EP1476991A1

EP1476991A1 - Method for local protection of label-switching paths with resource-sharing

Info

Publication number: EP1476991A1
Application number: EP03727556A
Authority: EP
Inventors: Jean-Louis Le Roux; Géraldine Calvignac; Renaud Moignard
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2002-02-21
Filing date: 2003-02-20
Publication date: 2004-11-17
Also published as: FR2836313A1; US20050188100A1; WO2003071746A1; AU2003233843A1

Abstract

The invention relates to a method for protection of label-switching paths in an MPLS network, comprising several nodes connected by IP connections, each path passing through a given series of nodes and connections in said network called elements of said pathway. An element in a first pathway is protected by means of a pathway called the first pathway bypass, starting at a node in the first pathway upstream of said element for protection and terminating at a node of the first pathway downstream of said element for protection with a certain number of network resources being reserved for said first pathway bypass, the latter begin activated in the case of failure of said element in the first pathway. An element in the second pathway is protected by a pathway called the second pathway bypass, starting from a node in the second pathway upstream of said element and terminating at a node of the second pathway downstream of said element. The pathway of the bypass for the second pathway uses at least a part of the resources reserved for the pathway of the first pathway bypass.

Description

Method for local protection of label switched paths with resource sharing

The present invention relates to a method for protecting label switched paths in an MPLS (MultiProtocol Label Switching) network. More particularly, the present invention relates to a method of local protection of such paths with sharing of resources. The MPLS standard, published under the auspices of the IETF (Internet Engineering

Task Force) is a technique based on label switching to create a connection-oriented network from a datagram type network like the IP network. Detailed documentation of the MPLS protocol can be found at www.ietf.org. There is shown schematically in FIG. 1 an MPLS network, 100, comprising a plurality of routers called LSR (Label Switching Routers) such as 110, 111, 120, 121, 130, 131, 140, linked together by IP links. When an IP packet arrives at an input peripheral node 110, called Ingress LSR, the latter assigns a label (here 24) according to its IP header and concatenates it to said packet. The router that receives the tagged packet replaces the (incoming) tag

^ÏQ IE OF CONFIRMATION by an outgoing label according to its routing table (in the example in question, 24 is replaced by 13) and the process is repeated from node to node until the output router 140 (also called Egress LSR) which removes the label before sending the package. Alternatively, label removal can already be done by the penultimate router since the egress router does not use the incoming label.

As shown in Fig. 2, an LSR router uses the label of the incoming packet (incoming label) to determine the output port and the label of the outgoing packet (outgoing label). Thus, for example, router A replaces the labels of the IP packets arriving on port 3 and of value 16 with labels of value 28 and then sends the packets thus relabelled on port 2.

The path traveled by a packet through the network from the ingress router (Ingress LSR) to the egress router (Egress LSR) is called Label Switched Path (LSP). The LSR routers traversed by the path and distinct from the input and output routers are called transit routers. On the other hand, we call equivalence class or FEC (Forward Equivalence Class) the set of IP packets which are transmitted along the same path.

The MPLS protocol makes it possible to force IP packets to follow a pre-established LSP path which is generally not the optimal IP path in terms of number of hops or path metrics. The technique of determining the path or paths to

borrowing is called traffic engineering or MPLS-TE (for MPLS Traffic Engineering). The determination of the path takes into account constraints on the available resources (constraint based routing), in particular in bandwidth on the various links of the network. Unlike conventional IGP routing operating in a hop-by-hop routing mode, the determination of an LSP path is performed in a so-called explicit mode (explicitly routed LSP or ER-LSP) in which certain or all nodes in the path from the ingress router to the egress router. When all the nodes of the path are fixed, we speak of explicit routing in the strict sense. An explicitly determined path is also called an MPLS tunnel.

The determination of one or more MPLS tunnels can be done centrally or distributed. According to the distributed method also called Constraint based Routing, each router is informed about the network topology and the constraints affecting the different network links. To do this, each router determines transmits to its neighbors a message indicating its immediate links and the constraints (or attributes) associated therewith. These messages are then propagated from node to node by extended IGP messages, according to a flooding mechanism until all the routers are informed. Thus, each router has its own database (called TED for Traffic Engineering Database) giving it the network topology and its constraints.

The determination of the label switching path is then carried out by the ingress router (Ingress LSR) also taking into account other constraints set by the network operator (for example avoiding this or that node or avoiding links of this or that type). The entry router then determines, for example by means of the Dijkstra algorithm, the shortest path satisfying all the constraints (Constraint Shortest Path First or CSPF), those affecting the links as those fixed by the operator. This shortest path is then signaled to the nodes of the LSP path by means of the signaling protocols known by the abbreviations RSVP-TE (Resource reSerVation Protocol for Traffic Engineering) or CR-LDP (Constrained Route Label Distribution Protocol). A description of the RSVP-TE protocol can be found in the document by D. Adwuche et al. entitled "RSVP-TE: extensions to RSVP for LSP tunnels" available under the aforementioned 1TETF site. These MPLS signaling protocols allow the distribution of tags along the path and the reservation of resources.

For example, if the RSVP signaling protocol is used, the input router A transmits, as shown in Fig. 3A, a “Path” message in an IP packet to the output router F. This message specifies the list of nodes through which the LSP path must pass. At each node the message “Path” establishes the path and makes a reservation of state. When the "Path" message reaches the output router, an "Resv" acknowledgment message is sent back by the same path to the input router, as shown in Fig. 3B. At each node, the MPLS routing table is updated and the resource reservation is made. For example, if the resource is a bandwidth and we wish to reserve 10 units (MHz) for the path, the bandwidths respectively allocated to each link are decremented by the value reserved (10) during the backpropagation of the message d 'acquittal / reservation. It should be noted that the resource in question (e.g. bandwidth) is a logical resource on the IP link and not a physical resource. When the acknowledgment message is received by the ingress router, the tunnel is established.

As indicated above, the determination of the LSP paths can be carried out centrally. In this case, a server has knowledge of the network topology and takes into account the constraints on the links and the constraints set by the network operator to determine tunnels between the input routers and the output routers. The input routers are then notified by the server of the tunnel (s) for which they are the input node. The tunnels are then established as shown in Fig. 3A and 3B. The centralized determination method has the advantage of great stability and predictability since only one body performs the preliminary calculation of all the tunnels. In return, it has the drawback of not easily adapting to rapid variations in the network topology, for example in the event of a physical link breaking, deleting the IP links that it supports.

Whether they were calculated centrally or distributed, tunnels are liable to be destroyed in the event of an underlying physical link being cut. It is then necessary to provide backup mechanisms making it possible to establish a new tunnel between the same entry router and the same exit router. We can distinguish the restoration mechanisms establishing a backup tunnel after the cut and the protection mechanisms pre-establishing a backup tunnel in anticipation of a possible cut.

The advantage of the protection mechanisms is that it allows traffic to resume very quickly, as a backup tunnel is already available. In return, they have the disadvantage of mobilizing significant resources from the network. More specifically, the protection mechanisms known from the prior art are divided into local protection methods and end-to-end protection methods. In the former, local backup tunnels are pre-established in anticipation of a failure of an element (node, link) of the initial tunnel. When the failure occurs, traffic is diverted through the local tunnel to bypass the failing element. In end-to-end protection methods, a backup tunnel is established from the ingress router to the egress router. Unlike restoration methods (where backup tunnels are created on demand), protection methods (where backup tunnels are created beforehand) consume network resources.

The state of the art is known, in particular from the document entitled “Fast-Reroute Techniques in RSVP-TE” by P. Pan et al. available on the 1TETF website mentioned above under the reference “draft-pan-rsvp-fastreroute-00.txt”, different methods of local protection (or FRR for Fast ReRoute) of a tunnel. The general principle of this local protection is recalled in FIG. 4. For an element (link, node) of the tunnel to be protected, a local emergency tunnel is provided to bypass it. For example, to bypass the CD link, an emergency tunnel T (CD) is provided, with the path C, C ', E. The upstream router which detects and repairs the tunnel failure by directing the packets to the backup tunnel is called PLR point (for "Point of Local Repair"). The router downstream of the failure where the backup tunnel joins the initial tunnel is called point PM (for "Point of Merging"). In this case, router C detects the failure of the CD link (symbolized by a lightning bolt) by the absence of RSVP "Hello" messages transmitted at regular intervals on the CD link by router D or by an alert of the physical layer underlying. Router C then redirects traffic from the initial tunnel to the CC'E bypass tunnel. The junction between the initial tunnel and the bypass tunnel is carried out at E. A first method of local protection of LSP path, called “one-to-one”, consists in creating for each element of the path to protect a local backup tunnel , also called "detour". Illustrated in FIG. 5 a one-to-one type of local protection method. Each element K of the path is protected by a detour denoted T (K). Note that a detour T (N) for a node N also protects the upstream link and the link downstream of the node. If the path has n nodes, there can therefore be up to (n-1) detours. If several paths are to be protected in the MPLS network, a series of detours must be provided for each of them. This protection method is therefore not extensible (scalable).

It is important to note that the detours are created dynamically during the establishment of the path. In addition, the detours are created in a distributed manner by the transit routers of the path, on the initiative of the entry router. Thus in the event of a change in network topology or modification of resource constraints, the detours will not necessarily be the same for the same route. The detours creation procedure requires a modification of the RSVP signaling, as described in the above-mentioned document.

According to a second local LSP path protection method, called "many-to-one", an emergency tunnel, called bypass tunnel, is provided by the operator to protect one or more elements (node, link) of the MPLS network . Such a bypass tunnel can then be used to rescue a plurality of paths using said item (s). By way of example, there is illustrated in FIG. 6 two paths to protect T ^ ABCDE and T ₂ = A'BCDE sharing the path BCDE. In the present case, the operator has planned to protect node C by configuring a bypass tunnel with BB'D'D as its path. This bypass tunnel makes it possible to rescue the two paths T _t and T ₂ in the event of failure of the node C (or of one of the links BC, CD). In general, a bypass tunnel makes it possible to rescue a plurality of paths which intersect it upstream of the failure at a common point PLR and downstream of the failure at a common point PM. The bypass tunnel takes advantage of the possibility of stacking labels (label stacking) by assigning them different levels of hierarchy to redirect packets transparently. More specifically, as shown in FIG. 6, the routers along the path Tι switch the labels 12, 18, 45 and 37. When a failure of the node C occurs, the router B stacks a label (here 67) locally representing the bypass tunnel. At the penultimate node of the bypass tunnel (here D '), the label locally representing the bypass tunnel (here 38) is unstacked so that the point PM receives a label identical to that (45) of a packet which does not would not have been redirected.

It is important to note that the bypass tunnels are determined beforehand, statically and / or centralized by a server without a priori taking into account the resource requirements of future LSP paths to be established. In particular, the bandwidth of the bypass tunnel may not be sufficient to transport the required band of the path to be protected. Thus, although a bypass tunnel is present, it will not effectively rescue the path to be protected.

The problem underlying the invention is to propose a method of protecting LSP paths which consumes fewer resources than the protection methods known in the state of the art, while guaranteeing a high degree of scalability. and a good guarantee of efficiency.

The problem is solved by the object of the invention, defined as a method for protecting label switched paths in an MPLS network comprising a plurality of nodes connected by IP links, a path passing through a determined series of nodes. and links of said network, said elements of said path. An element of a first path having been protected using a path, called bypass of the first path, starting from a node of the first path upstream of said element to be protected and ending in a node of the first path in downstream of said element to be protected and a certain number of network resources having been reserved for said bypass path of the first path, the latter being active in the event of failure of said element of the first path, an element of a second path is protected by means of a path, called bypass of the second path, starting from a node of the second path upstream of this element and ending in a node of the second path downstream of this element, the bypass path of the second path using at least part of the resources reserved for the bypass path of the first path.

We can thus save network resources by sharing them between the first and second paths.

Advantageously, if the element to be protected in the second path is a link, said bypass path of said second path is selected from a plurality of candidate paths not including said link, the selection being made by testing whether each link in the candidate path has a risk of default independent of the risk of failure of said link to be protected.

To do this, a group of links of said network affected by the failure of said physical element is determined for each physical element of said network.

Conversely, for each link of said network, the list of said groups to which it belongs is determined.

To test whether a link in the candidate path presents a risk of failure independent of the risk of failure of said link to be protected, it is determined whether the lists of said groups, respectively associated with the link to be protected and the link in the candidate path are disjoint.

If the element to be protected of the second path is a node, said bypass path of said second path is selected from a plurality of candidate paths not including said node, the selection being made by testing whether each link of the candidate path presents a risk of failure independent of the risk of link failure, known as the upstream link, joining the node (PLR) upstream of said node to be protected and this latter node.

The characteristics of the invention mentioned above, as well as others, will appear more clearly on reading the following description of embodiments, said description being made in relation to the accompanying drawings, among which:

Fig. 1 illustrates an MPLS network known from the state of the art;

Fig. 2 schematically illustrates the creation of a switched label path; Fig. 3 A schematically illustrates a first phase of the procedure for establishing an LSP path;

Fig. 3B schematically illustrates a second phase of the procedure for establishing an LSP path; Fig. 4 schematically illustrates the principle of local repair of a path

LSP;

Fig. 5 schematically illustrates a distributed method of local protection of an LSP path, known from the state of the art;

Fig. 6 schematically illustrates a centralized method of local protection of an LSP path, known from the state of the art;

Fig. 7 illustrates the concept of shared risk entity;

Fig. 8 schematically illustrates a method of local protection of LSP paths according to the present invention.

The idea underlying the invention starts from the observation that a failure in a network generally affects only one physical element of the network at the same time.

The failure of a physical element leads to the failure of a certain number of IP links and / or network nodes. Thus, in the event of failure of a physical element, only certain paths will be affected. The basic idea of the invention is to share the protection resources making it possible to protect paths which are not affected at the same time by the failure of the same physical element. Thus, bypass tunnels protecting different paths can share protection resources and save network resources such as bandwidth. In addition, by properly dimensioning the shared resources, we will obtain a good guarantee that the paths to be protected are effectively backed up in the event of failure.

We will hereinafter refer to a shared risk entity or SRLG (for Shared Risk Link Group) associated with a link, all of the links in the network sharing the same physical resource with the aforementioned link and all affected by the failure of this physical resource. This concept of shared risk entity was introduced by K. Kompella et al. in a document entitled “Routing extensions in support of generalized MPLS” available on the 1TETF website under the reference “draft-ietf- ccamp-gmpls-routing-01.txt”. A link can belong to several SRLGs or belong to none. The SRLG list of a link is defined as the list of SRLGs in which this link appears. Two links present a diversity of SRLG if their lists SRLG have an empty intersection. In particular two links not belonging to any SRLG have a diversity of SRLG.

The list concept of SRLG will be better understood using the example in FIG. 7. It is assumed that three routers Ri, R, R ₃ are interconnected by means of optical mixers (OXC) O _1; O ₂ , O ₃ . These optical crossovers are interconnected by means of optical fibers f _1; f ₂ with WDM muliplexing. Let Si, S ₂ , be the SRLGs associated respectively with the fibers f _! and f ₂ . The link R _Î R ₂ uses the only light path O ^ O ₂ its list SRLG is {Si}. The link RιR ₃ uses the light path O ₁ -O ₂ -O ₃ , its SRLG list is therefore {Sι, S ₂ }. The link R ₂ R ₃ uses the light path O ₂ -O ₃ , its SRLG list therefore boils down to {S ₂ }. It can therefore be seen that the links R _t R ₂ and R ₂ R ₃ have a diversity of SRLG but that these do not have any with the link with the link R ₁ R ₃ .

A failure of SRLG is defined as the failure of the physical resource shared by the various elements of the SRLG. Thus, in the previous example, a failure of the SRLG S ₂ corresponds to a failure of the fiber f ₂ . A failure of SRLG can cause the failure of several links. Thus, in the previous example, failure of the SRLG S _{2 will} result in the failure of the links R _Î R ₃ and R ₂ R ₃ . In general, the failure of a given SRLG will result in the failure of the links whose SRLG lists contain it.

Conversely, a failure of SRLG can occur independently of the failure of a link. Thus, in the previous example, the failure of the link R ₂ O ₂ connecting R ₂ to O leads to a failure of the link R ₂ R ₃ but not of the SRLG S ₃ . In general, if a link does not belong to an SRLG, the failure of this link will not lead to that of the SRLG.

In the following, it will be assumed that the probability that the network will be affected by more than one node or link or SRLG failure is low.

There are two types of bypass tunnels: those which protect a link, also called NHOP bypass (for next-hop bypass) and those which protect a node orN HOP bypass (for next-next-hop bypass).

An NNHOP bypass tunnel begins at a PLR point and ends two hops downstream or even further. Of course, it must not use the node it protects or the link downstream from the PLR point. He must also present a diversity of SRLG with the latter. Note that an NNHOP bypass tunnel protects not only the node downstream from the PLR point but also the link downstream from the latter. We also define a risk of failure or FR (for Failure Risk) as a link, a node or a SRLG. Of course, for an SRLG, the real risk of failure concerns the underlying physical resource but, for the sake of simplification, the SRLG will be associated with the physical resource in question. In addition, we define the default risk group or TFRG (for Tunnel

Failure Risk Group) of a bypass tunnel B as all the risks of failure that this tunnel protects. Thus, the TFRG of an NHOP bypass tunnel is the assembly formed by the downstream link and the SRLG list of this link. Similarly, the TFRG of an NNHOP bypass tunnel is the assembly formed by the node it protects, the link connecting the PLR point to this node and the SRLG list of this link.

It will be assumed subsequently that a bypass tunnel protects a link or a node (that is to say is of the NHOP or NNHOP type). It will be said that two bypass tunnels present a diversity of FRG (Failure Risk Group) if:

- they do not protect the same link - they do not protect the same node

- the links they protect present a diversity of SRLG

As before, we define the failure risk group or LFRG (for Link Failure Risk Group) of a link as the set of failure risks that protect the bypass tunnels passing through this link. Finally, we define the protection bandwidth of a risk of failure Φ by a link L of a bypass tunnel protecting Φ (in other words whose TFRG contains Φ), and we denote it BP (Φ, L), the bandwidth reserved or to reserve on this link to protect Φ. It should be noted that bandwidth is understood here to mean logical bandwidth and not physical bandwidth. More specifically, the physical bandwidth of a physical resource may include a primary bandwidth dedicated to normal traffic and a secondary bandwidth dedicated to protection. The entire secondary protection bandwidth is not necessarily reserved and for a dom ed link L a distinction will be made between the current value actually reserved for protection rBP (L) and the maximum value that can be reserved RBP (L).

We now assume that several paths have been created in the MPLS network between input routers and output routers, in a centralized or distributed manner as we saw in the introductory part. We are looking to create tunnels of bypass which will protect the elements (node, link) of each of these paths. The operator may have specified, for some of these elements or for the entire path, that it will not be necessary to provide protection. Likewise, he may have specified that certain elements of the network will not be eligible for a path protection function. Taking into account these specifications, the method for determining the bypass tunnels operates as follows, successively for each of the paths to be protected and in a path, for each element to be protected:

(1) it is determined whether there is already a bypass tunnel from the PLR and, more generally, whether there are already bypass tunnels in the network, the elements of which can be partially or totally reused. This produces candidate bypass tunnels. Candidate bypass tunnels cannot use the element to be protected.

(2) in the case of a link to be protected, it is determined for each link in the candidate bypass tunnel, whether it has a diversity of SRLG with this link: if not, the candidate bypass tunnel is not compatible with risk term and cannot be retained;

(3) in the case of a node to be protected, it is determined for each link of the candidate bypass tunnel, whether it has a diversity of SRLG with the link joining the PLR and the node to be protected: in the negative the tunnel of bypass is not compatible in terms of risk and cannot be retained;

(4) in the affirmative, on the other hand, we simulate a protection of the element considered by the candidate bypass tunnel and we calculate for each link of the tunnel the new bandwidth to be reserved, ie rBP (L) = max (BP (Φ, L)) where Φ e LFRG (L);

(5) one tests if the condition rBP (L) <RBP (L) is verified for all the links of the candidate bypass tunnel, if not the tunnel is not retained;

(6) the procedure is repeated for all candidate bypass tunnels.

An example will provide a better understanding of the implementation of the method for determining bypass tunnels. Consider the MPLS network in Fig. 8 and suppose that a first path LSPi≈AJBCD of bandwidth 10 units has been established in the network. It is also assumed that all IP links have a low traffic band of 10 units, a protection bandwidth of 10 units except the FG link which has a protective bandwidth of 20 units. The operator's specifications indicate that only the link BC and the node C need to be rescued. These two elements are respectively protected by a first NHOP Bi bypass tunnel and a second NNHOP B ₂ bypass tunnel, each having a bandwidth of 10 units. We assume that the SRLG list of the link BC is {Si, S ₂ } and that of the link FG is {S ₃ } with distinct Si, S ₂ , S ₃ .

Suppose now that we need to protect a second path LSP ₂ = IJKL with bandwidth 10 units. The specifications indicate that only the JK link and the J and K nodes need to be rescued. No bypass tunnel is available from I and J. We consider the candidate bypass tunnel Bs≈JFGK reusing the link

FG of B _L

JK link

Suppose that the link JK has for list SRLG = {S ₃ , S} with S distinct from Si, S ₂ ,

S ₃ . In this case, the JFGK candidate bypass tunnel cannot be selected because the FG link does not have any diversity of SRLG with the JK link. Another bypass tunnel should then be sought.

Suppose now that the JK link has the list SRLG = {S ₂ }. We successively test whether the links JF, FG and GK have a diversity of SRLG with {S ₂ }. If so, the JFGK tunnel can be selected. To be definitive, the JFGK bypass tunnel must offer sufficient bandwidth to rescue traffic on the JK link.

We simulate the protection of JK by the candidate bypass tunnel B ₃ . We obtain :

LFRG (JF) = {JK} and rBP (JF) = 10 BP (JK, JF) = 10

LFRG (GK) = {JK} and rBP (GK) = 10 BP (JK, GK) = 10

LFRG (FG) = {BC, C, JK, Si, S ₂ }

BP (BC, FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20

BP (JK, FG) = bandwidth (B ₃ ) = 10 BP (C, FG) = bandwidth (B ₂ ) = 10

BP (Sι, FG) = bandwidth (B.) + bandwidth (B ₂ ) = 20

BP (S ₂ , FG) = bandwidth (Bι) + bandwidth (B ₂ ) + bandwidth (B ₃ ) = 30

We note that this last case corresponds to a failure of the underlying physical resource of S ₂ . In this case, the links BC and JK are simultaneously faulty and the bypass tunnels Bi, B ₂ , B ₃ are all activated. In other words, the tunnels Bi, B ₂ , B ₃ do not have any diversity of FRG.

rBP (FG) = max (BP (Φ, FG)) where Φ e LFRG (FG) i.e., rBP (FG) = 30> RBP (FG). The tunnel B ₃ cannot be retained.

Suppose now that the JK link has the list SRLG = {S}. We test as before if the links JF, FG and GK have a diversity of SRLG with {S ₄ }. If so, in order for the JFGK tunnel to be definitively retained, the JFGK bypass tunnel must provide sufficient bandwidth to rescue traffic on the JK link.

The calculation of BP (JK, JF) and BP (JK, GK) is identical to that above. However for the FG link:

LFRG (FG) = {BC, C, JK, Si, S ₂ , S ₄ }

BP (BC, FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20

BP (JK, FG) = bandwidth (B ₃ ) = 10

BP (C, FG) = bandwidth (B ₂ ) = 10 BP (S i, FG) = bandwidth (B i) + bandwidth (B ₂ ) = 20

BP (S ₂ , FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20

BP (S ₄ , FG) = bandwidth (B ₃ ) = 10 i.e., rBP (FG) = 20. Since rBP (FG) ≤RBP (FG) the tunnel B ₃ is retained.

Here the protective band to reserve is weaker because the JK and BC links present a diversity of SRLG. We will keep this hypothesis in the following.

node J: Path B = IEFGK is a candidate bypass tunnel that presents a diversity of SRLGs with the IJ link. We obtain :

LFRG (IE) = {J} and BP (J, IE) = 10

LFRG (EF) = {J} and BP (J, EF) = 10

LFRG (GK) = {J} and BP (J, GK) = 10

LFRG (FG) = {BC, C, JK, J, Si, S ₂ , S ₄ }

BP (BC, FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20

BP (C, FG) = bandwidth (B ₂ ) = 10

BP (JK, FG) = bandwidth (B ₃ ) = 10

BP (J, FG) = bandwidth (B ₄ ) = 10 BP (Sι, FG) = bandwidth (Bi) + bandwidth (B ₂ ) = 20

BP (S ₂ , FG) = bandwidth (B + bandwidth (B ₂ ) = 20

BP (S ₄ , FG) = bandwidth (B ₃ ) = 10

hence rBP (FG) = 20. Tunnel B ₄ is selected since rBP (FG) ≤RBP (FG). It will be noted that B ₄ also makes it possible to protect the link IJ without additional reservation of bandwidth on the link FG.

node K:

The path B ₅ = JFGHL is a candidate bypass tunnel which presents a diversity of SRLG with the JK link. We obtain :

LFRG (JF) = {K} and BP (K, JF) = 10 LFRG (GH) = {K} and BP (K, GH) = 10

LFRG (HL) = {K} and BP (K, HL) = 10

LFRG (FG) = {BC, C, JK, J, K, SS ₂ , S ₄ }

BP (BC, FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20 BP (C, FG) = bandwidth (B ₂ ) = 10 BP (JK, FG) = bandwidth (B ₃ ) = 10 BP (J, FG) = bandwidth (B ₄ ) = 10 BP (K, FG ) = bandwidth (B ₅ ) = 10 BP (Sι, FG) = bandwidth (Bi) + bandwidth (B ₂ ) = 20 BP (S ₂ , FG) = bandwidth (Bι) + bandwidth (B ₂ ) = 20 BP (S ₄ , FG) = bandwidth (B ₃ ) = 10

hence, here too, rBP (FG) = 20. Tunnel B ₅ is selected since rBP (FG) ≤RBP (FG). It will be noted that B ₅ also makes it possible to protect the link KL without additional reservation of bandwidth on the link FG.

According to a first embodiment, the bypass tunnels are created centrally by a specialized server. This has the network topology and knows the bandwidths reserved for traffic and for protection on each of the network links. It also takes into account the operator's specifications for elements that are not susceptible to protection and / or those that cannot be used for protection.

According to a second embodiment, of the distributed type, when a path is established through the network, the input router can specify that the path in question must be the object of protection. To do this, provision is made for an extension of the IGP protocol (or ISIS or OSPF protocols which are already extended IGP protocols for traffic engineering) allowing, according to a flooding mechanism, to inform each node not only on the network topology and on the tunnels created, as in the prior art, but also on the bypass tunnels already created and the respective elements protected by these tunnels. The local database (TED) of each node thus contains information indicating the bypass tunnels created with their characteristics (NHOP, NNHOP, path, bandwidth, for example) as well as the elements they protect. When a bypass tunnel is created or destroyed, the nodes of the network are informed of it by means of creation / destruction messages making it possible to update their respective databases.

Protection is requested by the input router by means of the “Path” message of the RSVP-TE protocol, mentioned in the introductory part. More specifically, this router incorporates the following information into the “session attribute” or SAO (for Session_Attribute Object) object:

- an LPD (Local Protection Desired) bit indicating to each transit router that local protection of the path is required; - an NPD (Node Protection Desired) bit indicating to each transit router that an NNHOP type bypass tunnel is required. Conversely, an NHOP type bypass tunnel is used;

- a BPD (Bandwidth Protection Desired) bit indicating to each router that bandwidth protection is required, that is to say that the bypass tunnel must offer a bandwidth at least equal to that of the path to be protected.

When a transit router R on the path in question receives a “Path” message from the RSVP-TE protocol, it firstly searches whether protection is required and what its type is (NHOP, NNHOP). Depending on the case, the protection concerns either the link or the node, downstream from the router on the way. Router R then searches in its local database if there is already at least one bypass tunnel passing through R. If not, it searches if it can build a bypass tunnel using partially or entirely elements of existing bypass tunnels. The router thus obtains a certain number of candidate bypass tunnels which are subject to the selection steps (2) to (5) indicated above. If one of the candidates is selected, the router, after having received the RSVP protocol “RESV” message, effectively creates the bypass tunnel and allocates the necessary bandwidth to it. For each link L constituting the bypass tunnel, a bandwidth reservation is made rBP (L) = max (BP (Φ, L)) where Φ s LFRG (L). If the transit router cannot establish a bypass tunnel, for example due to insufficient bandwidth, it notifies the ingress router.

It is clear to those skilled in the art that the protection request and the reservation acknowledgment can also be transmitted by means of the CR-LDP protocol in place of the RSVP-TE protocol.

Claims

CLAIMS 1) Method for protecting label switched paths in an MPLS network comprising a plurality of nodes connected by IP links, a path passing through a determined series of nodes and links of said network, so-called elements of said path, an element a path which can be protected by means of at least one bypass tunnel of said path, starting from a node of said path upstream of said element to be protected and ending in a node of said path downstream of said element to be protected, characterized. in that, for a path element to be protected from failure,

for each physical element of said network, a group (SRLG) of links from said network is determined which have been affected by the failure of said physical element, then for each link of said network, the list of said groups to which it belongs is determined, and

a bypass tunnel, called candidate bypass tunnel, is selected from among a set of bypass tunnels capable of protecting said path element to be protected,

- it is determined whether the lists of said groups, respectively associated with the link constituting said element to be protected or with the link upstream of said element to be protected and with each link in the candidate tunnel are disjoined in order to test whether each link in the candidate bypass tunnel presents a risk failure independent of the risk of failure of said link to be protected or said upstream link,

if this is not the case, said bypass tunnel is refused and another candidate bypass tunnel is selected from among all those which are capable of protecting said path element and the preceding steps are repeated,

- but if this is the case, it is tested whether the bandwidth to reserve on each link of said candidate bypass tunnel to support said bypass tunnel or all of said bypass paths passing through said link is less than or equal to the maximum bandwidth of said link reserved for protection and

- if this is the case, said bypass tunnel is retained while it is refused otherwise. 2) Protection method according to claim 1, characterized in that the element to be protected from failure being a link, it is determined whether each of said links constituting said candidate bypass tunnel presents a risk of failure independent of the risk of failure of said link. 3) Protection method according to claim 1, characterized in that the element to be protected from a failure being a node, it is determined whether each of said links constituting said candidate bypass tunnel presents a risk of failure independent of the risk of failure of the link, said upstream link, joining the upstream node of said node to be protected and this latter node.

4) Protection method according to one of the preceding claims, characterized in that the maximum bandwidth of a link reserved for protection is the maximum sum of all the bandwidths of the bypass tunnels passing through this link and simultaneously active. 5) Protection method according to one of the preceding claims, characterized in that said bypass tunnels are determined centrally by a server.

6) Protection method according to one of claims 1 to 4, characterized in that a bypass tunnel of an element of a path to be protected is determined by a node upstream of said element on the latter path.