# US 8,543,734 B2 · System, method and apparatus that isolate virtual private network (VPN) and best effort traffic to resist denial of service attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,543,734 B2
- Document ID: US8543734B2
- Status: Granted
- Kind: B2
- Application number: 12/725,193
- Filed: 2010-03-16
- Published: 2010-07-08
- Granted: 2013-09-24
- Earliest claimed: 2001-03-20
- Assignees: Verizon Business Global LLC
- Applicants: David E. McDysan
- Inventors: David E. McDysan
- Web page: https://patentgrep.com/patent/US8543734B2

## CPC

- H04M 15/06: Recording class or number of calling {, i.e. A-party} or called party {, i.e. B-party}
- G06Q 20/102: {Bill distribution or payments}
- G06Q 30/04: Billing or invoicing
- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- H04L 12/14: Charging, metering or billing arrangements specially adapted for data communications, e.g. authentication, authorisation and accounting [AAA] framework
- H04L 12/1403: {Architecture for metering, charging or billing}
- H04L 12/1446: {inter-operator billing}
- H04L 47/125: by balancing the load, e.g. traffic engineering
- H04L 47/19: at layers above the network layer (network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60)
- H04L 47/2408: for supporting different services, e.g. a differentiated services [DiffServ] type of service
- H04L 47/2433: {Allocation of priorities to traffic types}
- H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ]
- H04L 61/00: Network arrangements, protocols or services for addressing or naming
- H04L 61/4523: using lightweight directory access protocol [LDAP]
- H04L 61/4535: using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
- H04L 61/4557: Directories for hybrid networks, e.g. including telephone numbers
- H04L 63/0272: {Virtual private networks}
- H04L 63/102: {Entity profiles}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1458: {Denial of Service}
- H04L 65/103: {in the network}
- H04L 65/104: {in the network}
- H04L 65/1043: Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
- H04L 65/1069: Session establishment or de-establishment
- H04L 65/1094: Inter-user-equipment sessions transfer or sharing
- H04L 65/1096: Supplementary features, e.g. call forwarding or call holding (systems providing special services or facilities to telephony subscribers H04M3/42)
- H04L 65/1104: Session initiation protocol [SIP]
- H04L 65/401: wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
- H04L 65/612: for unicast
- H04L 65/762: {at the source (reformatting of additional data in video distribution servers H04N21/2355)}
- H04L 67/06: specially adapted for file transfer, e.g. file transfer protocol [FTP]
- H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066)
- H04L 67/303: Terminal profiles
- H04L 67/306: User profiles
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services
- H04L 67/52: specially adapted for the location of the user terminal
- H04L 67/563: Data redirection of data network streams
- H04L 67/61: taking into account QoS or priority requirements
- H04L 69/329: in the application layer [OSI layer 7]
- H04M 3/2218: {Call detail recording}
- H04M 3/42229: {Personal communication services, i.e. services related to one subscriber independent of his terminal and/or location (diverting calls from one subscriber to another subscriber, i.e. two different subscriptions H04M3/54; selecting arrangements in intelligent networks H04Q3/005)}
- H04M 3/46: Arrangements for calling a number of substations in a predetermined sequence until an answer is obtained
- H04M 3/465: {Arrangements for simultaneously calling a number of substations until an answer is obtained}
- H04M 7/0075: {Details of addressing, directories or routing tables}
- H04M 7/0078: {Security; Fraud detection; Fraud prevention}
- H04M 7/1205: {where the types of switching equipement comprises PSTN/ISDN equipment and switching equipment of networks other than PSTN/ISDN, e.g. Internet Protocol networks}
- H04M 7/128: {Details of addressing, directories or routing tables}
- H04M 15/00: Arrangements for metering, time-control or time indication {; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP}
- H04M 15/41: {Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]}
- H04M 15/43: {Billing software details}
- H04M 15/44: {Augmented, consolidated or itemized billing statement or bill presentation}
- H04M 15/47: {Fraud detection or prevention means}
- H04M 15/49: {Connection to several service providers}
- H04M 15/51: {for resellers, retailers or service providers}
- H04M 15/52: {for operator independent billing system}
- H04M 15/53: {using mediation}
- H04M 15/55: {for hybrid networks}
- H04M 15/56: {for VoIP communications}
- H04M 15/58: {based on statistics of usage or network monitoring}
- H04M 15/63: {based on the content carried by the session initiation protocol [SIP] messages}
- H04M 15/745: {Customizing according to wishes of subscriber, e.g. friends or family}
- H04M 15/80: {Rating or billing plans; Tariff determination aspects}
- H04M 15/8207: {Time based data metric aspects, e.g. VoIP or circuit switched packet data}
- H04M 15/8214: {Data or packet based}
- H04M 15/8292: {Charging for signaling or unsuccessful connection}
- H04Q 3/0029: {Provisions for intelligent networking}
- H04W 4/02: Services making use of location information
- H04L 43/00: Arrangements for monitoring or testing data switching networks
- H04L 43/06: Generation of reports
- H04L 43/0817: by checking functioning
- H04L 43/16: Threshold monitoring
- H04M 7/006: {Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer (H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42)}
- H04M 2207/203: composed of PSTN and data network, e.g. the Internet
- H04M 2215/0104: Augmented, consolidated or itemised billing statement, e.g. additional billing information, bill presentation, layout, format, e-mail, fax, printout, itemised bill per service or per account, cumulative billing, consolidated billing
- H04M 2215/0108: Customization according to wishes of subscriber, e.g. customer preferences, friends and family, selecting services or billing options, Personal Communication Systems [PCS]
- H04M 2215/0148: Fraud detection or prevention means
- H04M 2215/0152: General billing plans, rate plans, e.g. charge rates, numbering plans, rate centers, customer accounts
- H04M 2215/0164: Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
- H04M 2215/0168: On line or real-time flexible customization or negotiation according to wishes of subscriber
- H04M 2215/0172: Mediation, i.e. device or program to reformat CDRS from one or more switches in order to adapt to one or more billing programs formats
- H04M 2215/0176: Billing arrangements using internet
- H04M 2215/0188: Network monitoring; statistics on usage on called/calling number
- H04M 2215/2013: Fixed data network, e.g. PDN, ATM, B-ISDN
- H04M 2215/202: VoIP; Packet switched telephony
- H04M 2215/2046: Hybrid network
- H04M 2215/22: Bandwidth or usage-sensitve billing
- H04M 2215/44: Charging/billing arrangements for connection made over different networks, e.g. wireless and PSTN, ISDN, etc.
- H04M 2215/46: Connection to several service providers
- H04M 2215/54: Resellers-retail or service providers billing, e.g. agreements with telephone service operator, activation, charging/recharging of accounts
- H04M 2215/7813: Time based data, e.g. VoIP or circuit switched packet data
- H04M 2215/782: Data or packet based
- H04W 4/029: Location-based management or tracking services
- H04W 4/20: Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04Q: SELECTING (switches, relays, selectors H01H; wireless communication networks H04W)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A network architecture in accordance with the present invention includes a communication network that supports one or more network-based Virtual Private Networks (VPNs). The communication network includes a plurality of boundary routers that are connected by access links to CPE edge routers belonging to the one or more VPNs. To prevent traffic from outside a customer's VPN (e.g., traffic from other VPNs or the Internet at large) from degrading the QoS provided to traffic from within the customer's VPN, the present invention gives precedence to intra-VPN traffic over extra-VPN traffic on each customer's access link through access link prioritization or access link capacity allocation, such that extra-VPN traffic cannot interfere with inter-VPN traffic. Granting precedence to intra-VPN traffic over extra-VPN traffic in this manner entails special configuration of network elements and protocols, including partitioning between intra-VPN and extra-VPN traffic on the physical access link using layer 2 multiplexing and the configuration of routing protocols to achieve logical traffic separation between intra-VPN traffic and extra-VPN traffic at the VPN boundary routers and CPE edge routers. By configuring the access networks, the VPN boundary routers and CPE edge routers, and the routing protocols of the edge and boundary routers in this manner, the high-level service of DoS attack prevention is achieved.

## Claims

### Claim 1

A method comprising:
establishing a virtual private network (VPN) that includes a first ingress boundary router and a first egress boundary router, the first egress boundary router being configured to communicate with a destination host, wherein the first ingress boundary router is configured to communicate with a second ingress boundary router of a public data network, and wherein the first egress boundary router is configured to communicate with a second egress boundary router of the public data network, the second egress boundary router being configured to communicate with the destination host;
transmitting only packets originating from sources within the VPN and targeting the destination host to the first egress boundary router via the VPN to prevent denial of service attacks originating from sources outside the VPN; and
transmitting packets originating from sources outside the VPN and targeting the destination host to the second egress boundary router via the public data network.

### Claim 2 (depends on 1)

A method according to claim 1, wherein the first egress boundary router and the second egress boundary router utilize separate logical connections over an egress access network to the destination host.

### Claim 3 (depends on 1)

A method according to claim 1, wherein the first ingress boundary router and the second ingress boundary router have connectivity to an ingress access network, the ingress access network transmitting packets having both source and destination addresses belonging to the VPN to the first ingress boundary router and transmitting other packets to the second ingress boundary router.

### Claim 4 (depends on 3)

A method according to claim 3, wherein the ingress access network has connectivity to a customer premise equipment (CPE) edge router that includes a classifier that classifies at least some packets for routing to one of the first ingress boundary router or the second ingress boundary router based on host service markings in the packets.

### Claim 5 (depends on 1)

A method according to claim 1, wherein the VPN is implemented within a Differentiated Services domain.

### Claim 6 (depends on 1)

A method according to claim 1, further comprising:
assigning a higher priority to traffic received from the first egress boundary router than traffic received from the second egress boundary router.

### Claim 7 (depends on 1)

A method according to claim 1, wherein the first egress boundary router is configured to shape traffic destined for the destination host to prevent starvation of traffic of the second egress boundary router.

### Claim 8 (depends on 1)

A method according to claim 1, wherein the first egress boundary router is configured to shape traffic destined for the destination host to a first rate, and the second egress boundary router is configured to shape traffic destined the destination host to a second rate, wherein the sum of the first rate and the second rate is no greater than a transmission capacity of an access link to the destination host.

### Claim 9 (depends on 1)

A method according to claim 1, wherein the first ingress boundary router includes:
first and second logical input interfaces for receiving traffic destined for the VPN and for the public data network, respectively;
first and second logical output interfaces for transmitting traffic over the VPN and the public data network, respectively; and
a forwarding function that switches packets received at the first logical input interface to the first logical output interface and that switches packets received at the second logical input interface to the second logical output interface.

### Claim 10 (depends on 1)

A method according to claim 1, wherein the first egress boundary router includes:
first and second logical input interfaces for receiving traffic from the VPN and from the public data network, respectively;
a first logical output interface and a second logical output interface respectively coupled to separate first and second logical connections on an egress access network, wherein the first logical output interface transmits traffic received from the VPN utilizing the first logical connection and the second logical output interface transmits traffic received from the public data network utilizing the second logical connection; and
a forwarding function that switches packets received at the second logical input interface to the second logical output interface.

### Claim 11 (depends on 10)

A method according to claim 10, wherein the first egress boundary router includes a scheduler, coupled to each of the first and second logical output interfaces, that transmits packets from the first and second logical output interfaces onto the egress access network, wherein the scheduler grants a higher priority to traffic from the first logical output interface than to traffic from the second logical output interface.

### Claim 12 (depends on 11)

A method according to claim 11, wherein the scheduler is configured to perform work-conserving scheduling on outgoing traffic from the first and second logical output interfaces.

### Claim 13 (depends on 10)

A method according to claim 10, wherein the VPN is one of a plurality of VPNs, and wherein the forwarding function has a corresponding plurality of VPN forwarding tables and a shared forwarding table for best effort traffic.

### Claim 14

A method comprising:
determining whether traffic received from a source is internal virtual private network (VPN) traffic or external virtual private network (VPN) traffic;
directing the traffic to a destination over a virtual private network (VPN) if the traffic is determined to be internal VPN traffic;
directing the traffic to the destination over a public data network if the traffic is determined to be external VPN traffic, wherein the internal VPN traffic is assigned a higher precedence than the external VPN traffic to prevent denial of service attacks;
forwarding the internal VPN traffic over a first logical connection to a first ingress boundary router within the VPN that includes a first egress boundary router having connectivity to the destination; and
forwarding the external VPN traffic over a second logical connection to a second ingress boundary router within the public data network that includes a second egress boundary router having connectivity to the destination.

### Claim 15 (depends on 14)

A method according to claim 14, wherein the first ingress boundary router and the second ingress boundary router have connectivity to an ingress access network, the ingress access network transmitting packets having both source and destination addresses belonging to the VPN to the first ingress boundary router and transmitting other packets to the second ingress boundary router.

### Claim 16 (depends on 14)

A method according to claim 14, further comprising:
classifying the traffic for routing to one of the first ingress boundary router or the second ingress boundary router based on host service markings in the traffic.

### Claim 17 (depends on 14)

A method according to claim 14, wherein the VPN is implemented within a Differentiated Services domain.

### Claim 18

An apparatus comprising:
a processor having a forwarding function configured to determine whether traffic received from a source is internal virtual private network (VPN) traffic or external virtual private network (VPN) traffic, the forwarding function being configured to direct the traffic to a destination over a virtual private network (VPN) if the traffic is determined to be internal VPN traffic, and the forwarding function being configured to direct the traffic to the destination over a public data network if the traffic is determined to be external VPN traffic,
wherein the internal VPN traffic is assigned a higher precedence than the external VPN traffic to prevent denial of service attacks, and
wherein the forwarding function is further configured to forward the internal VPN traffic over a first logical connection to a first ingress boundary router within the VPN that includes a first egress boundary router having connectivity to the destination, and to forward the external VPN traffic over a second logical connection to a second ingress boundary router within the public data network that includes a second egress boundary router having connectivity to the destination.

### Claim 19 (depends on 18)

An apparatus according to claim 18, wherein the first ingress boundary router and the second ingress boundary router have connectivity to an ingress access network, the ingress access network transmitting packets having both source and destination addresses belonging to the VPN to the first ingress boundary router and transmitting other packets to the second ingress boundary router.

### Claim 20 (depends on 18)

An apparatus according to claim 18, further comprising:
a classifier configured to classify the traffic for routing to one of the first ingress boundary router or the second ingress boundary router based on host service markings in the traffic.

### Claim 21 (depends on 18)

An apparatus according to claim 18, wherein the VPN is implemented within a Differentiated Services domain.