VLAN Tag Segmentation for Secure Layer 2 Broadcast Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure layer 2 broadcast transport networks struggle to effectively transmit and receive frames associated with different VLANs, as encryption of VLAN tags leads to unnecessary flooding of frames across all ports, requiring unintended sites to decrypt and filter out unwanted packets, which is inefficient and resource-intensive.
Innovation Solution
The method involves extracting and mapping VLAN identifiers from incoming frames to cleartext service VLAN identifiers, allowing secure transmission over a secure layer 2 broadcast transport network, and processing received frames to determine if the service VLAN identifier corresponds to a local VLAN, enabling targeted forwarding or decryption based on the destination.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VLAN tags are encrypted according to the 802.ae standard, then frame security is improved, but broadcast domain restriction capability deteriorates
Solution Approach 1:
The patent segments the VLAN identification function into two parts: the encrypted original VLAN tag (for security) and a new cleartext service VLAN tag (for broadcast domain restriction). This segmentation allows both security and broadcast domain restriction to function simultaneously without interference.
Solution Approach 2:
The service VLAN tag acts as an intermediary between the encrypted VLAN tag and the broadcast domain restriction mechanism. It translates the security-encrypted VLAN information into a form that the broadcast network can use for efficient frame forwarding, eliminating the need for sites to decrypt and filter frames.
2Reliability
If frames are transmitted with encrypted VLAN tags, then security is improved, but network efficiency deteriorates due to unnecessary flooding
Solution Approach 1:
The patent separates the security function (encrypted VLAN tag) from the routing function (service VLAN tag). This allows the network to use the cleartext service VLAN tag for efficient broadcast domain restriction and frame forwarding, while the encrypted tag maintains security, thereby improving network efficiency without compromising security.
Solution Approach 2:
The service VLAN tag serves as a mediator that enables efficient frame routing without requiring decryption at intermediate nodes. Network devices can use the cleartext service VLAN tag to determine frame destination and apply broadcast domain restrictions, eliminating unnecessary flooding and improving overall network efficiency.
3Reliability
If all frames are flooded to all ports in a secure layer 2 broadcast network, then broadcast domain restriction is maintained, but resource utilization deteriorates
Solution Approach 1:
The patent extracts the broadcast domain restriction information from the encrypted VLAN tag and places it into a separate cleartext service VLAN tag. This extraction allows network devices to use the service VLAN tag for efficient frame routing decisions, preventing frames from being flooded to ports that do not need them, thereby reducing unnecessary resource consumption.
Solution Approach 2:
The service VLAN tag acts as an intermediary that enables efficient frame routing by providing broadcast domain restriction information in cleartext form. This allows network devices to make intelligent forwarding decisions without decrypting frames, reducing unnecessary frame transmission and improving resource utilization.
4Reliability
If sites decrypt and examine VLAN identifiers to filter unwanted packets, then frame security is maintained, but processing overhead increases
Solution Approach 1:
The patent performs preliminary action by inserting the service VLAN tag into the frame before encryption and transmission. This allows receiving sites to use the cleartext service VLAN tag for immediate frame routing decisions without needing to decrypt the frame first, significantly reducing processing overhead and time.
Solution Approach 2:
The service VLAN tag serves as an intermediary that provides VLAN identification information in cleartext form, allowing sites to make rapid frame filtering and routing decisions without decryption. This eliminates the time-consuming process of decrypting every frame to examine VLAN identifiers.
Data Source
AI summary
Methods, systems, and computer program products for sending and receiving frames associated with different VLANs over a secure layer 2 broadcast transport network are disclosed. According to one method, a layer 2 frame is received at a transmit port of a layer 2 forwarding device. The layer 2 frame is to be sent over a secure layer 2 broadcast transport network. A VLAN identifier corresponding to a first VLAN is extracted from the layer 2 frame. The first VLAN identifier is mapped to a second VLAN identifier used by the secure broadcast transport layer 2 network to identify the first VLAN. A portion of the layer 2 frame including the first VLAN identifier is encrypted. The layer 2 frame is transmitted over the secure layer 2 broadcast transport network with the second VLAN identifier in a cleartext portion of the frame.