# US 2022/0045989 A1 · Broadband access for virtual private networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0045989 A1 - Document ID: US20220045989A1 - Status: Published application - Kind: A1 - Application number: 17/508,554 - Filed: 2021-10-22 - Published: 2022-02-10 - Earliest claimed: 2003-07-29 - Assignees: Marlow Technologies, LLC - Applicants: Marlow Technologies, LLC - Inventors: Weijing Chen; Keith Joseph Allen - Web page: https://patentgrep.com/patent/US20220045989A1 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 12/46: Interconnection of networks - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 45/74: Address processing for routing - H04L 49/354: for supporting virtual local area networks [VLAN] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 65/611: for multicast or broadcast (systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06) - H04L 69/22: Parsing or analysis of headers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An apparatus receives an upper layer packet that includes data from a source device, a virtual private network (VPN) identification, a destination address, and a destination option type. The apparatus authenticates the upper layer packet by comparing the VPN identification of the received upper layer packet to a customer VPN identification. The apparatus determines whether the apparatus recognizes the destination option type of the upper layer packet. The apparatus discards the upper layer packet on a condition that the apparatus does not recognize the destination option type. The apparatus decapsulates the upper layer packet into a lower layer packet and transmits the decapsulated packet to a destination on a condition that the apparatus recognizes the destination option type. ## Claims ### Claim 1 A method comprising: determining, by a first interface device of a virtual private network (VPN), a destination address of a destination device, the destination address being within a data packet, the first interface device comprising one or more processors; determining, by the first interface device, whether the destination address is mapped to a second interface device of the VPN; generating, by the first interface device, an encapsulated packet by encapsulating the data packet and by adding an address to the encapsulated packet based on whether the destination address is mapped to the second interface device; and adding, by the first interface device, a VPN identification to the encapsulated packet. ### Claim 2 (depends on 1) The method of claim 1, wherein generating the encapsulated packet comprises: encapsulating the data packet in a multicast packet and adding a multicast address of the VPN to the multicast packet, when the destination address is not mapped to the second interface device. ### Claim 3 (depends on 1) The method of claim 1, wherein generating the encapsulated packet comprises: encapsulating the data packet in a unicast packet and adding a unicast address of the second interface device to the unicast packet, when the destination address is mapped to the second interface device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving the data packet from a source device over a broadband access link. ### Claim 5 (depends on 1) The method of claim 1, further comprising: transmitting the encapsulated packet to a multicast destination or an egress line interface. ### Claim 6 (depends on 1) The method of claim 1, wherein the VPN identification comprises a unique identification number assigned to the source device, and wherein the unique identification number marks the encapsulated packet as belonging to a VPN comprising the source device and the destination device. ### Claim 7 (depends on 1) The method of claim 1, wherein the VPN identification comprises at least four bytes or a VPN hop count. ### Claim 8 (depends on 1) The method of claim 1, further comprising: adding a destination option type to the encapsulated packet, wherein the destination option type includes a value indicating to discard the encapsulated packet based on whether an interface device recognizes the destination option type. ### Claim 9 (depends on 1) The method of claim 1, further comprising: associating the first interface device with at least one line interface, each line interface being associated with a source device. ### Claim 10 (depends on 1) The method of claim 1, further comprising: caching a mapping of the source device with a line interface. ### Claim 11 A first interface device of a virtual private network (VPN), the first interface device comprising one or more processors and configured to: determine a destination address of destination device, the destination address being within a data packet, the first interface device comprising one or more processors; determine whether the destination address is mapped to a second interface device of the VPN; generate an encapsulated packet by encapsulating the data packet and by adding an address to the encapsulated packet based on whether the destination address is mapped to the second interface device; and add a VPN identification to the encapsulated packet. ### Claim 12 (depends on 11) The first interface device of claim 11, wherein the first interface device generates the encapsulated packet by: encapsulating the data packet in a multicast packet and adding a multicast address of the VPN to the multicast packet, when the destination address is not mapped to the second interface device. ### Claim 13 (depends on 11) The first interface device of claim 11, wherein the first interface device generates the encapsulated packet by: encapsulating the data packet in a unicast packet and adding a unicast address of the second interface device to the unicast packet, when the destination address is mapped to the second interface device. ### Claim 14 (depends on 11) The first interface device of claim 11, wherein the first interface device is configured to: receive the data packet from a source device over a broadband access link. ### Claim 15 (depends on 11) The first interface device of claim 11, wherein the first interface device is configured to: transmit the encapsulated packet to a multicast destination or an egress line interface. ### Claim 16 (depends on 11) The first interface device of claim 11, wherein the VPN identification comprises a unique identification number assigned to the source device, and wherein the unique identification number marks the encapsulated packet as belonging to a VPN comprising the source device and the destination device. ### Claim 17 (depends on 11) The first interface device of claim 11, wherein the VPN identification comprises at least four bytes or a VPN hop count. ### Claim 18 (depends on 11) The first interface device of claim 11, wherein the first interface device is configured to: add a destination option type to the encapsulated packet, wherein the destination option type includes a value indicating to discard the encapsulated packet based on whether an interface device recognizes the destination option type. ### Claim 19 (depends on 11) The first interface device of claim 11, wherein the first interface device is configured to: associate the first interface device with at least one line interface, each line interface being associated with a source device. ### Claim 20 (depends on 11) The first interface device of claim 11, wherein the first interface device is configured to: cache a mapping of the source device with a line interface.