WO2007124679A1

WO2007124679A1 - Method and system of network communication

Info

Publication number: WO2007124679A1
Application number: PCT/CN2007/001314
Authority: WO
Inventors: Zhenting Yang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-04-29
Filing date: 2007-04-20
Publication date: 2007-11-08
Also published as: CN101047631A

Abstract

This invention discloses a method and system of network communication, and the method includes the following steps: access node adds Ethernet frame header for subscriber uplink message; then uplink message is transmitted to the Ethernet; said uplink message is transmitted in said Ethernet according to said added Ethernet frame header;access sink node removes Ethernet frame header of said Ethernet uplink message and transmits said uplink message to another network.. This invention also discloses that a method of subscriber access information provided. This invention can be used to resolve the security problem of MAC address from Ethernet to sink network.

Description

The present invention claims to be submitted to the Chinese Patent Office on April 29, 2006, and the application number is 200610078654.1. The invention titled "user location information transmission method, MAC address automatic allocation method, network establishment method and system" Chinese patent Priority of the application, the entire contents of which are incorporated herein by reference.

Technical field

The present invention relates to the field of communications, and in particular, to a user access information providing method, a network communication method, a system, and a node device.

Background technique

In the current metropolitan area network and access aggregation network, Ethernet has become one of the most popular solutions due to its low cost, easy deployment and good scalability. In fact, more than 4 operators currently implement Ethernet services on the metro network. However, the large-scale deployment of Ethernet technology in metropolitan area networks and access aggregation networks is bound to face and solve many difficult problems, such as breaking the limit of 4096 VLANs (Virtual LANs), transparent LAN (Local Area Network, LAN) Network security issues such as service connection, quality of service guarantee, MAC address spoofing, DOS attack, etc. There are three "service transparent transmission" technical principles and service modes in Ethernet, namely IEEE 802.1Q VLAN Q-in-Q VLAN (Stack VLAN, VLA stack) and MAC stack technology.

801. lah, the Mac-in-Mac standard, defines the format standard for the two-layer MAC stack, and encapsulates the carrier's Ethernet frame header in addition to the user data frame, since Mac-in-Mac completely shields the user. Side information (such as MAC address, user VLAN, and generation t) implements transparent transmission of user data, improves operator network scalability and network security, and enhances service scalability. Mac-in-Mac uses Layer 2 technology, without complex signaling mechanisms, and low equipment costs, network construction, and operation and maintenance costs. It can be seen that Mac-in-Mac technology provides MAC address isolation for user networks and carrier networks, seamless transparent transmission of user network control protocols, easy differentiation of service quality, and good network deployment scalability. Ethernet-based Mac- The in-Mac technology will be an effective solution to the problem of access aggregation networks.

The format of the Mac-in-Mac frame specified by IEEE 802.1ah is shown in Table 1 below:

The meaning of each field is as follows: P-MAC DA/SA: Provider Destination/Source MAC Address, carrier destination/source MAC address;

P-TAG: Provider Tag, carrier label;

P-ServiceLabel: Provider service label, carrier monthly service label;

Among them, P-MAC DA, P-MAC SA, P-TAG, and P-ServiceLabel form a layer of carrier Ethernet frame header, that is, carrier network identifier, P-MAC DA and P-MAC SA are mandatory fields, P -TAG and P-ServiceLabd are optional fields.

The Mac-in-Mac specified by IEEE 802.1ah defines the network boundary node, and the network border node performs the addition and removal of the MAC stack address. The IEEE 802.1ah has great flexibility to implement a hierarchical network.

Customer Ethernet Frame: User Ethernet frame, such as Ethernet frame in 801.1Q format, Ethernet frame in 802.3 format, etc.

The 801.1Q format is shown in Table 2 below:

Table 2:

The meaning of each field is as follows:

C-MAC DA/SA: Customer Destination/Source MAC Address, User Ethernet 艮文源/Source MAC address;

C-TAG: Customer Tag, user Ethernet 艮 label;

Among them, C-MAC DA, C-MAC SA and C-TAG constitute the user Ethernet frame header, C-MAC DA and C-MAC SA are mandatory fields, and C-TAG is optional field.

Although the IEEE 802.1ah standard defines the system framework of Mac-in-Mac, it does not provide a solution for how to establish a Layer 2 connection channel inside the carrier network, especially the simple solution for establishing a connection channel for accessing the aggregation network application Mac-in-Mac. .

At present, the IP DSLAM (Digital Subscriber Line Access Multiplexer) has become the mainstream device for broadband access. Since the IP DSLAM uses Ethernet technology as the uplink interface transmission technology, the user PVC (Permanent Virtual Circuit) Access information such as ) and / or port can only be provided by the Ethernet VLAN ID (VLA identifier), and the range of VLAN ID is only 4096 in the IEEE protocol, so in more than 4 cases, the authentication is set. The device can only obtain the fuzzy VLAN ID (the VLAN ID shared by multiple users). The loss of user access information will bring many security problems to the operating broadband telecommunication network. The provision of user access information is already the development of IP DSLAM. One of the urgent problems to be solved.

In the case of IP DSLAM application, a user access information solution based on DHCP Option 82 (Dynamic Host Configuration Protocol 82) and PPPoE+ (Point to Point Protocol over Ethernet) is proposed. DHCP Option 82 and PPPoE+ can only be used in a unique scenario, that is, users can provide user access information when they use DHCP or PPPoE. They cannot provide a solution that adapts to various scenarios, and user location and location based on DHCP Option 82 and PPPoE+. The location provided by the delivery solution is one-off and does not provide user access information at runtime.

Summary of the invention

The embodiment of the invention provides a network communication method and system, which provides an easy deployment solution for the MAC stack application, and implements MAC address isolation between the user network and the operator network through the MAC technology, and solves the MAC address of the Ethernet access network. Security issue.

The embodiment of the invention further provides a method for providing user access information, which provides user access information during operation, which facilitates management of the user by the authentication device.

The embodiment of the present invention further provides an access node and a sink node, which implement MAC address isolation between the user network and the carrier network through the MAC technology, and solve the security problem of the MAC address of the Ethernet access network.

A network communication method provided by an embodiment of the present invention includes:

The access node receives the uplink packet from the user, and adds the carrier Ethernet frame header to send the uplink packet;

Transmitting the uplink packet in an Ethernet according to the carrier Ethernet frame header;

The access aggregation node receives the uplink packet, removes the carrier Ethernet frame header in the uplink packet, and transmits the uplink packet to another network.

Since the carrier Ethernet frame header is added in the uplink node at the access node, the carrier Ethernet frame header is deleted at the access aggregation node, thereby establishing between the Ethernet access node and the access aggregation node. A secure transmission channel, that is, a MAC stack tunnel, implements MAC address isolation between the user network and the carrier network, so that the carrier network does not need to perceive the user's MAC address, effectively solving the problem. MAC address spoofing, DOS (Denial of Service) attacks and other related security issues. A method for providing user access information provided by the embodiment of the present invention includes:

Converting user access information into an information code of a predetermined format;

Transmitting the information as a corresponding field of the packet header into the packet from the user; forwarding the packet.

Since the Ethernet frame header including the user access information is added to the uplink packet at the access node, the Ethernet frame header including the user access information is analyzed at the access aggregation node to obtain the user access information, thereby simplifying The way to solve the problem of user access information provision. Since each uplink packet contains user access information, user access information can be provided in various scenarios.

A network communication system provided by an embodiment of the present invention includes: an access node and an access aggregation node connected through an Ethernet;

The access node is configured to receive an uplink message from the user, add a carrier Ethernet frame header to the received uplink message, and then send the uplink message to the Ethernet;

The access aggregation node is configured to remove the operator Ethernet frame header in the uplink message from the Ethernet, and transmit the uplink message to another network.

The network communication system in the embodiment of the present invention adopts an operator Ethernet frame header in an uplink packet at an access node, and an operator Ethernet frame header is deleted at an access aggregation node, thereby being in an Ethernet access node and A secure transmission channel, that is, a MAC stack tunnel, is established between the access aggregation nodes to implement MAC address isolation between the user network and the carrier network, so that the carrier network does not need to perceive the user's MAC address, thereby effectively solving the Ethernet access. Network related MAC address spoofing, DOS (Denial of Service) attacks and other related security issues.

An access node provided by the embodiment of the present invention includes:

a receiving unit, configured to receive an uplink message from the user and a downlink message from the Ethernet network, where the sending unit is configured to send the uplink message to the Ethernet, and send the downlink message to the user ;

An Ethernet frame header adding unit is configured to add an operator Ethernet frame header to the uplink message received by the receiving unit.

A convergence node provided by the embodiment of the present invention includes:

a receiving unit, configured to receive an uplink packet from the local Ethernet network to which the access aggregation node belongs Downlink messages from other Ethernet networks;

a sending unit, configured to send the uplink packet to the other Ethernet, and send the downlink packet to the local Ethernet;

An Ethernet frame header adding unit is configured to add an operator Ethernet frame header and/or a user Ethernet frame header to the downlink packets of the other Ethernet.

The access node and the access aggregation node provided by the embodiment of the present invention implement MAC address isolation between the user network and the operator network through the MAC technology, and solve the security problem of the MAC address of the Ethernet access network.

DRAWINGS

The drawings are intended to provide a further understanding of the present invention, and are intended to be illustrative of the invention, and are not intended to limit the invention. In the drawing:

1 is a flowchart of a network communication method according to an embodiment of the present invention;

2 is a schematic diagram showing the implementation of a network communication method according to an embodiment of the present invention;

3A is a schematic diagram of networking of a network communication system, a user equipment, and other networks according to an embodiment of the present invention;

3B is a logic block diagram of a network communication system according to an embodiment of the present invention;

4 is a flowchart of an automatic allocation process of a source MAC address of an operator in an embodiment of the present invention; FIG. 5 is a schematic block diagram of an access node according to an embodiment of the present invention;

6 is a flowchart of an access node processing an uplink packet in an embodiment of the present invention;

7 is a flowchart of processing, by an access node, a downlink packet according to an embodiment of the present invention;

8 is a schematic block diagram of an access aggregation node according to an embodiment of the present invention;

FIG. 9 is a flowchart of processing an uplink packet by an access aggregation node according to an embodiment of the present invention;

10 is a flowchart of processing a downlink packet by an access aggregation node according to an embodiment of the present invention;

FIG. 11 is a flowchart of an embodiment of a method for providing user access information according to an embodiment of the present invention. detailed description

Embodiments of the present invention will be described in detail below.

1 is a flow chart of a network communication method according to an embodiment of the present invention. The method includes the following steps: 101. An access node receives an uplink message from a user. 102. The access node automatically adds a carrier Ethernet frame header to the received uplink packet, and then sends an uplink packet.

The access node generates a first field of the carrier Ethernet frame header according to the access information of the user, and generates a second field of the carrier Ethernet frame header by using the uplink forwarding parameter table.

The user's access information may be user location information and/or user identity, and may be other information that uniquely identifies the user. The user location information includes at least one of the following: an identifier of the access node, a slot number of the user access board, a port number accessed by the user, and a logical link number accessed by the user; the user identifier includes at least one of the following: The IP address of the incoming user, the MAC address of the access user, the partial field of the EP address of the access user, the partial field of the MAC address of the access user, the user account of the access user, and a specified value of the access user. .

The access node generates the code of the first field of the carrier Ethernet frame header according to the access information of the user, including the carrier source MAC address of the uplink packet; the access node generates the carrier Ethernet by searching or adapting the uplink forwarding parameter table. The encoding of the second field of the frame header includes the carrier's destination MAC address of the uplink packet; where, the uplink is the direction that the user sends to the access node.

103. According to the carrier Ethernet frame header, the uplink is transmitted in the Ethernet.

104. The access aggregation node removes the carrier Ethernet frame header in the uplink packet from the Ethernet, and transmits the uplink packet to another network, such as an IP network, an Ethernet, or the like.

If the uplink packet needs to be transmitted in the IP network, the access aggregation node also needs to remove the user Ethernet frame header from the uplink of the Ethernet.

If the access aggregation node needs user access information, the user access information may be obtained by parsing the code of the first field of the carrier Ethernet frame header.

In the above network communication method, the following steps may be further included:

105, a downlink from the access aggregation node in another network ^{^:} Gen increase Carrier Ethernet packet header and / or user Ethernet header.

106, according to the carrier Ethernet frame header in the Ethernet transmission downlink ^ = 艮 text.

107. The access node removes the carrier Ethernet frame header in the downlink from the Ethernet network, and transmits the downlink ^=艮 message to the user.

In the above network communication method, the Ethernet frame header includes: a destination MAC address and a source MAC address, and may further include: a VLAN tag and/or a type and/or a Service Label. The access node is a broadband access device in a broadband network.

In the above network communication method, the access node transmits the downlink message to the user by checking the access node downlink forwarding parameter table. The access node adds a corresponding field of the carrier Ethernet frame header to the uplink message from the user by checking the access node uplink forwarding parameter table. The corresponding field includes the ViAC address of the upstream message carrier. The access node uplink forwarding parameter table is a forwarding parameter table that includes an operator destination MAC address of the uplink packet and a user correspondence relationship. The access node converts the access information of the access user into the same encoding as the MAC address encoding format; the access node automatically uses the above-mentioned encoding including the access user access information as the carrier source MAC of the MAC address stack application.

The carrier's destination MAC address of the uplink packet may be configured at the access node according to at least one of the following rules:

(1) Configure the destination MAC address of the carrier of the uplink packet for the access node, and all users share the destination MAC address of the carrier of the uplink packet;

(2) Configuring the carrier's destination MAC address for the uplink packet for each port of the access node, and all the packet services in the port share the carrier's destination MAC address of the uplink packet;

(3) The carrier's destination MAC address of the uplink packet is configured for the logical link of each port of the access node, and all the packet services on the logical link of the port share the carrier's destination MAC address of the uplink packet.

The destination MAC address of the carrier that configures the upstream packet is the uplink forwarding parameter table of the carrier's destination MAC address to the access node.

The access node uplink forwarding parameter table may be configured at the access node by using at least one of the following rules, where the access node uplink forwarding parameter table is used to establish a mapping between the carrier's destination MAC address of the uplink packet and the user of the uplink packet. Relationship:

(1) Configuring at least one access node uplink forwarding parameter table for the access node, and all users sharing at least one access node uplink forwarding parameter table;

(2) Configuring at least one access node uplink forwarding parameter table for each port of the access node, and all packet services in the port share at least one access node uplink forwarding parameter table;

(3) Configuring at least one access node uplink forwarding parameter table for the logical link of each port of the access node, and all packet services on the logical link of the port share at least one access node uplink forwarding parameter table. In the above network communication method, the method further includes the following steps: The access node generates an access node uplink forwarding parameter table according to the carrier destination MAC address of the uplink message of the user and the user destination MAC address of the uplink message. The downlink direction refers to the direction of the packet sent from the access node to the user or the direction of the packet sent by the access aggregation node to the user.

In the foregoing network communication method, if the carrier's destination MAC address of the uplink packet and the user destination MAC address of the uplink packet already exist and are consistent in the uplink forwarding parameter table of the access node, the operator that refreshes the uplink packet The destination MAC address of the destination MAC address and the uplink destination packet of the uplink packet in the upstream forwarding parameter list of the access node; if the destination MAC address of the upstream packet and the destination destination MAC address of the uplink packet are forwarded by the access node If the parameter table already exists but is inconsistent, the access node uplink forwarding parameter table is updated; and if the destination MAC address of the uplink message and the user destination MAC address of the uplink message do not exist in the uplink forwarding parameter table of the access node, Then, in the access node uplink forwarding parameter table, a mapping item of the carrier's destination MAC address of the uplink packet and the user destination MAC address of the uplink text is added.

In the above network communication method, the access node actively maintains an aging mechanism of the uplink forwarding parameter table of the access node. If the access node uplink forwarding parameter table entry of the carrier's destination MAC address of the uplink packet and the user destination MAC address of the uplink packet is not updated or refreshed within the specified period, the access node forwards the parameter from the access node. In the table, the carrier's destination MAC address of the upstream packet and the destination destination MAC address of the uplink text are deleted.

The access node can manage and maintain the user MAC address of the user in at least one of the following ways: The user MAC address is configured on the access node; the access node learns the user's MAC address according to the uplink information of the user, and dynamically learns the user MAC address. The user MAC address is maintained and managed by the aging mechanism. The user MAC address is the user source MAC address of the uplink packet. The user MAC address exists in the downlink forwarding parameter table of the access node.

In the above network communication method, the processing procedure of the access node processing the uplink packet is as follows: The access node receives the uplink packet from the user; the access node generates the carrier source of the uplink packet according to the source MAC address generation rule of the operator. The MAC address is obtained by the access node to find the uplink forwarding parameter table of the access node to obtain the destination MAC address of the carrier of the uplink packet. If the destination MAC address of the carrier of the uplink packet is not found, the packet is processed according to the configuration policy, where the configuration policy includes At least one of the following: discards the packet, the carrier MAC address of the default upstream packet is the broadcast address of all Fs, and the default The destination MAC address of the carrier of the uplink packet is the specified default MAC address; the access node obtains the carrier label of the carrier tunnel header in the uplink direction; and the access node increases the carrier Ethernet according to the carrier Ethernet frame header forwarding. Ethernet header of the frame header.

In the above network communication method, the processing procedure of the access node processing the downlink packet is as follows: The access node receives the packet with the carrier Ethernet frame header sent from the upper layer device to the user; the access node removes the packet. The carrier Ethernet frame header; the access node searches the access node downlink forwarding parameter table according to the destination MAC address of the packet to obtain the port link or logical link where the user is located, and then sends the packet to the user.

In the foregoing network communication method, the access aggregation node processes the downlink packet by using the user access address table, where the user access address table includes the source MAC address of the carrier of the uplink packet and the source MAC address of the user of the uplink packet. Correspondence between the source MAC address of the carrier or the source MAC address of the uplink packet and the IP address of the user. The user access address table is in the form of static configuration or dynamic learning.

In the foregoing network communication method, if the established user access address table is in a dynamic learning form, the access aggregation node can obtain the user's IP address or the user source MAC address of the uplink packet by using an address resolution protocol (ARP) packet. Carrier source MAC address of the address or uplink packet. The source MAC address of the carrier of the uplink packet is obtained from the carrier source MAC of the uplink packet of the operator of the Ethernet frame header of the Ethernet frame header of the address resolution protocol packet.

In the above network communication method, the access aggregation node can manage the source MAC address of the carrier of the uplink packet in the following manner: Configuration mode, configuring the source MAC address of the carrier of the uplink packet to the designation of the access aggregation node On the link, the downlink source packet is forwarded by the source MAC address of the upstream packet. In the dynamic learning mode, the access aggregation node learns the source MAC address of the uplink packet according to the uplink user packet, and learns the uplink. The source MAC address of the carrier is used as the basis for forwarding the downlink packets of the user. The source MAC address of the carrier of the uplink packet is the destination MAC address of the carrier of the downlink packet.

In the above network communication method, the step of the access aggregation node processing the uplink Ethernet packet includes removing the Ethernet frame header in the uplink. The access aggregation node processes the downlink packet by using the following process: the downlink packet is a packet from the access aggregation node to the user: the access aggregation node receives the IP packet or the Ethernet packet sent to the user; Destination IP or user MAC address to find the user access location The address table obtains the destination MAC address of the carrier of the downlink packet and/or the destination destination MAC address of the downlink packet; adds the Ethernet frame header of the user and/or the Ethernet frame header of the operator in the downlink message; The user's Ethernet frame header and the carrier's Ethernet frame header.

2 is a schematic diagram showing the implementation of a network communication method according to an embodiment of the present invention. In the figure, the transmission path from an access node (AN) to an access aggregation node (such as an IP Edge node, an IP edge node) is called an access aggregation network.

The process of processing the uplink packet in the access aggregation network is as follows: the user terminal sends an uplink packet to the access node, and adds a carrier Ethernet frame header to the uplink packet by using a policy such as a table lookup at the access node, for example, , P-MAC DA and P-MAC SA, etc. The uplink packet of the carrier Ethernet frame header is transmitted in the Ethernet network by means of the carrier Ethernet frame header. When the uplink packet arrives at the access aggregation node, the access aggregation node terminates the Ethernet packet and simultaneously accesses the packet. The aggregation node can obtain user access information from the Ethernet frame header and then transmit the message to an IP network or other network, such as an Ethernet or VPN (Virtual Private Network).

The process of processing the downlink packet in the access aggregation network is as follows: The IP edge node receives the downlink packet sent to the user from the IP network, and adds the Ethernet frame header of the user to the downlink packet by checking the user access address table. / or the carrier's Ethernet frame header, and then the downlink ^ ¹艮 text is transmitted to the access aggregation network. The downlink packet of the carrier Ethernet frame header is transmitted in the Ethernet network by means of the carrier Ethernet frame header. After the downlink packet arrives at the access node, the access node removes the carrier Ethernet frame header and then passes Check the downlink forwarding parameter table and other policies to send downlink packets to the user. Through the above process, the establishment of a Layer 2 network connection channel is realized.

FIG. 3A is a schematic diagram of networking of a network communication system, a user equipment, and other networks according to an embodiment of the present invention:

As shown in the figure, the user equipment 21 accesses the Ethernet 301 through the access node 302 in the network communication system 30 of the embodiment of the present invention, and adds the uplink packet sent by the user to the carrier Ethernet frame header in the access node 302. Then, the uplink packet with the carrier Ethernet frame header is transmitted to the access aggregation node 303 in the network communication system 30 of the embodiment of the present invention through the Ethernet 301, and the access aggregation node 303 removes the Ethernet from the aggregation node 303. The carrier Ethernet frame header in the uplink packet can also obtain user access information from the carrier Ethernet frame header in the uplink packet, and transmit the uplink packet to the other network 22. The other network 22 may be an Ethernet network of another carrier or an IP network. If it is IP For the network, the access aggregation node 303 also needs to remove the user Ethernet frame header from the uplink temple of the Ethernet.

In the network communication system, after the access aggregation node 303 receives the downlink packet from the other network 22, the carrier Ethernet frame header is added to the downlink information, or the carrier Ethernet frame header is added at the same time. The user Ethernet frame header is then transmitted to the access node 302 via the Ethernet 301; the access node removes the carrier Ethernet frame header in the downlink message from the Ethernet network, and transmits the downlink message header. User equipment 21.

In the above network communication system, the access node is a broadband access device in the broadband network.

Figure 3B shows a logical block diagram of a network communication system in accordance with an embodiment of the present invention:

In this embodiment, the access node 302 includes: a mapping module 321, a carrier Ethernet frame header generating module 322, and an uplink packet encapsulating module 323. The mapping module 321 is configured to store an access node uplink forwarding parameter table. The carrier Ethernet frame header generating module 322 is configured to generate a carrier Ethernet frame header, including generating an operator Ethernet frame according to the user access information. The carrier source MAC address field in the header, and generates an operator destination MAC address field in the carrier Ethernet frame header by looking up the access node uplink forwarding parameter table; the uplink packet encapsulating module 323 is configured to generate the generated operation The MPLS Ethernet frame header is added to the uplink packet received by the access node.

The user's access information includes: user location information, and/or user identification, and/or other information that uniquely identifies the user. The user location information includes at least one of the following: an identifier of the access node, a slot number of the board accessed by the user, a port number accessed by the user, and a logical link number accessed by the user; the user identifier includes at least one of the following: The IP address of the access user, the MAC address of the access user, the partial field of the IP address of the access user, the partial field of the MAC address of the access user, the user account of the access user, and a specified user of the access user. value.

In the above network communication system, the access node compiles the user's access information into a 48-bit location information code according to the coding format of the MAC address. The location information coding includes: an index of information required by the one or more of the broadband access device number, the device frame number, the slot number, and the port number, and the user's IP address, the user's MAC address, and the priority. An index of one or more of the protocol encapsulation methods, user types, permanent virtual connection identifiers, and information describing the characteristics of the user. In the above network communication system, the access node automatically uses the above-mentioned code including the access information of the access user as the carrier source MAC of the MAC address stack application. The working principle of each unit in the above access node and the foregoing invention The description in the network communication method of the embodiment is similar, and details are not described herein again.

FIG. 4 is a flowchart of a process for automatically allocating a source MAC address of an operator in an embodiment of the present invention, including the following steps:

401. The network access device converts the identifier of the access user and/or the location information of the access user into an encoding that is the same as the encoding format of the MAC address.

402. The network access device automatically uses the foregoing encoding of the access information of the access user as the carrier source MAC of the MAC address stack application.

In the above automatic MAC address allocation method, the user's access information may be an access user identifier and/or an access user location information. The access user identifier includes an access user identity index. The access user identity index includes at least one of the following: an IP address of the access user, a MAC address of the access user, a part of the IP address of the access user, a part of the MAC address of the access user, and a user account of the access user. And a specified value of the access user. The access user location information includes at least one of the following: an identifier of the network access device that the user accesses the network, a frame number that the user accesses on the network access device, and a user board slot that the user accesses on the network access device. No., and the port number of the user accessing the user interface board. The identifier of the network access device includes at least one of the following: an IP address of the network access device, a name of the network access device, a device identifier configured for the network entry device, a MAC address of the network access device, or a partial word in the MAC address. Section, and part of the MAC address or MAC address configured for the network access device. The identity of the access user and/or the correspondence between the location information of the access user and the MAC code is configured in the network access device. The MAC address stack includes Mac-in-Mac.

The access user identity may be the user's IP address or a part of the user's MAC address or user IP address or a part of the user's MAC address or an account number or a specified value. Any combination between them may be combined. Configured in the access device.

The access user location information refers to the access location of the network where the user is located, including the identifier of the network access device that the user accesses the network, the slot number of the user interface board that the user accesses the device on the network, and the user access user. The port number of the interface board, which can also contain the logical link number.

The identifier of the network access device includes: an IP address of the device, a name of the device, a configured device identifier, a MAC address of the device, and a configured MAC address segment.

For example, the access node is configured with one or more MAC address segments, such as: MAC address segment: OxOOEO-FCl 1-0000, MASK: 0xFFFF-FFFF-0000, the MAC address segment can identify the access segment. Point, the MAC address segment can be configured according to the network plan; the access node automatically combines the user's node user location information with the configured MAC address segment to generate the P-MAC SA of the user's Mac-in-Mac tunnel. The user's node location information can be identified as follows: frame number / slot number / subslot / port number + [vpi, vci] + [vlan], frame number / slot number / subslot / port number + [vpi, vci] , frame number / slot number / subslot / port number + [vlan], frame number / slot number / subslot / port number, etc., node user location information is encoded according to a certain format, the length of the code is the length of the MAC segment allocation . For example, the frame number/slot number/sub-slot/port number is 0/1/0/63 format is 203f, then the user's P-MAC SA is 0x00E0-FCll-203F, and 0x00E0-FCll-203F can identify the user. The P-MAC SA is an operator source MAC of the uplink packet.

The P-MAC DA of the uplink packet of the access node user can be generated by the following rules:

I. Configuration

1. The network administrator can configure the P-MAC DA of the uplink packet on the access node. The configuration method can be flexibly configured. For example, one access node uniformly configures an uplink packet for P-MAC DA, and all users share the uplink packet. The P-MAC DA of the text is configured according to the port, and one port is configured with a P-MAC DA of the uplink packet, and all the packet services in the port share the P-MAC DA of the uplink packet, according to the port link configuration, one port The logical link is configured with a P-MAC DA of the uplink packet, and all the packet services on the link share the P-MAC DA of the uplink packet. The foregoing configuration is not mutually exclusive and can be used in combination. The access node saves the P-MAC DA of the uplink packet to the uplink forwarding parameter list of the access node according to the actual configuration policy.

2. The network administrator can configure the uplink P-MAC DA and the uplink C-MAC DA uplink forwarding parameter list in the access node, and the configuration method can be flexibly configured, for example:

The parameter list is configured according to the port configuration, and one port is configured with an uplink P-MAC DA and an uplink C-MAC DA access node uplink forwarding parameter table, and all the packet services in the port share the uplink P-MAC DA and the uplink C- MAC DA access node uplink forwarding parameter table, according to port link configuration, one port logical link is configured with one or more uplink P-MAC DA and uplink C-MAC DA access node uplink forwarding parameter table, in the port All the packet services on the link share the uplink forwarding parameter table of the access nodes of the uplink P-MAC DA and the uplink C-MAC DA. These configurations are not mutually exclusive. In combination, the access node saves the uplink P-MAC DA and the uplink C-MAC DA in the access node uplink forwarding parameter table according to an actual configuration policy.

The above two methods are not mutually exclusive and can be combined and used flexibly.

2. Dynamic learning mechanism

1. The access node learns the user's uplink P-MAC DA and uplink according to the downlink packet.

The uplink forwarding parameter table of the access node of the C-MAC DA. The downlink direction refers to the direction from the access node to the user or the direction of the aggregation node to the access node.

2. The access node learns the P-MAC SA and the C-MAC SA of the downlink packet, and the P-MAC SA of the downlink packet is the P-MAC DA of the user uplink, and the C-MAC of the downlink packet. The SA is the uplink C-MAC DA of the user. If the uplink P-MAC DA and the uplink C-MAC DA have already existed and are consistent in the uplink forwarding parameter table of the access node, the state is refreshed, if the uplink P-MAC DA and the uplink C- The MAC DA has already existed but is consistent in the access node uplink forwarding parameter table, and then updates the uplink P-MAC DA and the uplink C-MAC DA access node uplink forwarding parameter table. If not, the uplink P-MAC DA is added. And the uplink node of the uplink C-MAC DA forwards the parameter table item.

3. The access node actively maintains the aging mechanism of the uplink forwarding parameter list of the access node of the uplink P-MAC DA and the uplink C-MAC DA, and uplinks the uplink node of the uplink P-MAC DA and the uplink C-MAC DA in the specified period. The parameter table item is not updated or refreshed, and the access node deletes the uplink forwarding parameter list item of the access node of the uplink P-MAC DA and the uplink C-MAC DA.

4. The access node moves the uplink P-MAC DA and the uplink C-MAC DA access node to forward the parameter table. The learning form is flexible. For example: Based on the node learning, all users in the node share the uplink P-MAC DA and uplink. Dynamic mapping of C-MAC DA, based on port learning, all access nodes in the port manage and maintain the user's MAC address (downlink C-MAC DA, also known as uplink C-MAC SA) table, management and maintenance process with ordinary Ethernet The MAC address of the switch management user is the same. There are two ways:

Configure the MAC address (downlink C-MAC DA, that is, the uplink C-MAC S A) table: Configure the user's MAC address on the access node;

Dynamically learn the user's MAC address (downstream C-MAC DA, that is, the uplink C-MAC SA), The access node learns the user's MAC address (downlink C-MAC DA, that is, the uplink C-MAC SA) according to the uplink packet of the user, and the dynamically learned MAC address maintains and manages the user's MAC address table through the aging mechanism.

FIG. 5 is a schematic block diagram of an access node according to an embodiment of the present invention; FIG.

In this embodiment, the access node includes a receiving unit 51, a transmitting unit 52, and an Ethernet frame header adding unit 53. The receiving unit 51 is configured to receive an uplink packet from the user and a downlink packet from the Ethernet network, where the sending unit 52 is configured to send the uplink packet to the Ethernet, and send the downlink packet. To the user; the Ethernet frame header adding unit 52 is configured to add a carrier Ethernet frame header to the uplink information received by the receiving unit 51.

The Ethernet frame header adding unit 53 can be implemented by using the principle shown in FIG. 5, including: a mapping module 531, a carrier Ethernet frame header generating module 532, and an uplink packet encapsulating module 533. The mapping module 531 is configured to store an access node uplink forwarding parameter table. The carrier Ethernet frame header generating module 532 is configured to generate a carrier Ethernet frame header, and generate an operator Ethernet according to the access information of the user. The carrier source MAC address field in the frame header, and the operator destination MAC address field in the carrier Ethernet frame header is generated by searching the access node uplink forwarding parameter table; the uplink packet encapsulation module 533 is configured to generate the The carrier Ethernet frame header is added to the uplink message received by the access node.

In addition, the access node may also process the received downlink text from the Ethernet network through its internal carrier Ethernet header removal unit 54 to remove the carrier Ethernet in the downlink packet. Net frame header. The carrier Ethernet frame header removing unit 54 passes the processed user>3⁄4 text to the transmitting unit 52, and the transmitting unit 52 transmits the message to the user.

FIG. 6 is a flowchart of processing performed by an access node in an uplink direction (a user sends an access node) message according to an embodiment of the present invention. The process flow includes the following steps: Step 601: The user access node receives the user packet.

Step 602: Generate an uplink P-MAC SA of the packet according to an uplink P-MAC SA generation rule of the Mac-in-Mac tunnel.

Step 603: Search for an uplink P-MAC DA of the packet by using an uplink forwarding parameter of the access node according to the configuration policy. If the uplink P-MAC DA fails to be processed, the packet is processed according to the configured policy, such as: discarding the user packet, or the uplink P-MAC DA defaults to the broadcast address of all Fs, and the uplink P-MAC DA defaults to the specified MAC address;

Step 604: Obtain other field data of the uplink carrier tunnel header, such as a P-TAG, according to the configured policy.

Step 605: The access node adds the obtained carrier tunnel header data to the received user packet header.

Step 606: The access node performs some other necessary processing on the packet, for example, performing assignment and/or mapping processing on the service label and/or the P-TAG.

Step 607: The Ethernet packet of the carrier Ethernet frame header is added according to the carrier Ethernet frame header forwarding.

FIG. 7 is a flowchart of a process for an access node to process a downlink packet according to an embodiment of the present invention. The process flow includes the following steps:

Step 701: The user access node receives a downlink packet that is sent by the upper-layer device to the user and has an operator Ethernet frame header.

Step 702: Remove the Mac-in-Mac tunnel information data of the downlink packet, such as a carrier Ethernet frame header.

Step 703: Obtain a link where the user (downlink C-MAC DA) is located according to the downlink C-MAC DA lookup entry of the packet (the downlink forwarding parameter table of the access node), and then perform some necessary processing according to the policy, for example, the service label And/or P-TAG for assignment and/or mapping processing;

Step 704: Forward the user packet to the port link or logical link where the user is located.

The method for obtaining the association relationship between the access aggregation node (IP Edge node) uplink P-MAC SA (downlink P-MAC DA) and the uplink C-MAC SA (downlink C-MAC DA) is as follows:

1. Configure the access aggregation node (IP Edge node) to configure the association between the uplink P-MAC SA and the uplink C-MAC SA or the relationship between the uplink P-MAC SA and the uplink C-MAC SA and the user IP address. Joint relationship

2. Dynamic learning, the access aggregation node (IP Edge node) dynamically learns the association between the uplink P-MAC SA and the uplink C-MAC SA or the association between the uplink P-MAC SA and the uplink C-MAC SA and the user IP address through the protocol. Relationships, such as the ARP protocol, the access aggregation node resolves the ARP protocol packets with the user, and obtains the user's IP, the user's MAC (uplink C-MAC SA), and the uplink P-MAC SA through the ARP packet. The ARP entry of the aggregation node needs to be augmented as the user access address table. The IP address of the user or the MAC address of the user (uplink C-MAC SA) or the uplink P-MAC SA needs to be recorded, but the ARP protocol does not need to be modified. In itself, the upstream P-MAC SA is obtained from the carrier Ethernet frame header of the Ethernet frame header of the ARP packet.

Access aggregation node (IP Edge node) downlink P-MAC DA (upstream P-MAC SA) management:

1. Configure the downlink P-MAC DA to be configured on the specified link of the access aggregation node (IP Edge node), and then used for downlink packet forwarding.

2. Dynamic learning: As with the normal Ethernet MAC address learning mechanism, the access aggregation node learns the uplink P-MAC SA according to the uplink user packet, and the learned uplink P-MAC SA is used for user downlink packet forwarding.

FIG. 8 is a schematic block diagram of an access aggregation node according to an embodiment of the present invention:

The access aggregation node includes: a receiving unit 81, a transmitting unit 82, and an Ethernet frame header adding unit 83. The receiving unit 81 is configured to receive an uplink packet from the local Ethernet network to which the access aggregation node belongs and a downlink packet from another Ethernet. The sending unit 82 is configured to send the uplink packet to the other packet. Ethernet, and sending the downlink packet to the local Ethernet; the Ethernet frame header adding unit 83 is configured to add a carrier Ethernet frame header and/or a user Ethernet frame to the other Ethernet downlink packets. head. For the specific implementation of the Ethernet frame header adding unit 83, reference may be made to the Ethernet frame header adding unit 53 in the access node of the embodiment of the present invention shown in FIG.

In addition, an operator Ethernet frame header removing unit 84 may be further disposed in the access aggregation node, for removing the carrier Ethernet frame header in the uplink message.

FIG. 9 is a flowchart of processing an uplink packet by an access aggregation node according to an embodiment of the present invention. The process flow includes the following steps:

Step 901: The IP Edge node receives the uplink Ethernet packet of the user.

Step 902, processing a user's Ethernet message, such as removing an Ethernet frame header (user Ethernet frame header and / or carrier Ethernet frame header);

If the user access information needs to be obtained, the IP Edge node can obtain the access information of the user from the carrier Ethernet frame header.

Step 903: Forward the processed user packet to the corresponding IP network or other network (such as Ethernet, VPN, etc.) according to the destination IP or Ethernet frame header.

FIG. 10 is a flowchart of processing a downlink packet by an access aggregation node according to an embodiment of the present invention. The process flow includes the following steps:

Step 1001: The IP Edge node receives the IP address or other message that needs to be sent to the user. Step 1002: Search for the user access address table according to the destination IP address or the user MAC address, and obtain the downlink P-MAC DA and the downlink C- MAC DA;

Step 1003: Add a user's Ethernet frame header and an operator's Ethernet frame header according to the configured policy.

Step 1004: Find a downlink P-MAC DA entry according to the downlink P-MAC DA to obtain a destination port, and then perform some other necessary processing, for example, assigning a service label and/or a P-TAG, and sending an Ethernet with a user. The header of the frame header and the carrier's Ethernet frame header.

FIG. 11 is a flowchart of a method for providing user access information according to an embodiment of the present invention. The method includes the following steps:

111. When the user accesses the network, the access node acquires user access information.

The access node may extract the user access information from the received packet containing the user access information;

112. The access node converts the obtained user access information into an information code of a predetermined format. The user access information may be converted into a MAC address encoding format, or an 802.1 Q tag format, or a service tag format information according to an application environment requirement. coding.

113. Insert the information encoding as a corresponding field of the packet header into the packet from the user; the corresponding field includes a MAC address field or an 802.1Q Tag field or a service label field;

114. Forward a user message with the information code inserted.

In the foregoing user access information providing method, the access information of the user includes at least one of the following: an identifier of the access device accessed by the user, a frame number accessed by the user on the access device, and the user accessing the access device. The slot number of the incoming board, the port number of the board that the user accesses on the access device, and the user's access settings. The logical link number of the access device.

In the above method for providing user access information, the predetermined format is a corresponding field coding format in the header. The network access device converts the access information of the accessed user into the same information encoding as the MAC address encoding format or the 802.1Q Tag or Service Label in the packet header. Added headers including Mac-in-Mac headers. The corresponding fields are: P-Mac SA, P-Tag, Service Label, or other corresponding fields. If the new header is Mac-in-Mac, the network access device receives 4 messages from the user and adds a Mac-in-Mac header to the user's access information and Mac-in-Mac. The P-Mac SA in the text corresponds. If the newly added packet header is Mac-in-Mac, the network access device receives the message from the user and adds a Mac-in-Mac packet header to the user's access information and the Mac-in-Mac message. The P-Mac SA in the middle corresponds to the P-tag. The network access device is a broadband access device in a broadband network. The correspondence between the user's access information and the information encoding is configured in the broadband access device. The network access device compiles the user's access information into a 48-bit MAC code according to the encoding format of the MAC address. The access information coding includes: an index of one or more information required to mark the user's location in the broadband access device number, the device frame number, the slot number, and the port number; and the MAC address, priority, and protocol encapsulation method of the user An index of one or more of the user type, permanent virtual connection identifiers that describe the characteristics of the user.

In the embodiment of the present invention, an access node (AN, Access Node) refers to a network device or device or a network element that an operator provides access to a user, and the user access node mentioned in the present invention refers to a user that is closest to the user. An access network node capable of providing the above functions of the present invention, such as: DSLAM, LANSWITCH (Local Area Network Switch), and the like.

The access aggregation node (IP Edge node) refers to a network device or device or network element that provides an aggregation function for the access network user. It is located at the edge of the IP network and can provide the aggregation network node of the above functions of the present invention, such as: BRAS (Broadband Remote Access Server), IP ROUTER (Internet Router), LANSWITCH (LAN Switch), BNG (Broadband Network Gateway), and so on. The above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A network communication method, comprising:

The network communication method according to claim 1, wherein the step of increasing a carrier Ethernet frame header comprises:

The access node of the access node generates an operator source MAC address field in an operator Ethernet frame header.

The network communication method according to claim 2, wherein the access information of the user comprises: user location information and/or user identity.

The network communication method according to claim 2, characterized in that

The access node converts the user identifier of the access user and/or the location information of the access user into

The encoding of the same MAC address encoding format;

The access node uses the code containing the access user identity and/or the access user location information as the carrier source MAC of the MAC address stack application.

The network communication method according to claim 1, wherein the step of adding an operator Ethernet frame header further comprises:

The access node generates an operator destination MAC address field of the Ethernet frame header by using an access node uplink forwarding parameter table, where the uplink forwarding parameter table of the access node includes the carrier's destination MAC address of the uplink packet and the corresponding relationship of the user. .

The network communication method according to claim 5, wherein the method further comprises: the access node learning an operator's destination MAC address and an uplink message of the uplink message of the user according to the downlink message The user destination MAC address is generated, and the access node is generated according to the learned carrier MAC address and the user destination MAC address of the uplink packet.

The network communication method according to any one of claims 1 to 6, wherein the method further comprises: Adding, by the access aggregation node, a carrier Ethernet frame header and/or a user Ethernet frame header in a downlink message from the another network;

Transmitting the downlink packet in an Ethernet according to the carrier Ethernet frame header;

The access node removes a carrier Ethernet frame header from the downlink network of the Ethernet network, and transmits the downlink message to the user.

The network communication method according to claim 7, wherein the access node transmits the downlink message to the user by checking a downlink forwarding parameter table of the access node.

A user access information providing method, comprising:

The user access information providing method according to claim 9, wherein the user access information is converted into an information encoding of a MAC address encoding format or an 802.1Q Tag format or a service tag format.

The user access information providing method according to claim 9, wherein the corresponding field comprises a MAC address field or an 802.1Q Tag field or a service tag field.

The method for providing user access information according to claim 9, wherein the method further comprises:

The access server extracts user access information from the received message containing the user access information.

A network communication system, comprising: an access node and an access aggregation node connected through an Ethernet;

The access aggregation node is configured to remove the operator Ethernet frame header in the uplink packet from the Ethernet, and transmit the uplink packet to another network.

The network communication system according to claim 13, wherein the access node comprises:

a mapping module, configured to store an access node uplink forwarding parameter table;

a carrier Ethernet frame header generating module, configured to generate a carrier Ethernet frame header, including according to the The user's access information generates an operator source MAC address field in the carrier Ethernet frame header, and generates an operator destination MAC address field in the carrier Ethernet frame header by using the access node uplink forwarding parameter table;

The uplink packet encapsulating module is configured to add the generated carrier Ethernet frame header to the uplink packet received by the access node.

The network communication system according to claim 13, wherein the access aggregation node is further configured to add a carrier Ethernet frame header and/or a user Ethernet in a downlink message from the another network. And a network frame header, and sending the downlink information to the access node by using the Ethernet.

The network communication system according to claim 15, wherein the access node is further configured to remove the carrier Ethernet frame header in the downlink message from the Ethernet network, and Transmitting the downlink message to the user.

17. An access node, comprising:

a receiving unit, configured to receive an uplink message from the user and a downlink message from the Ethernet network, where the sending unit is configured to send the uplink message to the Ethernet, and send the downlink message to User

It is characterized in that it further comprises:

The access node according to claim 17, wherein the Ethernet frame header adding port unit comprises:

The carrier Ethernet frame header generating module is configured to generate a carrier Ethernet frame header, and generate an operator source MAC address field in the carrier Ethernet frame header according to the access information of the user, and pass the access The node uplink forwarding parameter table generates a carrier destination MAC address field in the carrier Ethernet frame header;

The access node according to claim 17 or 18, wherein the access node further comprises: The carrier Ethernet frame header removing unit is configured to remove a carrier Ethernet frame header in the downlink packet.

20. An access aggregation node, comprising:

a receiving unit, configured to receive an uplink packet from the local Ethernet to which the access aggregation node belongs and a downlink packet from another Ethernet;

It is characterized in that it further comprises:

The access aggregation node according to claim 20, wherein the access aggregation node further comprises:

A carrier Ethernet frame header removing unit is configured to remove a carrier Ethernet frame header in the uplink message.