Nortel Networks Corporation

Other

Avaya Inc.

Yunzhou Li

Billy C Ng

Shuching Shieh

Bilel N Jamoussi

David Benson

Dan Adamski

Jyothi Hayes

Jagannath Shantigram

Multicast networks are partitioned into hierarchical security domains. Each security domain may comprise one or more lower security domains. Each security domain includes a security broker that distributes a group key and translates multicast data destined to the security domain, if necessary. A primary security broker at the second level of the hierarchical multicast system distributes the top security key to all peer members, including all peer security domain brokers to establish trust relationships. For each security domain boundary with security domain border routers, a multicast virtual link in configured that connects the security domain border routers and the security broker for the security domain to reduce the latency in forwarding multicast data. It can also make the backbone of the security domain contiguous so that multicast data can travel unchanged across the backbone. The multicast data is forwarded to the security domain through the security broker with security translation. A group key is distributed at each hierarchy level by exchange of Group request and Group reply messages. The rekey process is accomplished by multicasting Rekey Announcement messages, either regionally by a security broker, or globally by the group controller through the primary top regional security broker.

Method for key distribution in a hierarchical multicast traffic security system for an internetwork

Multicasting data includes multicasting data to at least one line card attached to a router and storing state information associated with the data as a default state at each line card the data was multicast to. Multicast data having an unknown source and/or an unknown group need not be forwarded to the control path; the data path can be relied upon. A multicast packet included in the data can be forwarded up and evaluated to determine the packet's multicast source and/or group. After the state(s) are determined, the forwarding decision for the known states can be changed to 'no more forwarding' for line cards that need not receive data destined for the multicast group, e.g., ports not leading to member of the multicast group.

Multicast when forwarding information is unknown

A method and apparatus for distributing keys in a multicast domain is provided. In a secure multicast domain, a request to join a multicast group for a time period occurs. A key distributor which controls access to the multicast data group determines if the request will be accepted. If the request is accepted the key distributor assigns the member to a virtual channel, wherein each virtual channel is defined by a time period. A data group key is forwarded to the member as is a virtual channel key. The member can then receive and decode events from the data group on the assigned virtual channel.

Apparatus and method for distributing management keys in a multicast domain

An apparatus and method for managing multiple traffic redundancy mechanisms includes a resource manager for managing the multiple redundancy mechanisms for bridging traffic between a working port and a protection port, and uses an agent for the working port in order to maintain routes associated with the working port even after a failure occurs that affects communication over the working port. The resource manager creates a protection group including the working port and the protection port. A traffic bridge is established between the working port and the protection port.

Apparatus and method for supporting multiple traffic redundancy mechanisms

A system, device, and method for bridging network traffic between a first communication interface and a second communication interface uses a pre-computed bridged routing table to enable a bridge to be established quickly. The pre-computed bridged routing table includes the second communication interface as an outgoing interface in each routing table entry having the first communication interface as an outgoing interface. The bridged routing table is pre-computed for the pair of communication interfaces by searching a main routing table for all main routing table entries having the first communication interface as an outgoing interface and creating, for each such main routing table entry, a corresponding bridged routing table entry including all outgoing interfaces from the main routing table entry and additionally including the second (bridged) communication interface as an outgoing interface. Bridged routing tables may be pre-computed for multiple potential communication interface pairs.

System, device, and method for bridging network traffic

An apparatus and method of implementing multicast security in a given multicast domain, the given multicast domain having one or more network devices, receives multicast traffic that is encrypted with a global key, the global key being available to the given multicast domain and one or more other multicast domains, decrypts the received multicast traffic with the global key to produce decrypted multicast traffic, encrypts the decrypted multicast traffic with a local key to produce local encrypted multicast traffic, the local key being available to the given multicast domain, and forwards the local encrypted multicast traffic to the one or more network devices in the given multicast domain. In a further embodiment, the apparatus and method for implementing multicast security in a given multicast domain first receives a global key message that identifies the global key.

Apparatus and method of implementing multicast security between multicast domains

In a router, externally received messages addressed to an active line card are bridged to a protection line card. Each line card in the router is programmed to respond to such externally received messages by directing them to the protection line card associated with the active line card as well as to the active line card. The protection line card is configured with inbound and outbound path tables that are the clones of the inbound and outbound path tables of its corresponding active line card. Bridging is accomplished by revising descriptors stored in a plurality of line cards to indicate an association between an active one of the line cards and its protection line card. Received messages are addressed using the revised descriptors to the active line card and also to its protection line card. Upon failure of an active line card, its physical interface can be disabled once its protection line card has clones of the inbound and outbound path tables and bridging has been set up.

Mechanism for automatic protection switching in a router

An apparatus and method for processing multicast traffic in a given multicast domain aggregates one or more multicast interfaces into an aggregation interface, each multicast interface linked to a multicast domain other than the given multicast domain via a domain interface, the aggregation interface linked to the given multicast domain via an inbound interface. The apparatus and method then receives at the aggregation interface one or more multicast domain group membership messages from one or more of the other multicast domains, forwards multicast traffic for a particular multicast group from the given multicast domain towards the one or more other multicast domains via the inbound interface, and determines whether one or more of the other multicast domains is interested in the particular multicast group. Last, the apparatus and method, for each other multicast domain determined to be interested in the particular multicast group, establishes the domain interface as the outbound interface for the forwarded multicast traffic.

Method and apparatus for aggregating multicast interfaces

A method of multicast routing includes receiving link state advertisements from routers in a network, constructing a short path tree multicast routing table from the received link state packets.

Reverse path forwarding using a multicast routing table

A method of processing a multicast packet that includes determining whether a first forwarding cache that stores forwarding information for ranges of addresses includes a cache entry covering the source address, and, if the first forwarding cache includes the such an entry, adding an entry to a second forwarding cache for the specific source address and group of the packet using the forwarding information associated with the first cache entry.

Multicast routing cache

A system, device, and method for reducing the number of multicast routes maintained in a multicast routing information base aggregates a group of multicast routes and installs a single policy route for the group of multicast routes. The policy route is utilized as a default multicast route when no more-specific multicast route is available for one of the aggregated multicast routes. The policy routes are collected and distributed by a bootstrap device, preferably using a special bootstrap message.

System, device, and method for reducing the number of multicast routes maintained in a multicast routing information base

An apparatus and method of managing given VPN routing data received for a given VPN encodes the given VPN routing data into a format that is compatible with a located routing table. The encoded VPN routing data then is stored in the routing table. The routing table may have routing data for the given VPN, and routing data for another VPN. Accordingly, the routing table is capable of storing VPN routing data for more than one VPN.

Apparatus and method of managing virtual private network routing data

A system, device, and method for detecting and recovering from failures in a multicast communication system involves joining a multicast group over a primary interface, monitoring for multicast group information received over the primary interface, and determining that there is a multicast group failure if no multicast group information is received over the primary interface for a predetermined amount of time. Recovering from such a failure typically involves joining the multicast group over a backup interface in order to continue receiving multicast group information over the backup interface. A relay/proxy device may join the multicast group on behalf of a multicast host and forward multicast group information to the multicast host.

System, device, and method for detecting and recovering from failures in a multicast communication system

A mechanism for allowing a prober to detect and identify leaky points within a network protocol domain utilizes a Probe Boundary Leak (PBL) protocol to propagate a probe message throughout the network protocol domain. Each PBL router that receives the probe message checks for leaky points in the network protocol domain. Any PBL router that detects a leaky point in the network protocol domain sends a negative response message to the prober including a network address for each leaky point detected by the PBL router. A PBL border router within the network protocol domain being probed sends a positive response message to the prober including a network address for each exit interface supported by the PBL border router. The prober thereby receives a list of &ldquo;leaky&rdquo; network interfaces and a list of &ldquo;non-leaky&rdquo; exit interfaces for the network protocol domain.

Technique for detecting leaky points within a network protocol domain

A method of routing network packets to a border router joining different network domains includes defining a range of addresses for the border router in a router forwarding table, receiving a network packet, determining addresses included in the network packet, performing a search on the router forwarding table using the determined addresses, and transmitting the packet to the border router if the defined range of addresses matches for the determined addresses.

Growing community of inventors

Lowell, MA, United States of America

Yunzhou Li