Bridged cryptographic vlan
AssigneeMicrosoft Corporation
InventorsDENNIS MICHAEL VOLPANO, XINHUA J. ZHAO
Life of this patent
Estimating the term…
Abstract
The invention comprises three extensions of the IEEE 802.1Q VLAN bridge model. The first extension is the cryptographic separation of VLANs over trunk links. A LAN segment type referred to as an encapsulated LAN segment is introduced. All frames on such a segment are encapsulated according to an encryption and authentication code scheme. The second extension is the division of a trunk port into inbound and outbound ports. The third extension is a protocol that automatically infers for each outbound port in a bridged VLAN, a set of LAN segment types for the port that minimizes the number of transfers between encapsulated and unencapsulated segments required to transport a frame in the bridged VLAN.
Claims5
1-34. (canceled)
A method for eliminating redundant transfers between LAN segments in a bridged, cryptographic VLAN, comprising the steps of:
- avoiding transfer of an unencapsulated frame to a VLAN's cryptographically encapsulated segment more than once in a bridged VLAN where each transfer requires encryption;
- performing encryption once, said encryption being shared by all egress ports that belong to said VLAN's cryptographically encapsulated set across all bridges;
- and
- avoiding repeated cryptographically decapsulation across bridges in said bridged VLAN where each requires decryption.
A method for determining optimal transfer points between LAN segments representing a bridged, cryptographic VLAN, comprising the steps of:
- reducing any bridged LAN to a spanning tree whose nodes are said bridges and whose edges are trunk links to induce a partial order on said bridges;
- wherein a least bridge is the root of said spanning tree;
- wherein the set of bridges together with a partial order define a complete, partially ordered set;
- and
- wherein every nonempty subset of said bridges has a least upper bound;
- wherein said least upper bound of all bridges requiring a received frame of a VLAN to belong to one of said LAN segments representing said VLAN is an optimal transfer point for converting received frames to frames for that LAN segment;
- and
- deducing automatically, from an assignment of bridge access ports in said bridged VLAN to said LAN segments, the smallest set of LAN segments that must be associated with a given outbound trunk port in order to bridge said VLAN.
A protocol for access link displacement in a bridged, cryptographic VLAN, comprising bridges having inbound and outbound ports which bridges decrypt encrypted segments, said protocol comprising the steps of:
- recognizing an access port of a bridge of said bridged VLAN with which a displaced access link can be associated, wherein said access port may be virtual and created automatically;
- automatically assigning said access port to a LAN segment type based on a segment type of said displaced access link;
- and
- executing a transfer port protocol (TPP) for said bridged VLAN with said access port belonging to said assigned LAN segment type.
A method for joining an encrypted segment of a cryptographic VLAN, comprising the steps of:
- adding a new station to a group;
- distributing encryption key material to the new station;
- enabling all other stations in said group to eliminate said new station later by at least a subset of the other stations rekeying without every station so doing.
Dependencies are inferred from the claim text.