System for securing the access to a destination in a virtual private network
View Patent ↗A system for securing the access to a destination of a virtual private network (VPNA) connected to a nominal access router (PE 3 ) includes at least one core router (P 2 ) adapted to: detect a failure affecting communication with the nominal access router (PE 3 ); and switch the traffic to a protector access router (PE 6 ) in a back-up tunnel bypassing the nominal access router (PE 3 ). The protector access router (PE 6 ) is adapted: to replace, in an MPLS packet, a nominal VPN label specific to the nominal access router (PE 3 ) by a back-up VPN label specific to a back-up access router (PE 4 ) connected to that destination; and to redirect said packet to the back-up access router (PE 4 ) in a tunnel bypassing the nominal access router (PE 3 ).
1. A system for securing the access to a destination in a virtual private network connected to at least one nominal access router, comprising:
at least one core router adapted to:
detect a failure affecting communication with said nominal access router; and switch MPLS packet traffic to a protector access router in a back-up tunnel bypassing the nominal access router;
said protector access router being adapted to:
replace, in an MPLS packet, a nominal VPN label specific to said nominal access router by a back-up VPN label specific to a back-up access router connected to that destination; and
redirect said MPLS packet to said back-up access router in a tunnel bypassing said nominal access router.
2. The system according to claim 1 , comprising a partition of the VPN label space between said protector access router, said at least one nominal access router, and said at least one back-up access router.
3. The system according to claim 1 , wherein said core router sends said protector access router in said back-up tunnel information meaning that this back-up tunnel is to be used in the event of said failure.
4. A protector access router adapted to be used to secure the access to a destination in a virtual private network in the event of a failure affecting communication with a nominal access router connected to said network, comprising:
means for identifying a nominal VPN label specific to said nominal access router for said destination;
means for replacing, in a MPLS packet, said nominal VPN label by a back-up VPN label specific to a back-up access router for said destination; and
means for redirecting said MPLS packet to said back-up access router in a tunnel bypassing said nominal access router.
5. The protector access router according to claim 4 , comprising means for installing, in an MPLS switching table, said nominal label specific to said nominal access router for said destination and pointing to the back-up access router with said back-up VPN label specific to that back-up access router for that destination.
6. The protector access router according to claim 4 , comprising:
means for receiving from a core router via a back-up tunnel information meaning that said back-up tunnel is to be used in the event of said failure; and
means for creating a contextual MPLS switching table comprising instructions for:
replacing, in each MPLS packet received in said back-up tunnel, said nominal label by said back-up label; and
switching this MPLS packet to said back-up access router via said tunnel bypassing said nominal access router.
7. The protector access router according to claim 4 , comprising means for identifying said back-up access router and obtaining said labels from BGP announcements by said access routers.
8. A routing method usable in a protector access router for securing the access to a destination in a virtual private network in the event of a failure affecting communication with a nominal access router connected to said network, comprising:
a step of receiving an MPLS packet comprising a nominal VPN label specific to said nominal access router for the destination;
a step of replacing in said MPLS packet, said nominal VPN label by a back-up VPN label specific to a back-up access router for said destination; and
a step of redirecting said MPLS packet to said back-up access router in a tunnel bypassing said nominal access router.
9. A process in which a computer executes the instructions set forth in a computer program including instructions for performing the steps of a routing method according to claim 8 .
10. A non-transitory computer-readable storage medium storing a computer program including instructions for executing the steps of a routing method according to claim 8 .