the 4096 VLAN ID limit, while still providing the necessary security isolation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for communication includes coupling a group of switches (28, 30) in a Layer-2 bridged network (26). The interfaces (32, 34, 36) of the switches are configured so that at least one interface of at least one of the switches is configured as a first interface type, and a plurality of other interfaces are configured as a second interface type. Upon receiving frames through the interfaces of the first and second types for transmission over the network, the received frames are labeled with corresponding first and second type indications. The frames are forwarded through the Layer-2 bridged network using the switches responsively to the type indications. Frames labeled with the second type indication are permitted to be transmitted through the interfaces of the first type and prevented from being transmitted through the interfaces of the second type.