BRPI0721399B1 - method to create a synthetic bridge and synthetic bridge - Google Patents

Abstract

METHOD FOR CREATING A SYNTHETIC BRIDGE AND SYNTHETIC BRIDGE. The method for creating a synthetic bridge (100) uses selected data (406) logically extracted from an application layer of a first network (12A) that contains one or more first data streams to be transported to a second network (12B ). The selected data (406) is extracted logically from an application layer of the second network (12B) that contains one or more second data streams to be transported to the first network (12A). The two or more first and second data streams are transported through separate sets of media link interfaces, other than network (130-133), which allow only limited information encoding, and inherently prevent any protocol information of network pass with the two or more first and second data streams until after the two or more first and second data streams are in control of the opposite network, from which they were transported.

Description

History of the Invention

World-class businesses are increasingly demanding agility with respect to the design and development of new products and services. With the continued expansion of the global economy, businesses require transferring and leveraging knowledge through their organizations and partners, no matter where they are. However, the need to protect such shared knowledge makes its protection as important as the free flow of capital. Knowledge sharing across the borders of nations restricts the ability to take legal action against theft of intellectual property in relation to transferred knowledge. Therefore, in order to be globally competitive, it is necessary to be proactive, with respect to the protection of intellectual property from competitors, and all those who disturb the world economic system.

However, the formation of large information technology (IT) departments to support the exchange of ideas across borders is especially difficult due to the need to have a large and varied IT group, which considers the language, culture, and intimacy of the various foreign departments within the company itself. The difficulty is further amplified when the departments of several companies must agree on data sharing through separate and secure corporate networks, although the use of a common IT trajectory, such as the Internet, which exposes intellectual property to unknown threats, and also poses the risk of an external attack on the corporate network by intruders ("hackers") (known or unknown). Often, the inertia to change to make the IT departments of two different companies agree with a common firewall and other network protocols to share data between their networks, hinders or prevents the intended collaboration. Thus, most IT departments require an IT trajectory between different network sites ("sites"), which requires a pre-agreement between different IT departments for its implementation and administration.

Therefore, it is necessary to bring a new solution that provides a demonstrably secure way to exchange data between different groups within and between companies around the world, which protects and isolates the infrastructures of the various companies. Preferably, this new solution can be achieved by involving the various collaborative groups, requiring only little or no involvement of IT departments, once the new solution is implemented and approved. Therefore, there is a need to provide a reliable and safe knowledge transport between two or more global sites, without needing a customized IT path between networks.

Brief Description of Drawings

The present invention will be better understood with reference to the accompanying drawings. The elements of the drawings are not necessarily to scale, instead, it was preferred to emphasize a clearer illustration of the present invention. In addition, equal reference numbers refer to corresponding and similar parts in the different views. Figure 1 is an exemplary configuration of a video conference system by tele-presence, incorporating a Synthetic Bridge; Figure 2 is an exemplary design of a configuration illustrating a solution for implementing a Synthetic Bridge; Figure 3 is an exemplary configuration of a Synthetic Bridge with content node and collaboration node devices to provide interfaces to their respective networks; Figure 4 is an exemplary block diagram of an Synthetic Bridge Spanning configuration that incorporates two daisy-chained Synthetic Bridges coupled to a secure collaboration network; Figure 5 is an exemplary block diagram of an Extended Synthetic Bridge configuration that incorporates an additional or alternative component to the Extended Synthetic Bridge of figure 4; and Figure 6 is an abstract representation of network packets showing the removal of header information, which reduces the layers of the OSI model as the packets progress through the OSI model stack.

Detailed Description of the Invention

It should be noted that the drawings were not provided to scale. Furthermore, the various parts of the elements described were not designed to scale. Certain dimensions have been exaggerated in relation to others, to provide a clearer illustration and a full understanding of the present invention.

Furthermore, although the present invention is illustrated by preferred configurations, such illustrations are not intended to limit the scope or applicability of the present invention. Furthermore, it is not intended that the present invention be limited to the illustrated logical, electrical, and physical structures. These structures are included only for the purpose of demonstrating the utility and application of the present invention to the preferred configurations presently presented. Thus, while audio / video (A / V) data streams are considered to be the most typical data streams, any data streams, regardless of whether they are intended for audio, video, or any other purpose, are also included in the present invention.

This description describes an inherently secure data bridge (called a "Synthetic Bridge") between two separate secure networks, providing a "transport" mechanism for collaboration and other media data streams. The aforementioned Synthetic Bridge provides protection and isolation between network infrastructures for collaboration sessions and associated media resources. The Synthetic Bridge provides the transport of data streams, such as Audio / Visual (A / V) media to / from collaboration sessions, i.e. video conferencing. However, any data and relative application content of the non-network type, such as signals for remote activation of computer applications between two sites, can be shared, in general, through a Synthetic Bridge. Configurations of the invention include a specially designed and reliable collaborative transport network (c-tran network) connecting two or more content nodes. One of the content nodes can be connected to a separate and different network than the c-tran network which is not secure for users on the c-tran secure network. Each content node is connected to the collaboration node that interfaces the content node with the c-tran network.

The c-tran network provides quality of service guarantee, extending reach across the world with better performance in terms of low latency, bandwidth, and other values relating to individual networks connected via the Synthetic Bridge.

The collaboration node can include connectors to provide data entry to / from the collaboration node, as well as connectors to provide control of the relative non-network application to / from the collaboration node. The collaboration node may include an encoding / decoding mechanism for translating / converting collaboration data and control data to / from the c-tran network format. The collaboration node can also include connectors for connection to the c-tran network. Several additional items could be connected or presented in a collaboration node to increase the capacity for collaboration. Additional items may be part of the "collaborative media", such as cameras, speakers, microphones, video screens, or integrated A / V equipment, such as a collaboration studio, for example, Halo studio by Hewlett Packard Co.

The synthetic bridge has several advantages over ports, switches, firewalls of the prior art, which are traditionally used to provide similar interfacing between different networks. The Synthetic Bridge allows an intelligently and demonstrably secure transfer of collaborative media flows between networks. The Synthetic Bridge also provides an Internet or customized IP connection between networks for controlling non-network related applications. The Synthetic Bridge can provide a customization mechanism for a collaboration environment to be used, for example, by A / V integrators, for flexible and efficient customization of a desired collaboration environment, without needing IT support on a continuous basis. In addition, the interoperability of a virtual network with the Synthetic Bridge may include additional aspects, such as translation services, to allow collaborative sessions, which are incompatible with session management standards or media stream formats.

Before discussing the unique aspects and design of the Synthetic Bridge, some discussions and definitions of traditional networks and their terms should be appreciated to provide a better understanding of the Synthetic Bridge's unique value proposition and the various opportunities it presents.

Definition of Network Terms

The vast majority of the population is familiar with the Internet, which is an entity that connects the various corporate networks and allows individuals to access other computers or servers connected to it, when they access the network through a provider. The Internet per se is more than a collection of software "network protocols" that communicate through one or more hardware "networks". There are a plurality of different networks, but Ethernet is the most widespread local area network (LAN), which, in itself, has several software protocols to define how data must be organized to be transported. However, even Ethernet can rely on many transmission media, such as twisted pair cable, fiber optic cable, or coaxial cable. The various transmission media are connected with "hubs", ports (gateways), "bridges" (bridges), or switches. Various data devices or hosts (such as computers, servers, and peripherals) are connected to various transmission media using hubs, ports, bridges, and switches. Thus, hubs, ports, bridges, and switches can be used to interconnect the various data rates, software protocols, and transmission media between separate networks to form the global Internet.

To deal with network interoperability, the_ "International Organization for Standardization" (ISO) developed the "Open System Interconnection" (OSI) network suite that includes an abstract network model (7-layer model) and a set of concrete proposals . Although the Internet does not exactly follow the 7-layer model, its development was influenced by it. The 7-layer model divides the network system into layers, allowing one or more entities to implement the so-called layer functionality. An entity can combine one or more layer functionality.

Each entity interacts only with the layer immediately below and provides facilities for use by the layer immediately above. Network protocols allow an entity on one data device to interact with the corresponding entity on the same layer on another data device, via bridges, ports, or switches. Layer 1 is the physical layer. This layer defines the electrical and physical specifications of the devices. This layer defines which cables, coaxial cables, optical fibers, or wireless protocols, will be used. Layer 2 is the data link layer (often called the Ethernet layer). This layer provides functional and procedural techniques for transferring data between entities, and detecting errors that occur at Layer 1 (and possibly correcting them) - traditionally the layer where bridges and switches operate. Layer 3 is the network layer (often called the Internet IP protocol layer). This layer provides functional and procedural techniques to transfer sequences of variable length data from a source to a destination, through one or more networks, maintaining the quality of service required by Layer 4 (transport layer). Layer 3 performs the network routing function - traditionally the layer where routers operate to send data over an extended network. Layer 4 is the transport layer (often called the transmission control protocol layer) or TCP layer (Transmission Control Protocol). This layer provides a transparent transfer of data between users, thus easing the upper layers and providing a reliable data transfer. In addition, this layer follows the data packets and retransmits the packets that fail. Layer 5 is the session layer (often called the control layer). Layer 5 controls sessions between computers. Layer 5 creates, manages, and terminates connections between local and remote applications. Layer 6 is the presentation layer. This layer transforms data to provide a standard interface for the Application layer. Included in this layer are usually the functions of compression, encoding and decoding, as well as other techniques required for data manipulation. Other data manipulations may refer to conversions from ASCII encoded files to EBCDIC. Layer 7 is the Application layer. This layer provides a technique for a user to access information on the network through an application. Some standard application protocols that allow communication between applications include data transfer protocols (File Transfer Protocol FTP), simple mail transfer protocols (Simple Mail Transfer Protocol STMP), and hypertext transfer protocols (HTTP Hypertext Transfer Protocol ) used with Internet browsers.

Layers 4 to 7 are usually called "Host Layers", and Layers 1 to 3 "Media Layers". Data transferred on an OSI network is usually broken down in terms of data units for each layer and function. Thus, in Layer 1 (physical), the data is called "Bits" and represents the function of binary transmission, signal, and media. In Layer 2 (data link), the data is called "Frames" (Frames) and allows the function of physical addressing in the media access control sub-layers (MAC of Media Access Control) and logical link control (LLC de Logical Link Control) of Layer 2. In Layer 3 (network), the data are called "Packets" and provide the function of logical routing and path determination for the Internet protocol (Internet Protocol IP). In Layer 4 (transport), the data is called "Segments" and provides reliability functionality and end-to-end connections for the Transmission Control Protocol (TCP). In Layers 5 to 7, the data is simply called "Data" (Data) and provides inter-host communication functionality at the session layer, encoding, and data representation at the application layer, and the network to application process at application layer. Network ports can operate at any level of the OSI model from the application layer to the lower layers, including the physical layer.

It should be noted that, however, the TCP / IP architecture used on the Internet does not exactly follow the OSI model and a controversy has been established in the industry as to what should be described about the OSI layered model. In practice, the TCP / IP Internet network protocol omits some aspects of the OSI model, combines other aspects of adjacent layers, and separates other layers. When an application sends data to the network, each layer treats the information it receives from the upper layer, as data, and adds a header as control information in front of the data and transfers the data to the immediately lower layer. When a layer receives data from the lower layer, the layer processes and removes the header before transferring the remaining data to the subsequent upper layer.

The TCP / IP architecture in a model can be described as having 4 layers or hybridized entities: Application, Transport, Network, and Network Access. The TCP / IP Application layer groups the Session, Presentation, and OSI Application Layers. TCP / IP uses the terms "socket" and "port" to describe the paths through which applications host devices communicate. Most application-level protocols are associated with one or more port numbers. The TCP / IP transport layer effectively uses two network protocols to send / receive useful data to different applications. However, the transmission control protocol (TCP) guarantees the transmission of information. However, User Datagram Protocol (UDP) carries datagrams without checking them cable to cable. The network layer of the TCP / IP protocol includes several protocols, of which the Internet (IP) and ICMP protocols are the most important. All lower and upper layer communications travel over IP. The ICMP protocol is used to facilitate and manage packet routing on the network. The Network Access Layers group OSI Data Link and Physical Layers in the TCP / IP architecture. TCP / IP uses existing Physical Layer and Data Link standards, rather than defining them per se.

To cover two separate networks, several methods have been developed depending on the network organization. As some examples can be mentioned: firewall, bridges, ports, switches, and routers.

A firewall is a security device implemented by hardware, software, firmware, or a combination of these, which is configured to allow, reject, or broker connections. The basic task of the firewall is to control traffic and networks in different secure zones. Often, a firewall is called a "packet filter". To implement a firewall, a considerable understanding of security and complex network protocols is required, which requires considerable expertise from the network administrator to provide the appropriate configuration. A small error can render the firewall unusable as a security tool.

A network connects (serves as a bridge) multiple segments in the data link layer (Layer 2 in the OSI model, Network Access Layer in the TCP / IP model). A bridge is different from a hub, which simply relays packets to adjacent network segments. A bridge manages traffic from one network to another, processing information from each data frame received. For an Ethernet frame, the bridge provides the MAC address of the frame's source and destination, which is used to resolve the appropriate network segment to which the MAC address belongs. Two different methods are used to resolve how to route packets. "Transparent Bridging" uses a database to send frames across network segments. A Source Route Bridging Connection employs two frame types - One Route (SR - Single Route) and All Routes (AR - All Routes) - to find the route for the destination network segment. AR frames are used to find routes and SR frames to route data, as long as the route is known. According to the IEEE 802.ID standard, the network bridge is often called a "network switch". Although network bridges allow access control and performance control between networks, network bridges are difficult to adapt to large networks (to grow to an adequate size). Additionally, data accumulation requires a storage device and produces delays, which can be unpredictable on large networks, making latency a difficult parameter to guarantee. Often, the connection of different MAC protocols implies errors, so it is necessary to specify or formally designate the equipment for use on the network.

To handle large network items, routers and bridges must be included to control data. However, as experience has shown, Layer 3 (routers) and Layer 2 (bridges and switches) connections on the Internet are weak in terms of security. Various forms of attacks, such as MAC address fraud, DHCP starvation, spanning tree manipulation, VLA expectation (VLA), and others, imply serious restrictions imposed by IT departments in relation to how networks are implemented and configured.

To successfully connect (bridge) two networks, a port is often created from routers, bridges, and switches as an input to another network. A port is often associated with a router that knows where to direct a given packet that arrives at the port, and a switch that gives the effective trajectory to / from a port in a given packet. In a corporate network, a server is typically used as a port node. This server often also acts as both a proxy server and a firewall server and, therefore, its supervision requires very complex implementation and administration.

However, many applications (such as video conferencing) require audio and video streams from partners outside the corporate network to provide effective value. Therefore, the present invention provides images and devices to provide inherently secure data streams, such as A / V audio / video data streams for application programs, without the problems inherent in the implementation and administration of traditional network connections.

Synthetic Bridging Connection

The described configurations provide inherent security through a technique defined as "Synthetic Bridge Connection", which includes the following aspects: a- a first method or device to extract selected data from presentation or application layers of a first network containing a first set desired second data streams to be transported to a second network; b- a second method or device to extract selected data from presentation or application layers of the second network, containing a desired set of second data streams to be transported to the first network, allowing for a full-duplex operation; c- transport the first and second data streams through a set of media links of the non-network type, which only allows limited encoding of information and inherently prevents any information that is not in the sets of first and second streams of data that are modified until after the first and second data streams are in control of the opposite network, from which this data has been transported. "Limited Information Coding" refers to forcing all information (data) in the respective data streams to be encoded in a limited non-network format and sending it through a non-network media link interface, that only accepts this limited format before being decoded from the limited format back to an acceptable format for network packets. Thus, in a configuration, the information in the data streams of a first network is encoded from MPEG2 to a limited video encoding type RGB RS 170, and sent over a non-network media link interface, such as a cable VGA. RGB RS 170 video has a limited format that is characterized by being inherently incapable of executing a network protocol or being manipulated by network traffic on a first or second network. The RGB RS 170 system can then switch back to MPEG2 or another encoded video format to be controlled and integrated into the second network for transport. In another configuration, limited information encoding can maintain the data flow in digital form, but encodes the data flow to a different type of data bus (such as, SDI, DVI etc.) to provide a data link interface. non-network media, which does not correspond to the network, to inherently prevent the transmission of network control or the modification of any information not included in the data flow until the data flow is in control of the second network.

Certainly, other aspects can be added to further increase the capacity of the Synthetic Bridge. Thus, because only the selected data is extracted from the session, presentation, or application layers, an additional interface independent of the data path can be provided for application control or other application information to be transported to the second network. In addition, once all the network information of the lower TCP / IP or OSI layers is extracted from the selected data, an additional interface can be provided to allow directory services on the opposite network, thus allowing the selection of where to obtain or where to route the first ones. and second data streams. One solution with respect to providing control or directory services is to provide only one-way control and directory services. One way in which unidirectional control / directory services can be provided is to allow unidirectional control and directory services to be provided through a separate path, such as by email. In other words, a user at a site on the first network can send an email to a known email address, with the appropriate issuer authentication. The e-mail may include information regarding which site on the second network to access, and which data streams to receive and send. Another solution is to allow an Internet site to be accessed by password or biometric control to configure a Synthetic Bridge.

In addition to the aspects of a Synthetic Bridge, multiple Synthetic Bridges can be configurable in either a serial or "daisy chained" (serial) configuration. Therefore, a bidirectional path of inherently secure data flow can be transferred from a first to a third network over a second network (c-tran network) securely and requiring minimal IT support to implement and configure.

To provide even greater security and compatibility between networks and applications, the desired selected data can be encapsulated with hyperdata (such as using collaboration description language) that describes the purpose of the data flow, the format in which it is located, to whom belongs, and other relevant information, that can be useful to different applications. Thus, by providing an improved collaborative layer container around the selected data streams, the data streams can be shared among different applications after making various transformations to the data streams using encapsulated hyperdata. More details regarding these components of various configurations will be described later in relation to the accompanying drawings and their descriptions.

Figure 1 is an exemplary configuration of a bridge video conferencing system 10 that shares information such as video audio and other data streams over a reliable Internet network 12A, (c-tran network). The Internet, which is actually a network protocol operated on several private and public networks, is not considered to be a secure network, although it is often used as a collaborative network. A telepresence conference system 20 can include several video streams, such as from cameras 22, 24, 26, and from there to monitors 32, 34, 36. Audio streams from microphones 52, 54, 56, which go to speakers 44, 46, 48 and sub-woofer 50. Additional data streams can be transported over secure network 12A, such as local scanner 18 or data monitor 38, via local server 14. The server 14 can also perform other tasks, such as providing a graphical user interface (GUI) for monitor 18. The GUI allows simple implementation and operation of video conferencing, as well as directory services and other tasks. Server 14 can be controlled with mouse 16 with GUI interface by an on-site participant.

The audio streams to / from the telepresence video conference system 20 can be mixed and processed to reduce echoes and allow them to adapt to ambient acoustics, using a mixing and echo elimination circuit. The clarity of sound in the speakers can be improved by means of amplifiers 32 to allow a better directionality, providing the separation of low tones for sub-woofer 50 and high tones for speakers 44, 46, 48. All audio data streams and video can be compressed, encoded, decoded, decompressed, reformatted, or converted to different formats using codec 28 circuitry.

Although a secure network 12A allows a telepresence video conference system 20 to interface with similar systems 20 on secure network 12A, there are other types of video conference systems 11 through which it is preferred to share information between and with video conference systems over telepresence 20. However, these other video conferencing systems 11 typically are found on corporate intranets or on public / private networks 12B, which are not trusted by users on secure network 12A, thus making networks 12B insecure. In addition, although users on network 12B may trust each other, there may not be sufficient knowledge of people on secure network 12A with users on network 12B, therefore, secure network 12A can also come to be perceived as non-secure network.

Therefore, the described configurations allow a connection between two or more different collaborative sessions in different networks in a demonstrably secure way to provide a reliable and safe transport between two or more sites. These configurations eliminate the need for a private or unreliable Internet path between two site networks. That is, instead of providing a conventional IP switch bridge or router that operates at low levels (2-4) of the OSI framework, the invention provides a Synthetic Bridge 100 between networks 12A and 12B for application data flows . This Synthetic Bridge 100 removes and thus prevents all network protocols (such as IP protocol) from being shared between networks, while allowing application data and application control flows to be transported. Inherent security is provided in part by a logical selection of data streams (using hardware or software, or a combination of these) and by a limited encoding of information from the data streams, which allows data streams to pass through an interface non-network media link that physically does not allow any network protocol information to pass between networks. In addition, in some configurations, the non-network media link interface is only compatible with the transport of application data streams. Thus, a non-network media link interface for a video data stream is an analog video link, which is unable to carry network protocol information. A second non-network media link to an analog data stream can be an analog audio cable, which is unable to carry network protocol information. Thus, using conventional media link interfaces to conduct data streams that are inherently incapable of conducting media protocol information, security is demonstrably secure.

The secure network 12A can be a dedicated application network, such as a c-tran network and not a general network like the Internet, which operates on multiple networks, public or private. The 12A network is specifically designed to optimize low-latency broadband to be capable of live, interactive, audio, video, and other media streams with lots of data. Preferably, network 12A has a link less than 45 Mbps to avoid a more significant serialization delay. To keep latency minimized, a continuous network topology is used. To maintain a high quality experience for users, the total latency in one direction between two sites is kept below 1/4 of a second. This total latency covers all aspects of encoding / decoding, encapsulation / decapsulation, capture and presentation, filtering, processing, compression / decompression, and transport latencies across the transmission paths. As each component's contribution to total latency decreases (as the technology evolves), the "reach" distance from where different sites can be physically located increases.

To better preserve the shorter trajectories, which are capable of providing reliable delivery with the loss of a few packets, network resource and bandwidth mechanisms are used to ensure high quality sessions throughout the session. Since most data flows presumably occur by connecting a pair or a small number of sites for a given session, there is little presumption of session preference when authorized sessions start.

Latency and / or loss tolerant sessions can be provided on the network. Such services include directory, presence, messaging, credential verification, and time / name services, for example. The interior of the network focuses on allowing greater speeds to traffic flows. Any access control, encryption, decryption, and other proxy services, if necessary, occur at the edge of the network, such as on Synthetic Bridge 100, and not within network 12A. This solution helps provide a simple, stable and fast expansion and maintenance 12A network backbone.

Figure 2 is an exemplary drawing of a configuration illustrating a solution to implement Synthetic Bridge 100. In this configuration, Synthetic Bridge 100 has three main components: content node 120, a set of non-network media link interfaces 130- 135, and collaboration node 110. Content node 120 is connected to network 12B, such as with a leased line 140 (for example, an optical cable, T3 or via a wireless link) that provides a large / for content node 120. Although network 12B can be connected to various products in the collaborative type, such as video conferencing devices, video games, interactive screens, and telepresence systems, a few representative, non-limiting examples are shown. Thus, a mobile device 115, with a built-in webcam (not shown), is connected to the 12B network via either a wired, optical, or wireless connection. Also shown is an IBM ™ 113 or Apple ™ 116 (Imac ™) compatible PC computer, with dedicated personal web conferencing and video conferencing system 114. Collaboration node 110 is connected to a secure network 12A. The secure network 12A is additionally connected to other video conferencing systems (VCS) 20. The VCS 20 can be a telepresence system, as shown in an exploded view. The VCS S20 includes an interface 21 rack that connects video monitors 32, 34, 36 and GUI interface / collaboration screen 38. Other connections, for example, audio, cameras, and other collaboration tools, are omitted for clarity. Video monitors are arranged around a conference table 60 with chairs 62 to provide a sense of reality. The set of non-network media link interfaces 130-135 allows only limited encoding information to be transported between content node 120 and collaboration node 110. In this particular configuration, four network link interfaces are used. non-network media 130-135 to carry two video streams in opposite directions and two audio streams in opposite directions, although any number of non-network media link interfaces can also be used. Also shown is the condition of sharing other data, such as video content and audio content from DVD, HD-DVD ™, Blue-Ray ™, or other optical media players. Certainly, other A / V equipment or other narrowband interfaces can be connected via non-network media link interfaces to provide security inherent in networks.

Figure 3 is an exemplary configuration of a Synthetic Bridge 100 having content node 120 and collaboration node 110, which are devices that provide OSI model stack interfaces for the respective networks 12B and 12A for the set of media link interfaces. non-network type 130-133. Although only four non-network media link interfaces are shown, it is possible to use any number of non-network media link interfaces. Content node 120 receives the content of network 12B through a physical layer, such as an Ethernet connection including a leased line 140, such as connection T3, although any other physical types are possible. Conventionally, data exchange between two nearby networks is done at Layer 2 or Data Link Layer in the OSI model, when using a bridge or switch device. If the distance between the two networks is large, then the routing of data on Level 3 of the OSI model is conventionally done by a router. However, prior art practices to form a data link at these levels have traditionally (and continue to be) overloaded to provide effective security against viruses. Thus, it is difficult to effectively provide a bridge connection between two separate networks, local or distant, without a huge volume of IT support, when using conventional techniques in Level 2 and 3 layers of the OSI model or programming firewalls with ports.

In contrast, in the Synthetic Bridge configuration, data flows of interest are allowed to pass through Layers 1-7 in the OSI model (or IP layers 1-4, depending on how it was described, as mentioned above) before reaching a Collaboration Layer or Level 8 Layer, which allows you to extract or transfer data streams to Application Layer 7. In addition to A / V data streams, data streams in the form of application control can also be transferred through Level 8 and Level 7 Layers. Other information that can be transferred is data that describes format, size, encoding, content , usage, restrictions, etc. which are applied to each data stream transported to the other network 12A. This other information may have a limited encoding, and be carried over a non-network media link interface to maintain inherent security. Filtering or selectively selecting the desired A / V application and control data streams from the application layer and encoding them, in limited encoding, for non-network media link interfaces, all network protocol information (such as MAC addresses, IP addresses, ports, and routing information) are prevented from being transferred to the other 12A network. Using non-network media link interfaces in addition to the logical selection, it prevents the network protocol from being occasionally modified by a virus Trojans or other programs on another network. Therefore, the Synthetic Bridge 100 is a combination of hardware, software, and firmware that removes all network protocol information, before transferring application data through an inherently secure set of non-network media link interfaces.

To help provide additional security for a company's IT department, content node 120 can be provisioned, controlled, pre-configured, or inspected by the IT department to ensure that only the desired data streams are carried over Collaboration Layer 8 to non-network media link interfaces. However, significant ongoing IT support is not required. Ideally, media streams are logically selected from the exit of the Application without any modification to the Application. Thus, Collaboration Layer 8 can be added independently of existing applications, thereby increasing the chance of maintaining security.

In addition to helping to protect the encoding / decoding system on the 12B network, Collaboration Layer 8 can be used to provide decoding of the encoded data streams before presenting them to the set of non-network media link interfaces. 130-133 to add more security. Thus, not only are network protocols not transferred with data flows, but also public or private keys do not need to be transferred to allow decoding downstream of data flows at the receiving sites. Collaboration node 120, after receiving the encoded data stream from content node 120, can add its own encoding before presenting the data stream for transport on network 12A.

Similarly, in data streams transferred from collaboration node 110 to content node 120, collaboration node 110 can also remove its encoding (if any) and transfer a decoded data flow to content node 120, which then adds its own encoding at Collaboration Layer 8 before presenting the data stream to the 12B network. Again, here it is not necessary to share encryption keys between networks, thus providing greater confidence and security between networks 12A and 12B.

Although both content node 120 and collaboration node 110 are shown as abstract blocks implementing the various functions of the OSI Layers, those skilled in the art should realize that these functions could be implemented through logical circuitry using hardware or memory (or a combination of these) programmed to execute computer-readable instructions in a processing unit. The set of non-network media link interfaces can be implemented through any combination of conventional standard digital or analog interfaces, such as DVI, HDMI, RGB RS170, VGA, etc. In addition, a custom non-network media link interface can be implemented to provide additional security, building it so that it cannot be accessed without authorized physical access. However, once no network protocol information is transferred through the non-network media link interface, anyone with unauthorized access can achieve its disruption, monitoring, replacement of data flows. These actions would not affect the data flow routing as it is managed by the secure 12A network. Collaboration node 110 works similarly as described for content node 120, but provides its services for applications transported on secure network 12A. Collaboration node 110 communicates via a second broadband leased line 150 or other high-speed interface, such as optical fiber to network 12A. Furthermore, while figure 3 illustrates a symmetrical flow of information between the content node 120 and the collaboration node 110, the information flow can be asymmetric. Thus, collaboration node 110 can provide more A / V data streams to the receiving content node 120. As an example of bridge connection, a telepresence system for a video conferencing station, the content node 120 can provide video and audio streams. However, collaboration node 110 can provide three video streams and one audio stream to your local meeting site and three additional video streams and audio stream for the combined meeting together with an A / V collaboration link, such as a DVD player, or other A / V equipment.

In summary, the synthetic bridge includes a set of non-network media link interfaces that connect a content node to a collaboration node. The content node includes circuitry to extract selected data from the application layer of a first network. The selected data contains a set of first data streams without a network protocol to be transported to a second network. The content node also includes a circuit to receive a set of second data streams, of limited encoding, to be incorporated into the application layer of the first network, and a circuit to encode, in limited encoding, the set of first data streams. on non-network media link interfaces.

The collaboration includes circuitry to extract selected data from an application layer of the second network that contains a set of second data streams without a network protocol to be transported to the first network. The collaboration node also includes circuitry to receive a set of first encoded data streams to be incorporated into the application layer of the second network, and a circuit to encode, in limited encoding, the set of second data streams in the set non-network media link interfaces.

Figure 4 is an exemplary block diagram of an "Extended Synthetic Bridge" configuration 200 that incorporates two Synthetic Bridges 100A and 100B coupled to the secure network 12A in "Daisy" mode (Daisy Chained). The Synthetic Bridge 200 allows additional flexibility and long distance remote connections. Another possible aspect, if desired, is the remote control for the Synthetic Bridge 200.

In this configuration, a first network 12B is connected to computer 113A, VCS 114A, and mobile device 115A. Again, any of the connections can be wired, optical, or wireless, as desired. A second network 12C can be similarly configured with a computer 113B, VCS 114B, and mobile device 115B.

In this arrangement at least one of the devices from the first network 12B, the second network 12C, or the secure network 12A, or a combination of these, can access a control interface 202 from Synthetic Bridge 200. The control interface can be made manually directly connected or connected via the Internet 204 as shown in figure 4. The control interface 202 can be activated by command, graphical user interface (GUI), menu selection, capable of accepting remote commands, or any combination of these. An additional option for Internet control is made by commands sent by email. This solution allows additional filtering of the commands received to ensure that they come from authorized and reputable sources. In addition, the GUI can be presented via the web page interface to the 202 control interface.

The Extended Synthetic Bridge 200 includes secure network 12A, a first Synthetic Bridge 100A, and a second Synthetic Bridge 100B. The secure network 12A may include one or more video conferencing sites 20. In addition, control of the Extended Synthetic Bridge 200 may be provided by a separate control interface 202, for example, server-based. The control interface 202 may allow manual entry, such as via GUI interface 38 and mouse 16 (figure 1) or connect to another shared network, such as the Internet 204, as shown. Control interface 202 may include signals to allow secure network 12A to configure multiple connections for collaboration between devices on networks 12A, 12B, 12C.

The first Synthetic Bridge 100A includes a first control node 120A and a first collaboration node 110A for interfacing network 12B and secure network 12A, respectively. The first content node 120A and the first collaboration node 110A interconnect via at least one first non-network type media link interface 130A, through which the encoded signals are carried.

The second 100B Extended Synthetic Bridge is constructed as the first 100A Synthetic Bridge, however, programmed, or designated, to interface the 12C network with the secure 12A network. A content node 120B is connected to network 12C via a dedicated line, such as leased line 150 which can be remote from network 12C. The second collaboration node 110B is connected to network 12A and the second content node 120B, through at least one second non-network media link interface 130B.

The content nodes 120A and 120B can be programmed or configured to convert the received A / V streams to a standard limited encoding and send these A / V streams through the respective non-network media link interfaces 130A and 130B respectively for collaboration nodes 110A and 110B. Collaboration nodes 110A and 110B can convert or recode the received standard limited encoding to a special collaboration format recognized by collaboration nodes 110 on the secure network 12A. Similarly, special formatted A / V collaboration streams received by collaboration nodes 110A and 110B can be converted to a limited encoded format and transported respectively through the non-network media link interfaces 130A and 130B, and converted or recoded to the format required for networks 12B and 12C.

Therefore, by providing limited encoded formatting and transporting via a non-network media link interface, collaboration nodes 110A and 110B and content nodes 120A and 120B can provide conversion services with respect to various streams of data to ensure interoperability without affecting encryption security. While Synthetic Bridges 100A and 100B provide safety inherent in the secure network 12A, the Extended Synthetic Bridge 20 also provides network insulation with a high level of safety.

Figure 5 is an exemplary block diagram of an Extended Synthetic Bridge configuration 400 that incorporates an additional or alternative aspect to the Extended Synthetic Bridge 200 of figure 4. In this configuration, collaboration nodes 110A and 110B include logic for adding information from "Collaboration Description Language" (CDL) to transported data streams, to encapsulate them, and to allow other collaboration nodes 110 on the secure network 12A to better process the data stream. The CDL consists of information different from that contained in the network protocol headers, which normally accompany data flows over a network. Rather than containing MAC addresses and destination ports and IP addresses, the CDL describes encapsulated data streams with respect to subscribed properties to provide fast and easy decoding, decoding, converting, or modifying the data streams, and providing that they adapt to different A / V or other systems connected to networks 12A, 12B, 12C.

Thus, with a video stream, the CDL can describe the video format, its relationship with other video and audio streams, such as synchronization data, or correlation (in terms of telepresence or multiconference) with other data streams, video format color, bit depth, compression standard used, encoding technology used, owner of the stream, physical location from which the stream originated, time zone from which the stream originated, camera video capture angle, zoom factor of camera, which participants appear in the video, and other parameters regarding the content and format of the video, which can be useful for other collaborative nodes. The CDL can appear once at the start of transporting the video stream over the secure 12A network or it can also be sent periodically to allow resynchronization of the A / V stream, if there are network difficulties. The CDL can also be interrupted, so that some session related information is transmitted at the beginning of the data flow session and other information in real time is transmitted in individual packets. The CDL can also be used with public and private key transmission to ensure that encoded encoded CDL streams are received only by the respective collaboration node 110 to provide even more security.

The CDL can be added to encapsulate the data flow in the content node 120, or alternatively in the collaboration node 110. The information in the CDL can be pre-configured for each session and / or adapted in real time as the VCS session progresses.

Figure 6 is an abstract representation of network packets that shows the removal of header information from lower OSI model layers as the packets progress in the OSI model stack. Thus, at Layer 2, a data link packet 426 includes a first header 242 and a network layer data packet 420 that encapsulates a data packet 414, which is part of a larger data stream. Additional header information used in upper layers of the OSI model stack, such as second and third headers 422, 418, is shown encapsulated in the first data packet 420. After Layer 2 removes the first header 424 from the data link packet 426, the network layer packet 420, including part of network data 412, is transferred to Layer 3 of the OSI model stack. Layer 3 removes second header 422 and transfers the transport layer packet 416 to Layer 4 of the OSI model stack. Layer 4 removes the third header 418 and performs decoding or any other processing on the Transport layer data packet 410, before transferring the Session layer data packet 408 to Layer 5 of the OSI model stack. This Session 408 layer data package can be used on the Session, Presentation, and Application Layer (Layers 5-7) of the OSI Model Stack, as required. Information from a desired data stream is removed from the Session 408 layer data packet in Layers 5-7 and transmitted to Layer 8 (Collaboration Layer) which can translate, encode, convert, format, or manipulate the packet data from collaboration layer 406 to present to the secure network. In one configuration, CDL information 404 is attached to collaboration layer data packet 406 to create a secure network collaboration packet 402 to be transported over network 12A.

Similarly, collaboration packages from one or more secure network 402 received by Layer 8 take the CDL 404 packet, and use the information to translate, decode, reconvert, reformat, or manipulate the collaboration layer data packet 406 to create a Session layer data packet 408 for use on a receiving device, such as a video conferencing system. The Session layer data packet 408 is downloaded to the OSI model stack and network protocol information added, such as first, second, third, headers 424, 422, 418 to create a data link network packet 426 for be transported over a network to the receiving device.

While the present invention has been particularly described and shown with reference to preferred and alternative configurations, those skilled in the art should understand that many variations can be made without departing from the spirit and scope of the present invention, as only defined in the claims that follow. The description of the present invention should also be understood as including new and non-obvious combinations of these elements. The above configurations are for illustrative purposes only, and no element or aspect should be considered as essential to all combinations, which are claimed in this or other specifications. When claims use the terms "ONE" or "FIRST" element of its equivalent, such claims should be understood as including the incorporation of one or more of these elements, but without requiring or excluding two or more of them.

Claims (19)

1- Method for creating a synthetic bridge (100; 200; 100A, 100B; 400), characterized by the fact that it comprises the steps of: logically extracting first data from an application layer of one or more first data streams from a first network (12B), said first data to be transported to a second network (12A); logically extracting second data from an application layer of one or more second data stream from the second network (12A), said second data to be transported to the first network (12B); transport said first and second data from the two or more first and second data streams through separate sets of media link interface (130-135; 130A, 130B), of the non-network type, allowing only limited information encoding and preventing any network protocol information from being added with said first and second data from the two or more first and second data streams until after the two or more first and second data streams are in control of the opposite network, from which they were transported. 2- Method, according to claim 1, characterized by the fact that it additionally comprises the step of controlling the configuration of the synthetic bridge (100; 200; 100A, 100B; 400) from a separate network. 3- Method, according to claim 2, characterized by the fact that the step of controlling the configuration of the synthetic bridge (100; 200; 100A, 100B; 400) is done using email. 4- Method, according to claim 1, characterized in that it additionally comprises the step of converting at least one of the one or more first and second data streams from a first video format to a second video format. 5- Method, according to claim 1, characterized by the fact that the media link interfaces (130-135; 130A, 130B), of the non-network type, in order to prevent any network protocol information from being transferred between opposite networks. 6- Method, according to claim 1, characterized by the fact that it additionally comprises the steps of: transporting the two or more first and second data streams through a collaborative transport network having a smaller data link of 45 Mbps; logically extract third data from an application layer of one or more first data streams of the collaborative transport network, to be transported to the second network (12A); and logically extracting fourth data from an application layer of one or more second data streams from the collaborative transport network to be transported to the first network (12B). 7- Method, according to claim 6, characterized by the fact that the total latency in one sense of carrying the one or more first and second data streams between the first network and the second network (12B, 12A) is less than one quarter of a second. 8- Method, according to claim 6, characterized by the fact that it additionally comprises the steps of: encapsulating at least one of the first or second and second data streams using a collaborative description language, before transporting on the transport network of collaboration; and processing at least one of the one or more of the first and second data streams with the collaboration description language, encapsulating the at least one of the one or more first and second data streams before passing through the processed at least one of the one or more first and second data streams to the first network or second network (12B, 12A). 9- Method, according to claim 6, characterized by the fact that it additionally comprises the step of providing directory services for the collaborative transport network to only allow unidirectional control of the collaborative transport network from the first and second network network (12B, 12A). 10- Synthetic bridge (100; 200; 100A, 100B; 400), characterized by the fact that it comprises: a set of media link interfaces, of the non-network type (130-135; 130A, 130B); a content node (120; 120A, 120B) connected to the set of media interfaces (130-135; 130A, 130B), of the non-network type, the content node (120; 120A, 120B) including: a circuit for extract first data without network protocol information from a set of first data streams from an application layer of a first network (12B), said first data to be transported to a second network (12A), and receive a set of second encoded data streams to be incorporated into the application layer of the first network (12B); and circuitry to provide limited encoding of said first data from the set of first data streams in the set of media link interfaces, of the non-network type (130-135; 130A, 130B); and a collaboration node (110; 110A, 110B) connected to the set of media link interfaces, of the non-network type (130-135; 130A, 130B), the collaboration node (110; 110A, 110B) including: a circuit to extract the second data without network protocol information from a set of second data streams from an application layer of the second network (12A), said second data to be transported to the first network (12B), and to receive a set of first encoded data streams to be incorporated into the application layer of the second network (12A); and a circuit to provide limited encoding of said second data from the set of second data streams in the set of media link interfaces, of the non-network type (130-135; 130A, 130B). 11- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 10, characterized in that it additionally comprises a circuit to control the configuration of the synthetic bridge (100; 200; 100A, 100B; 400) a from a separate network. 12- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 11, characterized in that the control of the configuration of the synthetic bridge (100; 200; 100A, 100B; 400) is done using email . 13. Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 10, characterized in that it additionally comprises circuitry to convert at least one data stream in the set of the first and second data streams from from a first video format to a second video format. 14- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 10, characterized by the fact that the number of media link interfaces (130-135; 130A, 130B), of the non-network type , within the set of media link interfaces (130-135; 130A, 130B), of the non-network type, be asymmetrical between the content node (120; 120A, 120B) and the collaboration node (110; 110A, 110B). 15- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 10, characterized by the fact that it additionally comprises: where the second network (12A) is a collaborative transport network to transport the first sets and second data flows between the first network (12B) and a third network (12C); a second content node (120B) connected to a second set of media link interfaces (130B), of the non-network type, the content node (120; 120A, 120B) including: circuitry to extract third data without a network information protocol from the set of the first data streams from an application layer of the second network (12A), said third data to be transported to the third network (12C) and receive a set of second data streams limited encoding data to be incorporated into the application layer of the second network (12A); and a circuit for limited encoding said third data from the set of first data streams in the second set of media link interfaces (130B), of the non-network type; and a second collaboration node (110B) connected to the second set of media link interfaces (130B), of the non-network type, the collaboration node (110B) including: a circuit to extract fourth data without network protocol information a from the set of second data streams from an application layer of the third network (12C), said fourth data to be transported to the second network (12A), and to receive a set of first encoded data streams to be incorporated into the application layer of the third network; and circuitry to provide limited encoding of the fourth data from the second set of data streams in the second set of media link interfaces (130B), of the non-network type. 16- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 15, characterized by the fact that the total latency in one direction of the transport of the sets of the first and second data flows between the first network and the third network (12B, 12C) is less than a quarter of a second. 17- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 15, characterized by the fact that it additionally comprises: circuitry to encapsulate at least one of the data streams in the sets of first and second data streams using a collaboration description language before transporting on the collaboration transport network; and a circuit to process at least one of the data streams in the sets of the first and second data streams with the collaboration description language encapsulating the at least one data stream of the first and second data streams sets before passing the at least one data stream processed to the first network or second network (12B, 12A). 18- Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 15, characterized by the fact that it additionally comprises means to provide directory services for the collaborative transport network to only allow unidirectional control of the network collaborative transport from the first network and second network (12B, 12A). 19-Synthetic bridge (100; 200; 100A, 100B; 400), according to claim 15, characterized by the fact that the collaborative transport network has a smaller data link of 45 Mbps.

Images