CA2237659C - Frame relay switched data service - Google Patents

Abstract

A new type of data transport service which uses a frame relay layer 2 data link connection identifier (DLCI) to select among various service types, feature sets, and/or closed user groups (CUGs) . A layer 3 address may be extracted from a layer 2 frame, and the layer 3 address information may be used to route a data packet over a packet-switched network according to the service classes, feature sets, and/or CUGs selected. At the destination, the layer 3 data packet may again be enclosed in a layer 2 frame with a DLCI indicating the service classes, features sets, and/or CUGs. Because the use of conventional permanent virtual circuits (PVCs) is not required in aspects of the invention, new methods of measuring and managing network traffic are presented.

Description

s CA 02237659 1998-OS-14 FRAME RELAX' SWITCHED DATA SERVICE
1. Tec6nieal Field The: present imrartion is directed to systems sad methods for implementing improved network architectures, and more spea6ca11y to systems and methods for routing internex 1 ~~ protocol (1p) packata using modified 8rame relay protocols.

2. Deseription of the Related Arts Itaxn<ly, the populnity of large "meshed" has been icxxessing. However, large-scale highiy~ meshed networks can be difficult to implement, maintain, and mana8e using comr~ntionat network technologies.
2o An example of a conventional mesh configuration is shown in Fig. 1. A wide-area network (WAI~~ 900 includes a plurality of routers RN R~, R~, Rc, (customer premises equipment (CPE;)) respectively disposed at a plurality of end user locations A, B, C, and D and interconnected to a service provider's network (SPIN 901 via respective user-network interfaces (UM)~ 920.1, -2, ..., -n. The user-network interfaces 920 may be variously configured to be, for examFde, an asynchronous transfer mode (AT11~ switch having a frame relay interface to CPE. Connecting the sites together are logical paths called, for example, permanent virtual Grants (PVCs) P",~ P,,,~ Ps,a, P,,,.~ Pte, that aro characterized by their endpoints at the UrlIs - :' 920-1, 920.2, ..., 920-n and a guaranteed bandwidth called the committed information rate (C~), to Fig. 2 prawides a detailed view of the flow of data acrou the WAN 900.
There exists a plurality of layers of protocol over which communications may occur. For example, the well-larovm layers of the International Standards Organization's (ISO) Open Systems Interconnect Model fiaving layers from a physical layer (layer 1), a datalink layer (lays 2), a network layer (layer 4~ up through and including an application lays (layer '~. Under this model, user data t5 90Z is generated by a user spp4cation nrnning at the application lsya 903.
At the transport layer (layer 4) 904,.s source and destiinstion port address 906 (ss part of the TCP header (layer 4)) may be added to the use data 902. At the navvork layer (layer 3) 905, an additional header ~.e., an IP head~a (layer 3)) containing source and destination IP addresses) 908 may be added.
Thus, the layer :3 use data Held includes the lays 4 user dsts 902 plus the layer 4 header 906.
2o The layer 3 protocol data unit (PDU) 902, 906, 908, which makes up, for example, an IP packet 950, is then pasxd down to layer 2 909 in the CPE (routera R~, Ra, RG I~) that interfaces to the SPN 901. Jfn the router, a table maips one or more IP addresses (layer 3) 908 to an appropriate PVC or PVCs (P~~, P,,.~, Ps-ch P~.e~ pc.a)~ The router table is maintained by the customer. Once. the correct PVC is located in the routing table, the corresponding data link connection identifies (DLCI) (layer 2) 912 is coded into the header of the frame relay frame 914 (packet). 'Thaeafta, the ranainder of the frame relay frame is included and a frame check sum (FCS) is computed. 'The frame is that passed down to the physical layer and transmitted to the - _ SPN 901.
At the UNI 920, the frame is checked for validity to determine if there is a predefined PVC associated, with the DLCI 912. If so, the frame 914 is that forwarded on that PVC
to through tlx netv~rork along the same path and in the same order as other frames with that DLCI, as depicted in Fig. 2. The lsya 2 Same information remains as the packet traverses the frame ray n~v~o~ whether this network is acxually implemaited as a ~e day network or other network such as an ATM netarork. 'The frame is csrtied to its destination without any further routing deasions being made in the networfc. The FCS is checked at the egress UHI, and if the t s flame is not corrupted, it is then output to the Urll saso«ated with the end user.
As is well lQawa in the art, Figs. 1-3 provide exemplary diagrams of how the frame relay dots packets are assembled at the various ISO layers using the example of TCPIIP
protocol transport over a frame relay data link layer. The example shows how the user data at the appGcstion layer is 'wrapped" ~ ~g ~velopes, making up the PDUs, as it passes 2o down the prota~col stack Spedfically, the comQOx~ of ~° find is expanded for detail and is shown in Fg. 5. The data link connxtion iderrtiSa (DLCn ~Id comprises 10 bits spread over the first and second octet, and allows for 1023 possible addresses, of which some are reserved for specific uses by the standards. As shown in Fig. 3, the DLCI is added to the frame relay header according to what destination IP address is specified in the IP
packet. This decision about what DLCI is chosen is made by the CPE , usually a roofer, based on configuration s information provided by the customer that provides a mapping of IP addresses into the PVCs that connect the current location with others across the WAN 900.
In conventional ffarru relay, a layer 2 Q.922 fame cartid the layer 3 customer data packet across the network in a permanent virtual circuit (PVC) which is identified by a data link connection identifier (DLCn. Thus, the DLCIs are used by the ws<oma as addresses that lo select the proper PVC to arry the dsta to the desired dastinstion. The arstomer data packet is carried across the network transparently and its contents is never examined by the network The comrentional meshed >&aare relay network discussed above has a number of limitations. For example, every time a new end user location is added to the meshed network, a new connection is required to be added to every other end user location Consequently, all t s of the routing tables moat be updated at every end uses location Thus, a "ripple" effect propagates aa~ the entire network whenever there is a change in the network topology. For large networks with thoussnds of ayd uses locations, this ripple effect cxeates a large burden on both tha network provider to supply enough permanent virtual circuits (PVCs) and on the network customers in updating all of their routing tables. Further, most roofers are limited to 2o peering with a maximum of 10 other roofers which makes this network topology difficult to implariart. As networks grow in size, the rnm>ber of PVCs carstomers need to manage and map S
to DLCIs increases. Further complicating the problem is a trend toward increasing ~'meshedness" of networks, meaning more sites are directly connected to each other. The result is a growth in the number and mesh of PVCs in networks that does not scale well with current network technologies.
s A possible solution for handling large meshed networks is to use a virtual private network (VPN) which iinterconnecta aid user locations using encrypted traffic sent via "tunneling" over the Internet. However, VPNs are not widely supported by intarnet service providers (ISPs), have erratic information rates, and present a of seauit~r coctcerns.
Another possible sohition is the ux of frame relay based switched virtual circuits (SVCs).
to While PVCs (disa~ssed above) are usus>?y defined on a subscription basis and are analogous to leased lines, SVCs are tmtporary, defined on an as-needed basis, and are analogous to telephone calls. However, SVCs require continuous communications between all routers in the system to coordinate the SVCs. Further, bxauae the tables mapping IP addresses to SVC
addresses are typically cnarxrauy mainnined, SVCs are oRea imprscdal For large highly-meshed networks.
is Seauity is s mejvx concern for SVC networks where tables aro mismanaged or the network is spoofed. Further, flame SVCs are di~cult to interwork with asynchronous transfer mode (A'T>~ SVCs.
None of the above solutions adequately address the growing danand for large mesh networks. Acoordingiy, thane is s need for network architectures which arable implementation ' 20 of large mesh networks having saarrity, low maintenance costs, ei$cient opa~ations, and scalability.

?aspects; of the present invention solve one or more of the above-stated problems and/or provide improved systems and methods for implementing a network architecture.
s A new 'type of data transport service takes advantage of the existing base of frame relay customer premixs equipment (CPE) and customers while offtring a new mechanism for providing extensible service features to those customers. In the new service, data link -connection identifiers (DLCIs) may be uxd by the CPE to select among service types, feature sets, and clo;Kd user groups (CUGs). The DLCI is used in the lays 2 flame that comnys the t o user data to dhe network The layer 3 user data packet is extracted from the layer 2 frame and the layer 3 address information for the (mutable) protocol is used to route the user data packet ova a high-performance packet sw'ttched network, according to the servict class / feature set relaxed by the DLCI. At tl~ d~~nstion, the lays 3 data packet is again enclosed in a layer 2 frame with a DLCI that indicates to which servica group it belongs- 'The flame is then 15 forwarded to the CPE. Ux of this technique will allow the e~cating frame relay CPE to support, over the same physical interface, conventional frame relay service with a range of DLCIs that ~ ~ ~ lp~ ~h as permanent virtual circuit (PVCs), as well as a range of DLCIs that are linked to service andlor feature sets. This will allow a robust method for extension of new services to the &an~ relay installed base, with minimal impact to existing customer 2o equipment.
In some aspects of the invention, frame relay DLCIs are used for xlecting among various ''service categories." This differs significantly from conventional frame relay, which uses DLCIs only to select PVCs and/or switched virtual circuits (SVCs). Service categories may include, but are not lirroted to, communication via the public Internet, communication via a local intranet, communication within a closed user group (CUG), communication with an extranet (e.g., a network of trusted suppliers or corporate trading partners), live audio/video transmission, multicasting, telephony over Internet protocol (1P), or any combination thereof. Thus, the concept of a flame relay PVC is sign~ndy expanded by aspects of the present invention. For example, the !location of an intended network endpoint recipient is not necessarily determined by a DLCI at a sending network endpoint The DLCI may represent a service category with the io intended recipient indicated by an IP addreu within the frame relay packet.
This results in a signiscant benefit to network customers becausa unlike that of comrentional frame relay, customers no longs need to update their local DLCI tables each time a networfc customer with whom they wish to com<nunicste is added or removed 8rom the network. Thus, the customer's burden of ne~:work administration is substantially reduced.
t 5 In sub~~aspecta of the imrention, some DLCIs may be used to select among service categories ("servicx cat~Oty DLCIs") while in the same network other DLCIs may be used to select coma~tional PVCs and/or SVCs ("conventional DLCIs"). In other words, conventional frame relay may be mixed with aspects of the present imrention within the same network, allowing aspects of the present invention to be incrementally implemented in existing 2o conventional, frame relay networks.
In furttia aspects of the invattion, add~s~ng contained in multiple layers (e.
g., as defined by the Open System Interconnection model) are compared with each other in a network to determine routing errors. If the addressing in the layers are consistent with each other, then the associated data is routed without interruption. On the other hand, if the addressing in the layers is inconsistent with each other, the associated data may be specially handled.
For example, the data may be discarded, sent to a pre-determined address, and/or returned to the sender. This address comparison may be applied to the sending address and/or the destination address. An advantage of this multiple layer address comparison is that network security is increased. Fror instat~a, problems such as "spoosng" which is the practice of purposely Providing an incorrect sending inte~net protocol (IP) address., are better controlled by spch a method.
t o In still firrther aspects of the imrention, routing look-up table within the network are separated such that, for example, each customs, closed use group (CUG), extranet, and/or intrarxt may have its own private partition and/or separate table. This can provide greater network spa~d because a routs need not scan the entire available address space for all network customers at once FuN~a~more, data secxrrity is improved because the risk of sending data to t 5 a wrong recipient is reduced.
In yet fiu~h~ aspects of the imrention, layer 3 and/or layer 4 IP address information is utilized to ra~ute the fast packets through the network.
In evau fiuther aspects of the invention, new nttwork traffic management techniques and measurarterrts are defined. For example, in some traffic-management aspects of the invention, 2o committed dedivay rates (CDRs) may be assigned to one or more IJNIs. A CDR
is the average minimum data rate that is guaranteed to be delivered to a given tJl~ll when suffcient traffic is being sent to the UNI. In further traffic-management aspects of the invention, a destination rate share (DRS) is assigned to one or more UNIs. The DRS may be used to determine the share of traffic that a given UNI may send through the network. If several UNIs are simultaneously offering to send traffic to the same destination UNI, then each sending UNI's share of the network may be determined by its own DRS and the DRSs of the other sending UNIs.
In accordance with one aspect of the present invention there is provided a method comprising the steps of: receiving into a fast packet network frame relay data packets, said frame relay data packets having user data in a user data field; switching said frame relay data packets within the fast packet network responsive to the user data, wherein the user data includes an Internet protocol packet; generating a fast packet address field responsive to Internet protocol packet data; and routing the Internet protocol packet through the fast packet network responsive to the fast packet address field.
These and other features of the invention will be apparent upon consideration of the following detailed description of preferred embodiments. Although the invention has been defined using the appended claims, these claims are exemplary in that the invention is intended to include the elements and steps described herein in any combination or subcombination. Accordingly, there are any number of alternative combinations for defining the invention, which incorporate one or more elements from the specification, including the description, claims, and drawings, in various combinations or subcombinations.
It will be apparent to those skilled in network theory and design, in light of the present specification, that alternate combinations of aspects of the invention, either alone or in combination with one or more elements or steps defined herein, may be utilized as modifications or alterations of the invention or as part of the invention. It is intended that the written description of the invention contained herein covers all such modifications and alterations.

9a BRIEF DESCRIPTION OF THE DRAWINGS
The foregoing summary of the invention, as well as the following detailed description of preferred embodiments, is better understood when read in conjunction with the accompanying drawings. For the purpose of illustration, embodiments showing one or more aspects of the invention are shown in the drawings. These exemplary embodiments, however, are not intended to limit the invention solely thereto.
Fig. 1 illustrates a wide area network (WAN) having routers as CPEs and PVCs between s customer locations.
Fig. 2 shows data flow through the WAN shown in Fig. 1.
Figs. 3-5~ show the construction and How of data packets through the network -_ Fig 6 sts~wa a block diagram of a e~etwork architecture in sccordance with aspects of the present invention.
o Fig. 7 shows a detailed block diagram of the network illustrated in Fig. 6.
Fig. 8A~8H shows a migration path for incorporating aspects of the invention into conventional network architectures.
Fig. 9 shows data How through the network architecture of Fig. 6.
Fig. 10 elbows appl~n based prioritization through the network architecture of Fig. 6.
t 5 Fig. 11 ithlstrata m vcanplary aribodimatt of a means to apportion services through the network of Fil~ 6.
Figs, 12-14 illustrae data How through exemplary WANs 1.
2o Exemplavry embodiments of the present im~ention allow the large installed base of frame relay customer premises equipment (CPE) to be maintained by using the same interface in a di$'erent way to deliver new sets of services and features to the customer.
For example, the data pink connection identifier (DLCI) known from the frame relay protocol may be used to select among several virtual private networks with di$'ering address spaces, feature sets, andlor conventional permanent virtual circuits (PVCs).
s Referrin~3 to Fig. 7, a block diagram of a wide arcs network (WAIF 1 incorporating aspects of the p~resern imar<ion is shown. The WAN 1 includes a plurality of customer premise equipment (CPE) system, for example roofers located at each of the end user locations and interconnected via one or more service provider's networks (SPNs) 500. The SPN
500 is typically connected to a plurality of endpoint roofers 919 via a pof corresponding user to network interfaces (L7NIs) 402 and/or one or moro Internet protocol (IP) switcha 502. The IP
switches 502, LJNIs 402, and/or routerslswitches 501 may be interconnected so as to form a meshed network (e.g, a partial or Rrlly network). Additionally, the wide area network (WAN) 1 may contain any number of 1P switches 502 located within the WAN 1 such that it is not connected directly to any endpoint roofers 919, and/or one or more IP
switches 502 may t 5 be located at an interface between the SPN 500 and an endpoint roofer 919.
In further embodiments of the imrention, there may be multiple endpoint roofers 919 associated with a L)NI 402JIP switch 502 and/or multiple UMs 4021>P switches 502 associated with an endpoint roofer 919.
The netwbrk architecture of the WAN 1 allows the of 1P switches to increase as 2o a~stomera are tzansitioned to the new service. For example, as shown in Fig. 8A, initially there may be only a small number (e.g., one, two, three, etc.) of 1P switches installed in the system.

Where only a small number of IP switches are included in the network, traffc originating from non-IP enable:i UMs 402 (e.g., UM A) may be routed to an IP switch 502 elsewhere in the network Although this creates some negligible inefficiencies in "backtracking"
it nonetheless allows a migration path to the new network architecture without simultaneously replacing all routers 501. However, as more and more users are transitioned to the new network architecture of WAN 1, mom and more IP switches can be added (Fig. 8B) to accommodate the increased load. In many embodiments, it may be desirable to eventually comrert each L>NI
402 to as IP- -switch 502 such that IP routing may be accomplished at the edge of the network.
In some Wodiments, the WAN 1 may include a combination of comrentional networfc to svvitches and/or raitas 501 in addition to IP switches 502. On the other hand, every switch in the SP'N 500 may be an IP switch 502. Alta~atively, the WAN 1 may contain only a single IP
switch 502. T'h~e 1P switches SOZ may be vuiously configured to inchide a suitable mufti-layer routing switch such as a Tag Switch from Cisco. Mufti Layer routing switches may also be utilized from vendors srxh as I~lo~ Toslu'b~ IBM, andlor Telecow. ~ switches are aurently ~ s being devdopai to r~lsoe endpoirnt rarta~s so that a~stomer premise equipment (e.g., Ethernet local area network (L,AN) equipment) can connect directly to as asynchronous transfer mode (ATM) network. Aspects of the present invention propose using IP switches in a different maruxr to maintain the huge installed base of customer premise equipment while avoiding the lin>ttationa of pf~evbus systans, Accordingly, the IP switches in accordance with embodiments 20 of the imraition are disposed within the SPN 500 and modified to provide suitable routing and interface functions.

In some embodiments of the invention, an IP switch 502 acts as a mufti-layer switch. For example, an )~~ switch 502 may receive ATM cells, switching some or all of the ATM cells based upon the content of 1P packets encapsulated within the ATM cells. Thus, IP addressing may be used by an 1P switch 502 to determine an ATM virtual path for sending ATM cells to s a destination UM 402. In further embodiments of the invention, higher layer addressing (e.g., transmission ca~ntrol program (TCP) logical ports at layer 4) may also be used by an IP switch SOZ as a basis for switching ATM cells to provide a path through the SPN s00.
In still further _ embodiments of the imrention, an IP switch s02 uses IP addresser and/or TCP
logical ports to make quality a~f service (QOS) decisions.
to In find anbodiments ofthe imrention, an endpoint roofer 919 may encapsulate one or more 1P packets in frame relay frame 914. In thin event, the frame retsy frames may be transmitted between an atdpoin routs 919 and a cocr~ponding U1VI 402 and/or IP
switch s02.
The endpoint routar 919 anapIp pacloen 950 with frame relay llama 914.
Further, the adpoiat routar 919 may set the DLCI of each frame relay frame 914 according to a particular t s service category ('~f a seavica category DLGI is used) that the user has selected. For example, the various sexvice categories may include the public Internet, communication via a local intranet, communication within a closed user group (CUG), communication with an extrantt (e.g., a network of muted suppliers or corporate trading partners), live audio/video transmission, multicasting, telephony over Internet protocol (IP), or amr combination thereof.
2o Thus, the concept of a frame relay PVC is significantly expanded by aspects of the present invanioa For example, the location of an inta~ded network endpoint recipient is not necessarily determined by a DLCI at the endpoint roofers 919.
In fiuthtr embodiments of the invention, a LJNI 402 may receive frame relay frames 914 fiom an tndpoint roofer 919 and divides and encapsulates frame relay frames into, for example, smaller fixed-iex~gth ATM calls. The tJNI: 402 may further translates the frame relay DLCI into s an ATM address (e.g., a virtual path identifier / virtual channel identifier (VPI/VCI)). There are various methods which may be used to translate DLCIs to VPI/VCIs. For example, the Network Intmvorbng Standard as defined in Implanartation Agreanent #5 of the Frame Relay Forum, and/or the Service Literworking Standard as dt6ned in Implementation Agreement #8 of the Frame Relay Forum may be utli~edl. An ATM tddras ssaooiated with a service category DLCIs deb an ATM virtual path via network roofers to an iP switch 502. Thus, ATM data associated with s service r DLCI is ultimately sart to an Ip switch 542.
However, ATM
data assodated with a conventional DLCI may or may not be sent to an IP switch 502 and may be routed thravgh the netv~ork without palsaing an Ip switch 502. Thus, both translated IP data and comreationai PVC data may be present in the SPN 500 and/or WAN 1.
t s In furtha~ anbodimarts of the invattion, s LJNI 40Z and/or a n~ork muter 501 may send data to a predWermiixd IP switch SOZ. In even Rutha~ embodiments of the invention, a LJNI
40Z and/or a network muter 501 selects which IP switch 502 to send data to based upon an algorithm (e.g., based on network traffic flows, the relative distancellocation of an IP switch 502, the type of data being sent, and/or the service category selected). In still fiuther 2o embodiments o~f the imrartion, s LJNI 402, network routs 501, and/or IP
switch 502 may send the same data to more than one LJNI 402, network routs 501, and/or IP switch 502, depending upon, for example, a service category or' categories.
In further embodiments of the invention, a UM 402, an IP switch 502, and/or a network router 501 compares an ATM VP1/VCI 303-305 address with an IP address for the same data.
If the two addresses are inconsistent, then the ATM cell may be discarded, sent to a pre-5 determined address, and/or returned to the sending location. In even further embodiments of the invention, layers above the layer 3 IP layer may be' used for address and/or service class generationldis~rtimination. For example layer 4 of the ISO addressing scheme and/or other _ application level data may be utilized to determine particular service classes.
Rafaring speafi~lly to fig. 9, the path of user data ~owingfhrough an exemplary WAN
t o 1 is shown. As in the frame relay cax, uses data at the application layer and lsyec 4 requires the addition of a layer 3 network address header. In the CPE s decision is made based on information iu lsya's 3 and 4 about which virtual private network ('VPN), service class, or conventional PVC the packet should be routed to. Thus, a packet with layer 4 information indicating it i's a telnet ('uaaactive) application and layer 3 information that it is an internal t s company addrexa might p to VPN A for a low-delay intratret class of service. Another packet that is part of a. file tranafa protocol (FTP') Sle might go to VPN B with a lower service class, and s third packet going between two heavily utilized applications might go on a dedicated PVC: D. These decisions are coded as different DLCI values, inserted in the layer 2 frame, and seat into the UrII.
2o At the iJNI A 402, the switching based on the DLCI takes place. The packet may be routed to IP ;switch 502 in the center of the SPN 500. The first packet has its layer 2 frame stripped off as it is forwarded to VPN A. Within VPN A, the layer 3 address is now used to make routing decisions that send the packet to its destination L1NI. Thus, no PVC need be established ahead of time for that path, and conventional routing methods and protocols can be used, as well ~~s newer "short-cut" routing techniques. This permits VPN A to provide a high "mesh" of coruiectivity between sites without requiring the customer to configure and maintain the "mesh" as a large number of PVCs.. The packet forwarded to VPN B is treated similarly except that VPN B is implemented with a lower service class (e.g. higher delay). Finally, the-packet forwarded to PVC D has its layer 2 flame intact and passes through the network as a comrattional frame relay frame. This allows customers to maintain their current connectivity of to PVCs for their high utiliution tragic psths, but still have a high mesh of connectivit~r through various VPNs.
Thus, in various aspaxs of the imra~tion, the WAN 1 and/or SPN 500 may be any suitable fait packet network recdving flame relay data padoets having user data in a user dots field. The WAN 1 and/rnr SPN 500 tl~a switches packets using one or more IP switches 502 responsive t s to the user d:~ts. The user dats may be used to disaiminate between a plurality of different service categoric based on the user data. Routing ova the WAN 1 and/or SPN 500 may be responsive to at least one of the different service categories including discriminating based on multicast data. Additionally, the WAN may generate a fast packet address field responsive to the 1P packet data and route the IP packet through the fast packet network responsive to the -2o fast packet address field. Further, layer 4 information may be utilized to determine the quality of service. T'he quality of service may include, for example, one or more of the following: an information rate, priority information, delay, loss, availability, etc.
Security features may be implemented in the IP switch such that routing tables for each of the users are separated based on one or more service categories and/or users. In this manner the system is made more secure.
Still further, the system may receive a plurality of frame relay packets over a permanent virtual s circuit (PVC) at a first node in an asynchronous transfer mode (ATM) network, generate an ATM address based on a data field other than a data link connection identifier (DLCn within the fi~ame relay packets, and then route the packets through the ATM network based on the ATM address. The routing of packets may be responsive to one of a plurality of service categories. The sysran may provide separate routing tables within as ATM
switch for each of to a plurality of different service categories. The different service categories may be determined using inturtet protocol (Ip) dsts within a data field of a packet pssaed by the ATM switch. In a fast packu rxtvvork, a feat pac3cat switch may c~pare an addraa of a fast packet with a layer 3 Internet protocol (1P) address contained within the fast packet and determining whether the fast packet address is consistent with the layer 3 IP address. Further, for security, hardware t s ciraiits and/or sofrwa~e may be proviided for examination of a sending address or a destination address. Further, pxkas may be discarded responsive to an inconsistency being detected. The WAN 1 may include customer premises equipment (CPE) and an asynchronous transfer mode (ATM) switch coupled to and receiving from the CPE frame relay data packets, and including address tranaJation drautry for translating data link connection identifiers from the frame relay zo data packets iinto ATM addresses representing a plurality of virtual private networks based on a predetermined service category assoaated with a particular DLCI; or the WAN
1 may include customer prennises equipment (CPE) and a fast packet switch coupled to the CPE
via one or more permanent virtual circuits and receiving frame relay data packets, the fast packet switch including address translation circuitry for translating user data within the frame relay data packets into fast packet addresses.
In embodiments of the present invention, data security is enhanced in that data may be easily and accurately checked for inconsistencies at the destination This is because these embodimarts operate using both layer Z and layer 3 addraairrg information. As an illustration, assume that a ;frame relay frame having a DLCI indicating VPN 1 (e. g., the corporate intranet) arrives in a network switcwrouter with an Ip address of a particular corporate accounting to systarr. Hov~e;va, since the VPN proassa has avadaable to it the DLCI of the packet (and thus information about the soma of the pack~et~, the VPN processor may aoss-check the DLCI with the source IP address in the packet to see if the sourcx IP address is in the range known ITOm the otiglnabng sits Thus, the problem a~aodated with the spoofing of IP source addresses may be significantly reduced.
1 s In still f'.irrtha eaabodirrrertts of tlr~ invention, s LTrII 402, an IP
switch sOZ, and/or a network routar 501 has seprnate and/or partitioned routing look-up tsbla.
Routing tables may be separated based upon service category, customer or user, and/or UNI 402.
Thus, in some embodia~art~ within a VP'N, a customer or usa may have an individual routing table containing the customer"s IP network address information. In some embodiments, since the DLCI
2o identifies the lwurce of a frame, the DLCI may be used as an indac by an IP
switch, network routs, and/or LJrII for determining which routing table to ux. This allows customers to have their routing; table size and speed governed by their individual address space, thus speeding the routing process considerably. The use of separate routing tables also provides an added measure of security, as packets cannot be mis-routed due to errors or updates in routing information related to other customers.
In some embodiments, a router has multiple data space images paired with a single instruction space image of the routing software. Thus, for example, as packets arrive from Customer ~~, the routing software uses the data image for a routing table associated witt>r Customer A to make a routing decision. In further embodiments, a single soRware image is used, but additional indicxa corresponding to customers are added-to tlu3 routing tables. In stilt t o t~rther embodiments, instruction execution and data handling aro processed separately. This may be accomplished by the use of separate processors, one for instruction acecution and one for data handling.
Fg. la an exanQlary WAN 1 having both comrentionsl routers and IP switches incorporating aspens of the invention. In this exemplary WAN 1, a routing element 1004 and switch 1003 are connected to Customs Site A vis frnme relay switch 1001.
Routing element 1007 and sv~ritch 1006 are connected to Customer Site B via 8rame relay switch 1009. Routing dernau 1012 aid switch 1014 are connected to Customer Site C via frame relay switch 1016.
Routing danast 1413 and switch 101 ~ are connected to Customs Site D vis frame relay switch 1017. In thin exanplary WAN 1, incoming frames 1000 from Customer Site A may be encoded 2o with a layer 2 DLCI sQedfying VPN #1 as the lays 2 destination and a layer 3 address pointing to Customav Site B. In such a case, frame relay switch 1001 switches the frames over a frame relay trunk 1002 to switch 1003 which has layer 3 routing element 1004 associated with it.
:after the frame is received by switch 1003, the frame is forwarded to router 1004 which implements shoe-cut routing as described above. The router/switch 1003, 1004 uses the layer 2 information to~ discriminate between different source customers. The layer 2 information may s then be discarded. Next, the layer 3 information in combination with a routing table is used to make a routing ~daasion. In this case, the routing derision would result in a layer 3 PDU 1011 being forwarded to routerlswitch 1006, 1007. The layar 3 PDU 1011 is then encapsulated with a layer 2 frame, the frame in this case being addraaed to Customer Site B.
Switch 1006 then forwards the frame via a trunk 1008 to frame relay switch 1009: At the egress port of fume to relay switch 10(19, the DLCI of frame relay frame 1010 is replaced with a value indicating that the flame originated from, in this case, VPN #1. The frame relay frame 1010 is then delivered to the Customex B routs.
As the service grows the functionality for making the VPN routing decisions may be migrated closer to the arstomer and may eve~ualIy be present in every switching node, as t 5 shown in Wig. 13. This can reduce the backhaul prtviously needed to get to the router/switch processing nodes and allow for optimal routing using all the nods in the WAN 1 andlor SPN
SCb. In the ex~nnplary embodiment ofFig. 13, VPN #1 is connected to Customer Sites A, B, C, and D. Flare, every switching node includes a switch 1501 and a routing element 1502.
frame relay frames 1500 having a DLCI directed to Customer Site B may be sent from 2o Customer Site A. In such a case, frames 1503 would be sent through VPN #1 via switching nodes 1501, 1'.102, and frames 1504 would be received at Customer Site B.

In some embodiments, an AT~i core network may be used for data transport, and frame relay interface;; may be used to interface with the customer. An exemplary embodiment using an A'Tyf core .network is shown in Fig. 'l4. In this embodiment, switch 2003 and router 2004 are connectecl to Customer Site A via switch 2000 and a frame relay/ATM
conversion unit 2001. Switch 2019 and router 2018 are connected to Customer Site B via switch 2005 and frame relay/ATM conversion unit 2006. Switch 2012 and router 2010 are connected to Customs Site C via switch 2015 and fiamc rdaylATM comasion unit 2014. Switch 2013 and router 2011 are connected to Customer Site D via switch 2016 and frame relay/ATM
conversion unit 2017 Assuming that Customer Site A is sending frames 2020 destined for t o Customs Site B, incoming layer 2 frames may be encapsulated for transport into ATM cells at switch 2000 according to, for example, the Network Interworking Standard. Such encapsulation may, foc example, occur in conversion unit 2001, external to ATM
switch 2000.
ATM cells 2002 may be sent down an ATM PVC designated for VPN #1 processing.
ATM
cells 2002 may then be forwarded to switch 2003 and router/switch 2004 (which may be t 5 attaalted to saritch 2003), whore the ATM cells may be reassembled to obtain the layer 3 packet information for r~put>ng within VPN # 1. Once the address infonnstion has been extracted from the layer 3 packet, the packet may be segmented again into ATM cells 2009 that can be transferred though the network After being sent though router/switch 2018, 2019, ATM cells 2008 may be. comrerted from cells to frames at the external conversion unit 2006 and switch ' 20 2005. Customer Site B would then receive frama relay frames 2021. Thus, an extra segrcxntation and reassanbly (SAR) cycle may be required when using an ATM
backbone with ?~
a core of rout~~_r/switches. However, if the VPN processing is pushed outward to edge switches, the extra SA.R cycle may be eliminated. The extra SAR cycle may be eliminated because conversion from frame relay frames to ATM cells may take place in the same unit where VPN
routing decisions are made.
s Traffic management may be variously configured in the WAN 1 and/or the SPN
500.
For example, from a customer's viewpoint, the WAN 1 and/or SPN 500 may ensure certain tragic rates for the customer.
In a network, data tragic may be sent from multiple sources to a single destination .
(multi-point to point). A "soured' is de6ibd as the usa transrritting side oil for example, a IJNI
to ~.e., the custa~mc side of a tJN>~ whic'- -w be external to a WAN and/or to a VP'N), a switch, an IP svhtch, and/or a roofer at or near u.e edge of a network. A
"destination" is defined as the user receiving side o~ for example, a LTrII ('~.e., the network side of a LTI!11), a switch, an IP
switch, andlrn~ routs at or near the edge of a network Tragic that is offered for transmission by a source to~ the WAN 1 andla SPN 500 is defined as the "offered traffc."
Further, a "VPN
t 5 source" and a "VPN destination" aro a source and destination, respectively, which belong to a given VPN. A given UNI, if simultaneously sending and receiving, may simultaneously be a source and a destination. Furthermore, a given source may offer data traff c to multiple destinations, and a given destination may receive traffic from multiple sources.
In some embodiments of the invention, a committed delivery rate (CDR) may be 2o assigned to each dG~ination. The CDR is defined as the average rnimber of bits per second that the WAN 1 afzd/or SPN 500 is comrnittod to deliver to a given dauination, wherein the average .? 3 may be calculated over a fixed or variable time window. Although the word "average" will be used throughout, any other similar algorithm may be used, such as the mean, the sum, or any other useful measurement andlor statistical calculation. If the average rate of aggregate offered traffc (i.e. the total offered traffc) from one or more sources to a given destination is greater than or equal t:o a given destination's assigned CDR, then the WAN 1 and/or SPN 500 may guarantee to deliver traffic addressed to the destination at an average rate equal to or greater than the CDR If the average rate of aggregate offered txaffc is less than the CDR, then the WAN I and/or SPN s00 may deliver the offered traffic to the destination at the aggregate offered traffic rate ( 100% of the offered traff c). To clarify, let the number of active sources i o sending tic to a particulu destination be N. As will be described in more detail below, a source may be: considered "active" during a given time window if the source offers at least a threshold amount oftraffic to the WAN 1 and/or SIfN 500 within the given time window. Let S, be the av~asp,~a offered traffrc ratg or "offering rates" from each source i toward a single given destination, wherein ~ _ ( 1, ..., ,~. Further, let R be the total rate st which the WAN 1 and/or is SPN 500 actually delivers traffc to the destination. Then, the WAN 1 and/or SPN 500 will provide that:
R i CDR ij ~; S~ 2 CDR ;
f R = ~ S~ OII~C!'wlJf .
If the aggregate offered traffic rate ~S, does not exceed the CDR, then 100%
of the offered traffic from each sourct l may be delivered through the WAN 1 and/or SPN 500 to the destination. However, when the aggregate offered traffic rate ~S, exceeds the CDR, the WAN
1 and/or SPN 500 may have the discretion to throttle back or reduce the delivery rate of offered traffic from some or all of the active sources. Delivery may be reduced by an amount such that s the total rate of traffic delivery R to a destination is at least equal to the destination's assigned CDR. In the situation where R is reduced by the network, it may be desirable to enforce "fairness" for Bitch source. In other words, it may be desirable to ensure that no single source may be allowed to be greedy by obtaining a disproportionate amount of network bandwidth at the expense of other sources.
to To provide for fair access to the WAN 1 and/or SPN 500, in some embodiments each source is assigned at least one dGStinmon rate share (DRS). A DRS is a rate, measured in data units per unit of time (e.g., bits per second). A separate DRS andlor set of DRSs may be assigned to each sounx and/or grasp of sourrssi. Further, the DRS or DRSs for a given source may depend upwn the don or sat of dest;nations that the source may sand traffic to. In t 5 other words, each source l may be assigned at least one DRS, corresponding to the DRS
assigned between a source l and a given destination (or sei of destinations).
Thus, in some embodies, the DRS may be different for a given source depending upon which destination it is sending traf~c to. In further embodiments, the DRS for a given source may be constant, independent o:f the destination.
2o When a source l offers tral$c at an average rate S, exceeding the CDR of a particular destination, fairness may be achieved by ensuing that each source is allowed to transmit at least its fair share of the CDR. A source's "fair share" of the destination's CDR is defined as the source's DRS divided by the aggregate DRS of active sources transmitting to a given destination. Thus, each active source's fair share, r" of the CDR may be defined as the following:
S DRS
r; = D~ CDR .
The actual network mmsmission rate, T" that the WAN H and/or SPN 500 chooses as conforming traffic guaranteed to be delivered from each source to a given destination may satisfy the following:
what ~; S, s CDR , i T~ x >sa~r~, S~~ .
Thus, in these embodima~ts the WAN 1 and/or SPN 500 may enforce fairness by reducing one or more a~outca' actual network transmission rate T, at most from S, to r, ensuring that each source obtains its fair share of the CDR In some embodiments, to achieve a rate of at least CDI~ the WAN 1 and/or SPN 500 may at its discretion transmit traffic from a given active -t 5 source or sources at a rate greater than r,. In fact, the WAN 1 and/or SPN
500 may at its discrdion tran.~tmit data from a source i at any rate between and including the fair share rate r, and the full offered rate S;.
IfS, is greater than T;, a source may be considered by the WAN 1 and/or SPN
500 to be a ''non-conforming source." Conformance of a source may be calculated using a standard leaky bucket algorithm with variable drain rate. 'Thus, the conforming "depth" of a "bucket" would s be DRS," W. In other words, the maximum number of bits that will be seat to the network within a given time window of length W is equal to DRS,' W. During a given time window of length W, the'~drain rate" of the "bucket''' is equal to T, which is calculated during previous time _ windows. TMs, data packets inserted "above" the conforming bucket depth may be labeled as "non-conforming." In other words, for a given time window, data packets in excess of the total t o DRS,' W number of bits may be labeled as non-conforming data packets. In such a situation, some or all of the source data packets equal to the differenca between S, and T, may be labeled as non-conforming data packets, and some or all of the non-conforming data packets may be dropped.
This does not mesa that data cannot be of a bursty or rate-variant nature.
Although t s exemplary embodiments have been described as operating using average rates, real-time rates may vary withun arty given time window of length W. TMrsy a certain amount of burstiness of data is allowable. This maximum burst size is the maximum number of bits that the WAN 1 and/or SPN 500 guarantees to transfer during a time window W.
In further embodiments of the invention, the WAN 1 and/or SPN 500 may provide _ 2o forward congestion notification to a dGStinstion. For examples the WAN 1 and/or SPN 500 may provide a layer 2 binary indication that the CDR is being exceeded by using the frame relay forward explicit congestion notification (F'ECI~ bit and/or a layer 3 message that indicates a ron-conforming source and optionally contains rate information for that source (e.g. the actual transmitted rate T, and/or the excess rate S, - T). Furthermore, in some embodiments, multiple non-conforming sources might be listed, even within a single message. In these forward congestion notification embodiments, conformance may be measured at the network side of a destination. Li some embodiments, a forward congestion notification may be provided to a given destinatiion when the offering rate S, of as active source offering to send traffc to the destination exceeds the actual network transmission rate T, for the sourca.
Non-conforming packets that cannot be transmitted on the egress port of a source may to be dropped vvith or without any indication to the source or destination. To measure conformance- of a source, the amount of excess bandwidth available to the sources for transmission to the datinstion should be determined. To calculate the excess bandwidth, Iet w be the ~ dime window. The excess bandwidth above the &ir share bandwidth may be computed as y r ~ s wherein M is defined as the number of possible sources from which a destination rnay receive traffic, and wherein B is defined as a predetermined reference rate. The introduction of reference rate i3 effectively reserves network bandwidth for an inactive source, thus ensuring that a previously inactive source that becomes active can send at leant some traffc through the network during time period W~ Specifically, the WAN I andlor SPN 500 may ensure that each source's T, is F;uaranteed to be at least a minimum reference rate B. In this situation, a source is considered active during w if more than B"' w units of data (e.g., bits) are received during W.
It is desirable: to define B to be relatively small as compared with S, so as to retain as much s excess bandv~~idth as possible, yet still large enough to ensure network availability to a non-active sotuce (non-sending source with respect to a given destination) that may later become active with respect to a given destination. In some embodiments, B may be a predenrmined -rate. In fiirthar anbodiments, B may vary with time, with the number of inactive sources, with the number of active sources, and/or with the total number -Df sources. In still fiuther t o embodima~ts, B for a source may depend upon a priority clsssi8cstion assigned to the source.
In still furthar anbodiments, when a previously inactive source becomes active, the priority assigned to the sourca may depend upoa the content of tlss data (e.g., data payload, DLCI, and/or address) offered to be sent Thus, B may trot be the same for each source.
Once the access bandwidth is determined, the maximum conforming actual network t 5 transmission rates, Ta may be calculated. To accomplish thin, T, for each source may first be set by defituh to min(r" S~. Then the exceu bandwidth, E, may be distributed among some or all of the sounxs.that are activdy transmitting to the given destination, thus adjusting or raising T, for these sources. In some anbodiments, the excess bandwidth may be uniformly distributed among some or all of the active sources. In further embodiments, the excess bandwidth may 2o be distributed among these sources according to source priortty, data priority, and/or DLCI.
In fi~rth~ anbodiments, the WAN I and/or SPN 500 may provide backward congestion e9 notification to a non-conforming source. Such notification may be in the form of a layer 2 and/or a layer 3 message indicating a destinations) for which the non-conforming source is exceeding T, and/or rate information for the non-conforming source (e.g. the actual transmitted rate T, and/or the excess rate S, - T~. However, a layer 2 notification by itself may not be s preferable, sin~;,e a source receiving only a layer 2 notification may not be able to distinguish between destunations to which the source is conforming and those for which it is not conforming. In some embodiments, a backward congestion notification may be provided to a given active source when the offering rate S, of the source exceeds the aciusl network transmission rate T, for the sources. In firrthes embodiments, s user-st a non-confornsing source t o msy be notified of congestion information, the assigned CDI~ DRSr s"
and/or ?',. In still further embodiments, it may be up to a user to decide how to act upon a congestion notification. In even further ernbodiments, a source tray reduce its offering rate S, in response to receiving a backward congestion notiscation.
In these backward congestion notification embodiments, conformuice may be t s implanted at the netv~rork side of the sources UNL In such anbodiments, feedback concerning the destination delivery rate may be required from the destination. The feedback may also contain information regarding the rate share of the active sources at the destination andlor the CDR divided by the aggregate rate.
While iecemplary systems and methods embodying the present invention are shown by Zo way of example, it will be understood, of course, that the invention is not limited to these embodimarts. ~Modifieations may be made by those skilled in the art, particularly in light of the foregoing teachings. For example, each of the elements of the aforementioned embodiments may be utilized alone or in combination with elements of the other embodiments.
Additionally, although a meshed network is shown in the examples, the inventions defined by the appended claims is not necessarily so limited. Further, the IP switch may convert from any higher level 5 1P like protocol to any fast-packet like protocol and is not necessarily limited to the ATMJIP
example provided above. Furthermore, examples of steps that may be performed in the implementation of various aspects of the invention are described in conjunction with the example of a physical embodiment as illustrated in Fig. 5 . However, steps in implementing the method of the imariion are not limited thereto. Additionally, although the examples have been 1o daivcd using the IP protocol for layer three, it will be apparent to those skilled in the art that any version of IP or IPX could be used as the layer three routeable protocol.
Furthermore, it will be unda~tood that while some examples of implementations ara discussed above regarding IP and ATM protocols, the imrention is not intended to be limited solely thereto, and other protocols that are compatible with aspects of the imrontion may lx used as well.
l5

Claims (10)

1. A method comprising the steps of:
receiving into a fast packet network frame relay data packets, said frame relay data packets having user data in a user data field;
switching said frame relay data packets within the fast packet network responsive to the user data, wherein the user data includes an Internet protocol packet;
generating a fast packet address field responsive to Internet protocol packet data; and routing the Internet protocol packet through the fast packet network responsive to the fast packet address field.

2. The method of claim 1 wherein the step of generating the fast packet address field occurs in a node located at an edge of the fast packet network.

3. The method of claim 1 wherein the step of generating the fast packet address field includes routing the Internet protocol packet data within the fast packet network to a node capable of generating the fast packet address field responsive to the Internet protocol packet data.

4. The method of claim 1 wherein the fast packet address is generated at a single node within the fast packet network.

5. The method of claim 1 wherein the fast packet network includes a plurality of nodes capable of generating the fast packet address field responsive to the Internet protocol packet data and nodes not capable of generating the fast packet address field responsive to the Internet protocol packet data.

6. The method of claim 1 wherein layer 3 data within the Internet protocol packet data is utilized to generate the fast packet address field.

7. The method of claim 1 wherein layer 4 data within the Internet protocol packet data is utilized to generate the fast packet address field.

8. The method of claim 7 wherein the layer 4 information is utilized to determine a quality of service.

9. The method of claim 8 wherein the quality of service includes an information rate.

10. The method of claim 8 wherein the quality of service includes priority information.