Broadband access for virtual private networks
An apparatus receives an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type. The apparatus authenticates the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification. The apparatus determines whether the apparatus recognizes the destination option type of the upper layer packet. The apparatus discards the upper layer packet on a condition that the apparatus does not recognize the destination option type. The apparatus decapsulates the upper layer packet into a lower layer packet and transmits the decapsulated packet to a destination on a condition that the apparatus recognizes the destination option type.
1. A method performed by a first interface device of a virtual private network (VPN), the method comprising:
receiving a data packet from a source device;
determining a destination address of a destination device from the received data packet;
determining whether the destination address is mapped to a second interface device of the VPN;
on a condition that the destination address is not mapped to a second interface device:
encapsulating the data packet in a multicast packet and adding a multicast address of the VPN;
on a condition that the destination address is mapped to a second interface device:
encapsulating the data packet in a unicast packet and adding a unicast address of the second interface device;
adding a VPN identification to the encapsulated packet;
adding a destination option type to the encapsulated packet, wherein the destination option type includes a value indicating to discard the encapsulated packet on a condition that an interface device does not recognize the destination option type; and
transmitting the encapsulated packet.
2. The method of claim 1 , wherein the VPN identification is a unique identification number assigned to the source device for marking the encapsulated packet as belonging to a VPN to which the source device and the destination device belong.
3. The method of claim 1 , wherein the VPN identification comprises at least four bytes.
4. The method of claim 1 , wherein the VPN identification includes a VPN hop count.
5. The method of claim 1 , wherein the data packet is received from the source device over a broadband access link.
6. The method of claim 1 , wherein the first interface device and the second interface device are associated with a service provider network.
7. The method of claim 1 , wherein the encapsulating is in accordance with a service provider network format.
8. The method of claim 1 , wherein the first interface device is associated with at least one line interface, wherein each line interface is associated with a source device.
9. The method of claim 1 further comprising caching a mapping of a source device with a line interface.
10. A first interface device of a virtual private network (VPN), the first interface comprising:
at least one circuit configured to receive a data packet from a source device;
the at least one circuit is further configured to determine a destination address of a destination device from the received data packet;
the at least one circuit is further configured to determine whether the destination address is mapped to a second interface device of the VPN;
the at least one circuit is further configured to, on a condition that the destination address is not mapped to a second interface device, encapsulate the data packet in a multicast packet and add a multicast address of the VPN to the encapsulated packet;
the at least one circuit is further configured to, on a condition that the destination address is mapped to a second interface device, encapsulate the data packet in a unicast packet and add a unicast address of the second interface device to the encapsulated packet;
the at least one circuit is further configured to add a VPN identification to the encapsulated packet and to add a destination option type to the encapsulated packet, wherein the destination option type includes a value indicating to discard the encapsulated packet on a condition that an interface device does not recognize the destination option type; and
the at least one circuit is further configured to transmit the encapsulated packet.
11. The first interface device of claim 10 , wherein the VPN identification is a unique identification number assigned to the source device for marking the encapsulated packet as belonging to a VPN to which the source device and the destination device belong.
12. The first interface device of claim 10 , wherein the VPN identification comprises at least four bytes.
13. The first interface device of claim 10 , wherein the VPN identification includes a VPN hop count.
14. The first interface device of claim 10 , wherein the data packet is received from the source device over a broadband access link.
15. The first interface device of claim 10 , wherein the first interface device and the second interface device are associated with a service provider network.
16. The first interface device of claim 10 , wherein the at least one circuit is further configured to encapsulate the packet is in accordance with a service provider network format.
17. The first interface device of claim 10 , wherein the first interface device is associated with at least one line interface, wherein each line interface is associated with a source device.
18. The first interface device of claim 10 , wherein the at least one circuit is further configured to cache a mapping of a source device with a line interface.