Broadband access for virtual private networks

1. An apparatus comprising:

at least one circuit configured to receive an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type, wherein the VPN identification is a unique identification number assigned to the source device for marking the upper layer packet as belonging to a VPN to which the source device and a destination device belong, wherein the destination option type includes a value indicating to discard the upper layer packet on a condition that the apparatus does not recognize the destination option type;

the at least one circuit configured to authenticate the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification; and

the at least one circuit configured to determine whether the apparatus recognizes the destination option type of the upper layer packet, wherein the at least one circuit is configured to discard the upper layer packet on a condition that the apparatus does not recognize the destination option type, and wherein the at least one circuit is configured to decapsulate the upper layer packet into a lower layer packet and transmit the decapsulated packet to a destination on a condition that the apparatus recognizes the destination option type.

2. The apparatus of claim 1 , wherein the apparatus is associated with a service provider.

3. The apparatus of claim 2 , wherein the at least one circuit is configured to receive the upper layer packet from an ingress edge device and wherein the ingress edge device is associated with the service provider.

4. The apparatus of claim 1 , wherein the VPN identification comprises at least four bytes.

5. The apparatus of claim 1 , wherein the VPN identification includes a VPN hop count.

6. The apparatus of claim 1 , wherein the apparatus is a router.

7. The apparatus of claim 1 , wherein the apparatus is a gateway.

8. The apparatus of claim 1 , wherein the upper layer packet is sent to multicast addresses determined by a service provider network and includes an address of the apparatus on a condition that the destination is not mapped specifically to the apparatus.

9. The apparatus of claim 1 , wherein the upper layer packet is sent to an address of the apparatus but not at other apparatus of a service provider network that the apparatus is associated with on a condition that the destination is mapped specifically to the apparatus.

10. A method, implemented by an apparatus, comprising:

receiving an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type, wherein the VPN identification is a unique identification number assigned to the source device for marking the upper layer packet as belonging to a VPN to which the source device and a destination device belong, wherein the destination option type includes a value indicating to discard the upper layer packet on a condition that the apparatus does not recognize the destination option type;

authenticating the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification; and

determining whether the apparatus recognizes the destination option type of the upper layer packet, wherein the determining further comprises:

discarding the upper layer packet on a condition that the apparatus does not recognize the destination option type; and

decapsulating the upper layer packet into a lower layer packet and transmitting the decapsulated packet to a destination on a condition that the apparatus recognizes the destination option type.

11. The method of claim 10 , wherein the apparatus is associated with a service provider.

12. The method of claim 11 , wherein the upper layer packet is received from an ingress edge device and wherein the ingress edge device is associated with the service provider.

13. The method of claim 10 , wherein the VPN identification comprises at least four bytes.

14. The method of claim 10 , wherein the VPN identification includes a VPN hop count.

15. The method of claim 10 , wherein the apparatus is a router.

16. The method of claim 10 , wherein the apparatus is a gateway.

17. The method of claim 10 , wherein the upper layer packet is sent to multicast addresses determined by a service provider network and includes an address of the apparatus on a condition that the destination is not mapped specifically to the apparatus.

18. The method of claim 10 , wherein the upper layer packet is sent to an address of the apparatus but not at other apparatus of a service provider network that the apparatus is associated with on a condition that the destination is mapped specifically to the apparatus.

19. A non-transitory computer-readable storage medium with stored instructions, wherein the stored instructions are executable by a processor of a computer, the instructions comprising:

instructions to receive an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type, wherein the VPN identification is a unique identification number assigned to the source device for marking the upper layer packet as belonging to a VPN to which the source device and a destination device belong, wherein the destination option type includes a value indicating to discard the upper layer packet on a condition that the apparatus does not recognize the destination option type;

instructions to authenticate the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification;

instructions to determine whether the processor recognizes the destination option type of the upper layer packet;

instructions to discard the upper layer packet on a condition that the processor does not recognize the destination option type; and

instructions to decapsulate the upper layer packet into a lower layer packet and transmit the decapsulated packet to a destination on a condition that the processor recognizes the destination option type.