Back to results
US 11,115,323 B2Granted
Securing Layer-3 virtual private network
AssigneeSaudi Arabian Oil Company
InventorsMudashiru Busari, Salah M. S. Buraiky, Muhammad I. Khayyal
Life of this patent
Estimating the term…
Abstract
A data packet from a sub-virtual routing and forwarding (sub-VRF) in a virtual routing and forwarding (VRF) is received. The VRF includes more than one sub-VRF. A value in a Border Gateway Protocol (BGP) attribute attached to the data packet is determined. Based on the value in the BGP attribute, whether to route the data packet to a different sub-VRF in the VRF is determined.
Claims17
A computer-implemented method performed by an edge router, comprising:
- receiving, a data packet from a sub-virtual routing and forwarding (sub-VRF) in a virtual routing and forwarding (VRF), wherein the VRF represents an Layer-3 Virtual Private Network (L3VPN), the VRF includes more than one sub-VRF, the sub-VRF comprises a plurality of user devices, the VRF is included in a network that comprises multiple VRFs, and a different Border Gateway Protocol (BGP) attribute is assigned to each sub-VRF in the VRF;
- detecting, a second value in a Border Gateway Protocol (BGP) attribute attached to the data packet, wherein the BGP attribute attached to the data packet comprises a first value and the second value, the first value identifies the network that includes the multiple VRFs, and the second value identifies that the data packet is a unicast data packet and a source sub-VRF of the data packet or a multicast data packet;
- and
- determining, based on the second value in the BGP attribute, whether to route the data packet to a different sub-VRF in the VRF.
1 more element
An edge router, comprising:
- at least one hardware processor;
- and
- a non-transitory computer-readable storage medium coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions, when executed, cause the at least one hardware processor to perform operations comprising:
- receiving, a data packet from a sub-virtual routing and forwarding (sub-VRF) in a virtual routing and forwarding (VRF), wherein the VRF represents an Layer-3 Virtual Private Network (L3VPN), the VRF includes more than one sub-VRF, the sub-VRF comprises a plurality of user devices, the VRF is included in a network that comprises multiple VRFs, and a different Border Gateway Protocol (BGP) attribute is assigned to each sub-VRF in the VRF;
- detecting, a second value in a Border Gateway Protocol (BGP) attribute attached to the data packet, wherein the BGP attribute attached to the data packet comprises a first value and the second value, the first value identifies the network that includes the multiple VRFs, and the second value identifies that the data packet is a unicast data packet and a source sub-VRF of the data packet or a multicast data packet;
- and
- determining, based on the second value in the BGP attribute, whether to route the data packet to a different sub-VRF in the VRF.
4 more elements
A non-transitory computer-readable medium storing instructions which, when executed, cause a computing device to perform operations comprising:
- receiving, a data packet from a sub-virtual routing and forwarding (sub-VRF) in a virtual routing and forwarding (VRF), wherein the VRF represents an Layer-3 Virtual Private Network (L3VPN), the VRF includes more than one sub-VRF, the sub-VRF comprises a plurality of user devices, the VRF is included in a network that comprises multiple VRFs, and a different Border Gateway Protocol (BGP) attribute is assigned to each sub-VRF in the VRF;
- detecting, a second value in a Border Gateway Protocol (BGP) attribute attached to the data packet, wherein the BGP attribute attached to the data packet comprises a first value and the second value, the first value identifies the network that includes the multiple VRFs, and the second value identifies that the data packet is a unicast data packet and a source sub-VRF of the data packet or a multicast data packet;
- and
- determining, based on the second value in the BGP attribute, whether to route the data packet to a different sub-VRF in the VRF.
1 more element
Dependencies are inferred from the claim text.