Domain isolation through virtual network machines
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-021/44
H04L-012/46
H04L-012/24
출원번호
US-0210002
(2014-03-13)
등록번호
US-9047460
(2015-06-02)
발명자
/ 주소
Salkewicz, William
출원인 / 주소
ERICSSON AB
대리인 / 주소
Nicholson de Vos Webster & Elliott LLP
인용정보
피인용 횟수 :
0인용 특허 :
75
초록▼
A method and device for communicating information resources between subscriber end stations and nodes belonging to different network domains is described. The device instantiates different virtual network machines for different network domains using separate independently administrable network datab
A method and device for communicating information resources between subscriber end stations and nodes belonging to different network domains is described. The device instantiates different virtual network machines for different network domains using separate independently administrable network databases. Each of the administrable chores of the separate independently administrable network databases includes the assignment of access control and the configuration of the policies for those network databases. The policies include traffic filtering policies to indicate what kind of information payloads can be carried, traffic and route filtering policies to indicate what paths through the network will be used for each payload carried. Each of the network domains includes one of the different virtual network machines and each of the different network domains is virtually isolated from other network domains.
대표청구항▼
1. A method performed by a server end station communicatively coupled with a single network device that is communicatively coupled with one or more end stations, wherein the server end station stores a plurality of user records, the method comprising: authenticating, using an authentication, authori
1. A method performed by a server end station communicatively coupled with a single network device that is communicatively coupled with one or more end stations, wherein the server end station stores a plurality of user records, the method comprising: authenticating, using an authentication, authorization and accounting (AAA) protocol, a user based upon identifying one of the plurality of user records that identifies the user, wherein the user utilizes an end station of the one or more end stations, wherein each of the plurality of user records comprises information indicating which of a plurality of virtual routers the end station of the user is to be currently coupled to, wherein the single network device comprises the plurality of virtual routers that share a set of physical resources of the single network device, and wherein each of the plurality of virtual routers provides access to a different one of a plurality of virtual private networks; andcausing the single network device to communicatively couple the end station of the user with one of the plurality of virtual routers selected based on the information from the user record identified during said authenticating. 2. The method of claim 1, wherein said causing the single network device to communicatively couple the end station of the user with one of the plurality of virtual routers comprises transmitting, using the AAA protocol, the information from the identified user record that indicates the one of the plurality of virtual routers that the end station of the user is to be coupled to. 3. The method of claim 1, wherein the AAA protocol is Remote Authentication Dial In User Service (RADIUS) protocol. 4. The method of claim 3, wherein said identifying the one of the plurality of user records that identifies the user is based upon a username provided by the user and a password provided by the user. 5. The method of claim 1, wherein said information comprises an identifier of one of the plurality of virtual private networks. 6. The method of claim 1, wherein the single network device, after communicatively coupling the end station of the user with the one of the plurality of virtual routers, routes packets for the end station via the one of the plurality of virtual routers using one of a plurality of network databases, wherein each of the plurality of network databases belongs to a different one of the plurality of virtual routers. 7. The method of claim 6, wherein said single network device, responsive to receiving the information from the identified user record that indicates that one of the plurality of virtual routers the end station of the user is to be currently coupled to, creates or updates a binding data structure that associates the end station of the user with the one of the plurality of virtual routers. 8. A server end station to be communicatively coupled with a single network device that is to be communicatively coupled with one or more end stations of one or more users, the server end station comprising: a set of one or more processors;communications hardware to transmit and receive packets; anda non-transitory computer-readable medium having stored therein a set of instructions that, when executed by the set of processors, cause the server end station to: authenticate, using an authentication, authorization and accounting (AAA) protocol, a user of the one or more users based upon identifying one of a plurality of user records stored by the server end station that identifies the user, wherein the plurality of user records comprise information indicating which of a plurality of virtual routers the one or more end stations of the one or more users are to be communicatively coupled to, wherein the single network device comprises the plurality of virtual routers that share a set of physical resources of the single network device, and wherein each of the plurality of virtual routers provides access to a different one of a plurality of virtual private networks, andcause the single network device to communicatively couple an end station of the user with one of the plurality of virtual routers selected based on the information from the user record identified during said authentication. 9. The server end station of claim 8, wherein said set of instructions cause the server end station to cause the single network device to communicatively couple the end station of the user with the one of the plurality of virtual routers by causing the single network device to transmit, using the AAA protocol, the information from the identified user record that indicates the one of the plurality of virtual routers the end station of the user is to be coupled to. 10. The server end station of claim 8, wherein the AAA protocol is Remote Authentication Dial In User Service (RADIUS) protocol. 11. The server end station of claim 10, wherein said identifying the one of the plurality of user records that identifies the user is based upon a username provided by the user and a password provided by the user. 12. The server end station of claim 8, wherein said information comprises an identifier of one of the plurality of virtual private networks. 13. The server end station of claim 8, wherein the single network device, after communicatively coupling the end station of the user with the one of the plurality of virtual routers, is to route packets for the end station via the one of the plurality of virtual routers using one of a plurality of network databases, wherein each of the plurality of network databases belongs to a different one of the plurality of virtual routers. 14. The server end station of claim 8, wherein said single network device, responsive to a receipt of the information from the identified user record that indicates the one of the plurality of virtual routers the end station of the user is to be coupled to, is to create or update a binding data structure that associates the end station of the user with the one of the plurality of virtual routers. 15. A non-transitory computer-readable storage medium that stores instructions which, when executed by a set of one or more processors of a server end station, cause the server end station to perform operations comprising: authenticating, using an authentication, authorization and accounting (AAA) protocol, a user based upon identifying one of a plurality of user records that identifies the user, wherein the user utilizes an end station of one or more end stations that are communicatively coupled with a single network device, wherein each of the plurality of user records comprises information indicating which of a plurality of virtual routers the end station of the user is to be coupled to, wherein the single network device comprises the plurality of virtual routers that share a set of physical resources of the single network device, and wherein each of the plurality of virtual routers provides access to a different one of a plurality of virtual private networks; andcausing the single network device to communicatively couple the end station of the user with one of the plurality of virtual routers selected based on the information from the user record identified during said authenticating. 16. The non-transitory computer-readable storage medium of claim 15, wherein said causing the single network device to communicatively couple the end station of the user with one of the plurality of virtual routers comprises transmitting, using the AAA protocol, the information from the identified user record that indicates the one of the plurality of virtual routers the end station of the user is to be coupled to. 17. The non-transitory computer-readable storage medium of claim 15, wherein the AAA protocol is Remote Authentication Dial In User Service (RADIUS) protocol. 18. The non-transitory computer-readable storage medium of claim 17, wherein said identifying the one of the plurality of user records that identifies the user is based upon a username provided by the user and a password provided by the user. 19. The non-transitory computer-readable storage medium of claim 17, wherein said information comprises an identifier of one of the plurality of virtual private networks. 20. The non-transitory computer-readable storage medium of claim 15, wherein the single network device, after communicatively coupling the end station of the user with the one of the plurality of virtual routers, routes packets for the end station via the one of the plurality of virtual routers using one of a plurality of network databases, wherein each of the plurality of network databases belongs to a different one of the plurality of virtual routers. 21. The non-transitory computer-readable storage medium of claim 20, wherein said single network device, responsive receiving the information from the identified user record that indicates the one of the plurality of virtual routers the end station of the user is to be currently coupled to, creates or updates a binding data structure that associates the end station of the user with the one of the plurality of virtual routers.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (75)
Christie ; deceased Joseph Michael ; Christie ; legal representative by Joseph S. ; Christie ; legal represenative by Jean M. ; DuRee Albert Daniel ; Gardner Michael Joseph ; Nelson Tracy ; Wiley Wil, ATM gateway system.
Stein Scott A. (Phoenix AZ) Carlson Bruce M. (Phoenix AZ) Yen Chung S. (Bedford MA) Farrington Kevin M. (Williamsville NY), Ally mechanism for interconnecting non-distributed computing environment (DCE) and DCE systems to operate in a network s.
Vepa, RamKrishna; Baker, Roman; Nanda, Sameer; Binder, James; Maufer, Thomas Albert, Combining virtual local area networks and load balancing with fault tolerance in a high performance protocol.
Willner Barry E. ; Block Marc A. ; Brady Stephen ; Foulger Davis ; Ganek Alan G. ; Harrison Colin G. ; Marks Barry ; Newman Thomas E. ; Soora Gopalaswamy ; Stern Edith H. ; Tantawi Asser N., Cross service common user image association.
Varghese George ; Bassett John,GBX ; Thomas Robert Eugene ; Higginson Peter,GBX ; Cobb Graham,GBX ; Spinney Barry A. ; Simcoe Robert, Device for partitioning ports of a bridge into groups of different virtual local area networks.
Dobbins Kurt ; Grant Thomas A. ; Ruffen David J. ; Kane Laura ; Len Theodore ; Andlauer Philip ; Bahi David H. ; Yohe Kevin ; Fee Brendan ; Oliver Chris ; Cullerot David L. ; Skubisz Michael, Distributed connection-oriented services for switched communications networks.
Fehskens Leonard G. ; Sylor Mark W. ; Chapman Kenneth W. ; Schuchard Robert C. ; Goldfarb Stanley I. ; O'Brien Linsey B. ; Rosenbaum Richard L. ; Kohls Ruth E. J. ; Namoglu Sheryl F. ; Seger Mark J., Entity management system.
Dutcher David Paul ; Lenharth Scott Alan ; Smith Stanley Alan ; Hughes Patrick Alan ; Elswick Paul Blair, Managing a dynamically-created user account in a client following authentication from a non-native server domain.
Meltzer Bart Alan ; Allen Terry ; Fuchs Matthew Daniel ; Glushko Robert John ; Maloney Murray,CAX, Market makers using documents for commerce in trading partner networks.
Arrow Leslie J. ; Bots Henk J. ; Hoke Mark R. ; Hunt William E. ; Jones Russell C. ; Liu Quentin C., Method and apparatus for configuring a virtual private network.
Roberts, Andrew F.; Booth, Jonathan W.; Burati, Michael R.; Beauvais, Thomas E.; Serfass, Jr., John T.; Sommers, III, Joseph, Method and apparatus for providing web based services using an XML Runtime model to store state session data.
Cox Norman Eugene ; Christensen Kenneth J. ; Ervin Jim P. ; Matlack ; Jr. Richard Colbert, Method and system for distributing network routing functions to local area network stations.
Chan Chuck Y. ; Ganugapati Krishna ; Johnson Margaret K. ; Judd Steven G. ; Kwan Stuart L. S. ; Watson Colin, Method and system for uniformly accessing multiple directory services.
Flug Christian (Munich DEX) Kolb Dieter (Germering DEX), Method for dynamically linking definable program elements of an interactive data processing system.
Mitchell David C. ; Anderson Kelly L. ; Osman Andrew V. ; Mitchell Dale K., Method for managing dynamic relations between objects in dynamic object-oriented languages.
Jain Lalit ; Ford Michael T., Network device for supporting construction of virtual local area networks on arbitrary local and wide area computer networks.
Tantry Subhash B. (Palo Alto CA) Mashruwala Rajesh U. (Palo Alto CA) Lozier Barry A. (Sunnyvale CA) Hess Richard L. (Palo Alto CA), Object-oriented architecture for factory floor management.
Parker, Simon; MacCarthy, Diarmuid Micheal; McDaid, Georgina; Watson, Charles Ian; Baker, Robert Patrick; O'Donoghue, Hugh; Buckley, Patrick Anthony Warren, Operating system for structured information processing.
Bruno, John Louis; Brustoloni, Jose' Carlos; Gabber, Eran; Silberschatz, Abraham; Small, Christopher Allen, Operating system transfer of control and parameter manipulation using portals.
Narad Charles E. ; Fall Kevin ; MacAvoy Neil ; Shankar Pradip ; Rand Leonard M. ; Hall Jerry J., Packet processing system including a policy engine having a classification unit.
Meltzer Bart Alan ; Davidson Andrew Everett ; Fuchs Matthew Daniel ; Glushko Robert John ; Persson Kenneth ; Schwarzhoff Kelly Lane, Participant server which process documents for commerce in trading partner networks.
Herve Le Goff DE; Norbert Haertelt DE; Markus Hies DE; Helmut Oberheim DE; Michael Schambach DE, Process and apparatus for the operation of virtual private networks on a common data packet communication network.
Charles E. Narad ; Kevin Fall ; Neil MacAvoy ; Pradip Shankar ; Leonard M. Rand ; Jerry J. Hall, Programmable system for processing a partitioned network infrastructure.
Lonnroth, Magnus M.; Svensson, Roland; Svensson, Johan, Providing clients with services that retrieve data from data sources that do not necessarily support the format required by the clients.
Barker Thomas N. (Vestal NY) Collins Clive A. (Poughkeepsie NY) Dapp Michael C. (Endwell NY) Dieffenderfer James W. (Owego NY) Lesmeister Donald M. (Vestal NY) Nier Richard E. (Apalachin NY) Retter E, SIMD/MIMD processing memory element (PME).
Lai Konrad K. (Aloha OR) Pollack Frederick J. (Portland OR), Synchronous communication between execution environments in a data processing system employing an object-oriented memory.
Thorson Gregory M. (Altoona WI) Scott Steven L. (Eau Claire WI), System for randomly modifying virtual channel allocation and accepting the random modification based on the cost functio.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.