Method for mapping packets to network virtualization instances
View Patent ↗An operating system adds an application signature as a tag in a packet header. In one embodiment the tag is inserted as a Q-tag in an Ethernet header. When a network element receives the tagged packet, it uses the tag alone or in combination with one or more additional header fields to map the packet to a network virtualization identifier segregating the application traffic on the network. Services are applied to packets according to network virtualization identifier to enable distributed application of services without requiring network elements to maintain state associated with packet flows.
1. A method of mapping packets of data to network virtualization instances, the method comprising the steps of:
creating, by a Media Access Control (MAC) process of an end system, MAC headers for packets of data, at least some of the packets of data being tagged with application signature tags implemented using a field of Internet Protocol (IP) headers of the packets of data, the step of creating MAC headers including a step of mapping the packets of data that are tagged with application signature tags to a set of network virtualization identifiers based on the application signature tags, the set of network virtualization identifiers being implemented using a field of the MAC headers;
receiving, by a network element, the plurality of packets of data;
applying sets of network services to the packets based on the network virtualization identifiers, the sets of network services being configured in the network element and associated with network virtualization instances; and
forwarding, by the network element, the packets of data within the network virtualization instances;
wherein the step of mapping the packets of data to network virtualization identifiers causes packets from applications requiring the same sets of network services to be forwarded by the network element within the same network virtualization instances.
2. The method of claim 1 , wherein the step of mapping uses a combination of fields of the IP headers in addition to the application signature tags.
3. The method of claim 1 , wherein the network virtualization identifiers are Virtual Local Area Network Identifiers (VLAN IDs).
4. The method of claim 1 , wherein the network virtualization identifiers are I-component Service Identifier (ISIDs).
5. The method of claim 1 , wherein the step of applying sets of network services includes applying, by the network element, a specified level of quality of service to packets within the network virtualization instance.
6. The method of claim 5 , wherein the specified level of quality of service enables latency for packets within the network virtualization instance to be specified.
7. The method of claim 1 , wherein the packets of data include encrypted payload portions, and wherein the step of mapping occurs without reference to data carried within the encrypted payload portions.
8. The method of claim 1 , further comprising the steps of receiving, by a second network element, the packets of data within the network virtualization instances and applying, by the second network element the sets of network services to the packets within the network virtualization instances, the sets of network services being configured in the second network element and associated with the network virtualization instances.
9. The method of claim 1 , wherein the sets of network services include traffic policing, traffic shaping, and Quality of Service.
10. The method of claim 1 , wherein the sets of network services include stateless firewall services.
11. An end system, comprising:
an operating system;
two or more applications communicating with the operating system via sockets; and
a Media Access Control (MAC) process in communication with the operating system;
wherein the operating system is configured to receive data from the application via the sockets, divide the data into the packets of data, add transport layer headers to the packets of data, add routing layer headers to the packets of data, and pass application signature tags for the packets of data to the MAC process, the application signature tags being based on identities of the applications from which the data was received; and
wherein the MAC process is configured to receive the packets of data from the operating system, apply MAC headers to the packets of data, and in connection with applying the MAC headers to the packets of data, map the packets of data to network virtualization identifiers based on the application signature tags and sets of network services to be applied to the packets, the MAC process being further configured to insert as Q-tags in the MAC headers, values associated with the application signature tags received from the Operating System, the Q-tags identifying network virtualization instances on the network within which the sets of network services will be applied to the packets of data.