Virtual private networks and methods for their operation

A device providing communication between a first and a second Local Area Network (LAN), said first and second LANs in communication by a connectionless network, said device comprising:

• an input interface in communication with said first LAN;
• an output interface in communication with said connectionless network;
• a storage media storing data frames received from said first LAN received via said input interface, data packets and frames for transmission to said second LAN through said output interface;
• and
• a processor, said processor adapted to:
• receive conventional LAN data frames received from said first LAN through said input interface, said received data frames destined for said second LAN;
• determine, responsive to said received conventional LAN data frames, routing information for routing said received conventional LAN data frames to said second LAN, said routing information comprising an Internet Protocol (IP) address;
• encapsulate said received conventional LAN data frames with said routing information;
• transmit said encapsulated conventional LAN data frames to said connectionless network over said output interface;
• receive encapsulated conventional LAN data frames from said connectionless network from said output interface;
• generate conventional LAN data frames from said received encapsulated conventional LAN data frames;
• and
• transmit said generated conventional LAN data frames to said first LAN by said input interface.

A method of transmitting conventional Local Area Network (LAN) data frames from a first to a second LAN, said first and second LAN interconnected by a connectionless medium, said method comprising:

• receiving said conventional LAN data frames from said first LAN destined for said second LAN;
• determining, responsive to said received conventional LAN data frames, routing information for transmittal of said conventional LAN data frames to said second LAN;
• encapsulating said received conventional LAN data frames with said routing information;
• transmitting said encapsulated received conventional LAN data frames to said connectionless medium;
• receiving encapsulated conventional LAN data frames from said connectionless medium destined for said first LAN;
• generating conventional LAN data frames responsive to said received encapsulated conventional LAN data frames;
• and
• transmitting said generated conventional LAN data frames to said first LAN;
• wherein said determining routing information comprises:
• determining an identifier uniquely identifying a VPN comprising said first LAN and second LAN;
• determining from said received conventional LAN data frames the destination for said received conventional LAN data frames;
• and
• retrieving, from a database and responsive to said determined destination, an Internet Protocol (IP) address of an egress location forming part of said connectionless medium servicing said determined destination, if said database does not contain an entry for said determined destination, said retrieved address comprising an IP multicast address comprising egress locations servicing said VPN.

A method for facilitating communication in a virtual private network (VPN), said VPN comprising a plurality of local area networks (LANs) each interconnected through a network interface to a connectionless network, comprising, at a first network interface of a first LAN of said VPN:

• receiving conventional LAN data frames on said first LAN, said conventional LAN data frames having destination information;
• determining an identifier uniquely identifying said VPN;
• searching a routing table with said destination information and said identifier for a unique IP address of another network interface of another LAN of said VPN;
• if said routing table does not contain said unique address, retrieving a multicast IP address for all network interfaces of said plurality of LANs of said VPN;
• encapsulating said conventional LAN data frames with said identifier and one of said unique IP address and said multicast IP address;
• and
• transmitting said encapsulated frames on said connectionless network.

A first network interface for a first local area network (LAN) of a virtual private network (VPN), said VPN comprising a plurality of LANs each interconnected through a network interface to a connectionless network, comprising:

• means for receiving conventional LAN data frames on said first LAN, said conventional LAN data frames having destination information;
• means for determining an identifier uniquely identifying said VPN;
• means for searching a routing table with said destination information and said identifier for a unique address of another network interface of another LAN of said VPN, said unique address comprising an IP address of said another network interface;
• means for, if said routing table does not contain said unique address, retrieving a multicast address for all network interfaces of said plurality of LANs of said VPN, said multicast address for said all network interfaces comprising a multicast IP address;
• means for encapsulating said conventional LAN data frames with said identifier and one of said unique address and said multicast address;
• and
• means for transmitting said encapsulated frames on said connectionless network.

A Virtual Private Network (VPN) data signal embodied on a carrier wave, said VPN data signal generated from a received conventional LAN data frame, said conventional LAN data frame comprising a LAN destination address, a LAN source address, a LAN payload and a LAN error checking portion, said VPN data signal comprising:

• an egress destination address of an egress network interface, said egress network interface servicing an egress destination corresponding to said LAN destination address and wherein said egress destination address comprises an Internet Protocol (IP) address;
• an ingress source address of an ingress network interface, said ingress network interface servicing an ingress source corresponding to said LAN source address and wherein said ingress source address comprises an IP address;
• said LAN destination address;
• said LAN source address;
• said LAN payload;
• and
• an error checking portion generated from said egress destination address, said ingress source address, said LAN destination address;
• and said LAN source address and said LAN payload.

A system of providing communication between a first and a second Local Area Network (LAN), said first and second LANs interconnected by a connectionless network, said system comprising:

• a first network interface connecting said first LAN to said connectionless network, said first receiving device for:
• receiving conventional LAN data frames;
• determining an address of a second network interface responsive to destination information in said received conventional LAN data frames, said second network interface connecting said second LAN to said connectionless network;
• and
• encapsulating said conventional LAN data frames received at said first network interface with said address of said second network interface;
• a router for routing said conventional LAN data frames encapsulated with said address to said second network interface over said connectionless network;
• said second network interface connecting said second LAN to said connectionless network, said second network interface for:
• receiving conventional LAN data frames encapsulated with said address;
• re-generating said conventional LAN data frames from said conventional LAN data frames encapsulated with said address;
• and
• transmitting said re-generated conventional LAN data frames to said second LAN;
• and
• wherein said determining an address comprises:
• determining an identifier uniquely identifying a virtual private network (VPN) comprising at least said first and second LANs;
• accessing a routing table stored at said first network interface;
• where possible, retrieving, from said routing table a unique address of said second network interface responsive to a destination address stored in said received LAN data frames and said determined identifier, said unique address comprising an IP adderess;
• and
• if said routing table does not contain said unique address for said destination information, retrieving a multicast address, said multicast address representative of all LANs forming part of said VPN and comprises an IP multicast address;
• and
• wherein said encapsulating comprises encapsulating said conventional LAN data frames with said determined identifier and one of said unique address of said second network interface and said multicast address;
• and
• wherein said routing comprises:
• receiving said encapsulated conventional LAN data frames at a first Network Network Interface (NNI) of said router;
• modifying said encapsulated conventional LAN data frames to have a conventional LAN data frame header and LAN data frame payload, said modified encapsulated conventional LAN data frame recognizable by a conventional routing switch of said router;
• routing, by said routing switch, said modified encapsulated LAN data frame to a second NNI of said router;
• generating, at said second NNI, an encapsulated conventional LAN data frame from said modified encapsulated data LAN data frame;
• and
• transmitting said generated encapsulated conventional LAN data frame to said second network interface.