Mutually secure optical data network and method

Abstract

A digital optical data network system for improving information security in Passive Optical Networks (“PON”) by providing virtual information separation in the router, such as a premise router, or routers interfacing the entire PON, such as by utilizing virtual routing and forwarding, thus allowing safe data traffic between multiple carriers, service providers accessing the PON and multiple end users on the PON such as tenants in a building, employees of a business entity, or subscribers in a residential community.

What is claimed is: 
     
         1 . A multi-user optical data network apparatus comprises:
 a plurality of network service carrier lines connected to a passive optical network interface router;   at least one uplink connecting said interface router to an optical line terminal;   said optical line terminal being connected to a number of passive optical network feeds for carrying a common data feed to a plurality of optical network units each supporting at least one of a plurality of private user devices;   said interface router being configured to have at least one virtual routing table for each one of said plurality of optical network units; and,   wherein each of said optical network units is adapted to extract data packets intended for a supported one of said devices.   
     
     
         2 . The apparatus of  claim 1 , wherein said interface router is a premise router. 
     
     
         3 . The apparatus of  claim 1 , wherein said interface router is further configured to have a routing table routine generating said at least one virtual routing table for each one of said plurality of optical network units. 
     
     
         4 . The apparatus of  claim 1 , wherein each of said optical network units provides service to a separate number of private users. 
     
     
         5 . The apparatus of  claim 1 , wherein said uplink carries data including digitized voice and video data. 
     
     
         6 . A multi-user optical data network apparatus comprises:
 a plurality of network service carrier lines connected to a plurality of passive optical network interface routers;   a plurality of uplinks connecting said interface routers to an optical line terminal;   said optical line terminal being connected to a number of passive optical network feeds for carrying a common data feed to a plurality of optical network units each supporting at least one of a plurality of private user devices;   wherein each of said interface routers is configured to have at least one virtual routing table for each one of said plurality of optical network units to which said each of said interface routers is connected; and,   wherein each of said optical network units is adapted to extract data packets intended for a supported one of said devices.   
     
     
         7 . A digital data network communication method comprises:
 accepting a plurality of private data streams into a passive optical network interface router serving a plurality of private users through a plurality of optical network units;   aggregating said private data streams into a combined data feed;   routing said data feed to at least two of said plurality of optical network units;   extracting from said data feed a first one of said private data streams;   wherein said routing comprises:
 generating an independently unique virtual routing table for each of said plurality of optical network units; 
 tagging ethernet frames intended for a first one of said plurality of optical network units according to entries in a first one of said virtual routing tables associated with a first one of said optical network units; 
 distributing said tagged ethernet frames according to said first one of said virtual routing tables. 
   
     
     
         8 . The method of  claim 7 , wherein said distributing comprises associating destinations listed in said first one of said virtual routing tables with said first one of said optical network units. 
     
     
         9 . The method of  claim 7 , wherein each of said optical network units provides service to a separate number of private users. 
     
     
         10 . The method of  claim 7 , wherein said accepting comprises:
 interfacing a plurality of service provider data lines through a single headend.   
     
     
         11 . The method of  claim 10 , wherein said interfacing comprises:
 utilizing at least one premise router and a radio frequency video converter; and,   feeding an output of said at least one premise router through an optical line terminal.   
     
     
         12 . The method of  claim 11 , wherein said interfacing further comprises:
 feeding an output of said converter through said optical line terminal.   
     
     
         13 . The method of  claim 7 , wherein said aggregating comprises using an enterprise aggregating switch.