Methods, systems, and computer program products for transmitting and receiving layer 2 frames associated with different virtual local area networks (VLANs) over a secure layer 2 broadcast transport network
Methods, systems, and computer program products for sending and receiving frames associated with different VLANs over a secure layer 2 broadcast transport network are disclosed. According to one method, a layer 2 frame is received at a transmit port of a layer 2 forwarding device. The layer 2 frame is to be sent over a secure layer 2 broadcast transport network. A VLAN identifier corresponding to a first VLAN is extracted from the layer 2 frame. The first VLAN identifier is mapped to a second VLAN identifier used by the secure broadcast transport layer 2 network to identify the first VLAN. A portion of the layer 2 frame including the first VLAN identifier is encrypted. The layer 2 frame is transmitted over the secure layer 2 broadcast transport network with the second VLAN identifier in a cleartext portion of the frame.
1. A method for transmitting a layer 2 frame over a secure layer 2 broadcast transport network, the method comprising:
(a) receiving, at a transmit port of a layer 2 forwarding device, a layer 2 frame to be sent over a secure layer 2 broadcast transport network, the layer 2 frame including a first VLAN identifier used to identify a first VLAN;
(b) mapping the first VLAN identifier to a second VLAN identifier used by the secure layer 2 broadcast transport network to identify the first VLAN and to limit the layer 2 broadcast domain of the layer 2 frame in the layer 2 broadcast transport network to the first VLAN;
(c) encrypting a portion of the layer 2 frame including the first VLAN identifier and inserting the second VLAN identifier in an unencrypted portion of the layer 2 frame; and
(d) transmitting the layer 2 frame over the secure layer 2 broadcast transport network.
2. The method of claim 1 wherein the secure layer 2 broadcast transport network comprises a service network, the sending site comprises a customer network, the first VLAN identifier comprises a customer VLAN tag inserted by the customer network, and the second VLAN identifier comprises a service VLAN identifier.
3. The method of claim 2 wherein the customer network and the service network are under a common administrative domain.
4. The method of claim 2 wherein the customer network and the service network are under different administrative domains.
5. The method of claim 1 wherein encrypting a portion of the layer 2 frame includes encrypting the portion of the layer 2 frame prior to the mapping of the first VLAN identifier to the second VLAN identifier.
6. The method of claim 1 wherein encrypting a portion of the layer 2 frame includes encrypting the portion of the layer 2 frame simultaneously with the mapping of the first VLAN identifier to the second VLAN identifier.
7. The method of claim 1 wherein encrypting a portion of the layer 2 frame includes encrypting the portion after the mapping of the first VLAN identifier to the second VLAN identifier.
8. The method of claim 1 wherein transmitting the layer 2 frame over the secure layer 2 broadcast transport network includes using the second VLAN identifier to restrict a broadcast domain of the layer 2 frame in the secure layer 2 broadcast transport network.
9. The method of claim 1 wherein transmitting the layer 2 frame over a secure layer 2 broadcast transport network includes transmitting the secure layer 2 frame over a metro Ethernet network.
10. The method of claim 1 comprising, at a receiving site, decrypting the layer 2 frame and forwarding the layer 2 to the first VLAN using the first VLAN identifier.
11. The method of claim 1 comprising, at a receiving site, decrypting the layer 2 frame, replacing the first VLAN identifier with a third VLAN identifier used by the receiving site to identify the first VLAN, and forwarding the layer 2 frame to nodes associated with the first VLAN.
12. The method of claim 11 wherein the first VLAN identifier corresponds to a first customer VLAN of a first customer network, wherein the receiving site comprises a second customer network, and wherein the third VLAN identifier corresponds to a second customer VLAN of the second customer network.
13. A system for transmitting frames associated with different VLANs over a secure layer 2 broadcast network, the system comprising:
(a) a layer 2 frame encryption module for receiving a layer 2 frame to be transmitted over a secure layer 2 broadcast transport network and for encrypting a portion of the layer 2 frame including a first VLAN identifier associated with a first VLAN;
(b) a service VLAN identifier mapper for mapping the first VLAN identifier to a second VLAN identifier used by the secure layer 2 broadcast transport network to identify the first VLAN and to limit the layer 2 broadcast domain of the first layer 2 frame in the layer 2 broadcast transport network to the first VLAN and for inserting the second VLAN identifier in an unencrypted portion of the layer 2 frame; and
(c) an outbound layer 2 frame transmitter for transmitting the layer 2 frame over the secure layer 2 broadcast transport network.
14. The system of claim 13 wherein the secure layer 2 broadcast transport network comprises a service network, the sending site comprises a customer network, the first VLAN identifier comprises a customer VLAN tag inserted by the customer network, and the second VLAN identifier comprises a service VLAN identifier.
15. The system of claim 14 wherein the customer network and the service network are under a common administrative domain.
16. The system of claim 14 wherein the customer network and the service network are under different administrative domains.
17. The system of claim 13 wherein the layer 2 frame encryption module is adapted to encrypt the portion of the layer 2 frame prior to the mapping of the first VLAN identifier to the second VLAN identifier.
18. The system of claim 13 wherein the layer 2 frame encryption module is adapted to encrypt the portion of the layer 2 frame simultaneously with the mapping of the first VLAN identifier to the second VLAN identifier.
19. The system of claim 13 wherein the layer 2 frame encryption module is adapted to encrypt the portion of the layer 2 frame after the service VLAN transport identifier mapper maps the first VLAN identifier to the second VLAN identifier.
20. The system of claim 13 wherein the outbound layer 2 frame transmitter is adapted to transmit the layer 2 frame over a metro Ethernet.
21. A computer program product comprising computer-executable instructions embodied in a non-transitory computer-readable medium for performing steps comprising:
(a) receiving, at a transmit port of a layer 2 forwarding device, a layer 2 frame to be sent over a secure layer 2 broadcast network, the layer 2 frame including a first VLAN identifier used to identify a first VLAN;
(b) mapping the first VLAN identifier to a second VLAN identifier used by the secure layer 2 broadcast transport network to identify the first VLAN and to limit the layer 2 broadcast domain of the layer 2 frame in the layer 2 broadcast network to the first VLAN;
(c) encrypting a portion of the layer 2 frame and inserting the second VLAN identifier in an unencrypted portion of the layer 2 frame; and
(d) transmitting the layer 2 frame over the secure layer 2 broadcast transport network.