CN108390825B - Method and system for establishing secure optical tree in multi-domain optical network based on hierarchical PCE - Google Patents

Abstract

The invention discloses a method and a system for establishing a multi-domain optical network secure optical tree based on a layered PCE (personal computer equipment), aiming at the security threat existing in a multi-domain optical network multicast routing protocol, a corresponding security mechanism is designed by utilizing a nested Hash chain and a trust model theory, and the establishment of the multi-domain optical network secure optical tree is realized by optimizing the original optical tree calculation and optical tree establishment process; the method can realize the calculation and the establishment of the multi-domain optical network safety optical tree while ensuring the self safety, and has lower blocking rate and smaller optical tree establishment time delay.

Description

Method and system for establishing secure optical tree in multi-domain optical network based on hierarchical PCE

technical field

The present invention relates to a method and system for establishing a multi-domain optical network security optical tree based on layered PCE.

Background technique

With the rapid development of optical communication technology and real-time streaming media multicast applications, the use of optical network multicast to transmit information has become more and more extensive. How to establish and maintain a multicast tree that meets security requirements has become a very important factor in multi-domain optical networks. question.

In 2010, IETF (The Internet Engineering Task Force) described the multicast process in GMPLS (Generalized Multi-Protocol Label Switching, Multi-Label Switching Protocol) in RFC (Request For Comments) 5920 Various security threats faced in the Relevant mechanisms deal with the security problems existing in optical network multicast; in addition, related literature discusses the RSVP-TE (Resource Reservation Protocol-Traffic Engineering, Traffic Engineering-based Resource Reservation Protocol) protocol reliability mechanism through specific analysis. The security problems that the TE protocol may face, and corresponding countermeasures are proposed, but neither of the above two forms a relevant multicast protocol; in addition, a method of creating optical paths in parallel is proposed, which can effectively save resource allocation time, but the protocol It is a unicast protocol and cannot achieve the purpose of secure multicast.

SUMMARY OF THE INVENTION

In view of the above problems in the prior art, the present invention proposes a method for establishing a secure optical tree of a multi-domain optical network based on a layered PCE, which can realize the secure establishment of a multicast tree. In terms of blocking rate and optical tree establishment delay good performance.

In order to achieve the above object, the present invention adopts the following technical solutions:

A method for establishing a multi-domain optical network security optical tree based on hierarchical PCE, comprising the following steps:

Step 1, the source node in the optical network receives the multicast connection request, and the source node sends a tree-building request R1 to the cPCE of the domain where the source node is located, and the cPCE sub-path calculation unit;

Step 2, the cPCE of the domain where the source node is located receives the tree-building request R1 and uses the two-way authentication method based on the nested hash chain to perform identity authentication on the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication on the tree-building request R1; The cPCE of the domain sends the tree-building request R1 to the pPCE, which is the parent path calculation unit;

Step 3, after receiving the tree-building request R1 sent by the cPCE of the domain where the source node is located, the pPCE uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to source the tree-building request R1. Authentication; adopt the multi-domain optical network security multicast routing calculation algorithm based on artificial immunity and trust degree to calculate the optimal abstract multicast tree routing information; the tree establishment request R1 and the optimal abstract multicast tree routing information form the establishment request R2, The pPCE sends the tree establishment request R2 to the cPCE in the domain through which the optimal abstract multicast tree routing information passes;

In step 4, the cPCE in each domain that the optimal abstract multicast tree routing information passes through is calculated to obtain the intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree-building request R2 form a tree-building request R3; the cPCE in each domain Send the tree-building request R3 to pPCE;

Step 5, determine the distribution wavelength; combine all the intra-domain multicast tree routing information obtained in step 4 to form strict multicast tree routing information; strict multicast tree routing information and distribution wavelengths form a tree-building request R4; pPCE sends the tree-building request R4 into the cPCE that manages the source node or branch node;

Step 6, after receiving the tree-building request R4, the cPCE of the management source node or the branch node in step 5 uses the TCP-AO mechanism to perform source authentication on the tree-building request R4; the cPCE of the management source node or the branch node reads the tree-building request R4 respectively. Take the strict multicast tree routing information, and the cPCE managing the source node intercepts the routing information between the source node and the branch node in the domain where it is located. To the source node; the cPCE of the management branch node intercepts the routing information between the branch nodes in the domain, the routing information and the allocated wavelength generate a tree-building request R5', and the cPCE of the management branch node sends the tree-building request R5' to each branch node ;

Step 7, after the source node and each branch node receive the tree-building request R5 and the tree-building request R5', use the TCP-AO mechanism to perform source authentication on the tree-building request R5 and the tree-building request R5', and obtain the route between the source node and the branch node respectively. information and routing information between each branch node, and all get assigned wavelengths; the source node and each branch node start the RSVP-TE protocol, respectively form the routing information and the wavelength information into a PATH message, and send the PATH message to the downstream node;

Step 8: After the downstream node receives the PATH message, it determines whether the allocated wavelength is occupied on the link between the downstream node and the next node. If it is not occupied, the PATH message is passed to the next node; Occupied, return to step 5;

Step 9: After all the tail nodes in the transmission process in Step 8 receive the PATH message, they use the TCP-AO mechanism to authenticate the source of the PATH message, generate a RESV message, and transmit it to the upstream source node in the reverse direction along the transmission path in Step 8. and each branch node, and complete the wavelength configuration on the link between adjacent nodes according to the assigned wavelength;

Step 10: After the source node and all branch nodes receive the RESV message, they each generate a confirmation message and send the confirmation message to the cPCE in their respective domains; the cPCE forwards the confirmation message to the pPCE; after the pPCE confirms that all the confirmation messages are received, the pPCE Send a tree establishment success message to the cPCE in the domain where the source node is located, and the cPCE in the domain where the source node is located sends the tree establishment success message to the source node; the source node can then start multicast sending data.

Another aspect of the present invention provides a multi-domain optical network security optical tree establishment system based on layered PCE, including a module for receiving a tree-building request R1, a module for sending a tree-building request R1, a module for forming a tree-building request R2, a module for forming a tree-building request R3, a module for forming a tree-building request tree-building request R4 module, tree-building request R5 module, PATH message forming module, transmission PATH message module, generating RESV message module and confirmation message generating module, wherein,

Receive the tree-building request R1 module, which is used to implement the following functions:

The source node in the optical network receives the multicast connection request, and the source node sends a tree-building request R1 to the cPCE of the domain where the source node is located;

Send a tree-building request to the R1 module to implement the following functions:

The cPCE of the domain where the source node is located receives the tree-building request R1 and uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication for the tree-building request R1; the cPCE of the domain where the source node is located Send the tree-building request R1 to pPCE;

A tree-building request R2 module is formed to implement the following functions:

After receiving the tree-building request R1 sent by the cPCE in the domain where the source node is located, the pPCE uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication for the tree-building request R1; The multi-domain optical network security multicast routing calculation algorithm based on artificial immunity and trust degree calculates the optimal abstract multicast tree routing information; the tree establishment request R1 and the optimal abstract multicast tree routing information form the establishment request R2, and pPCE will establish the tree Request R2 to send to the cPCE in the domain through which the optimal abstract multicast tree routing information passes;

A tree-building request R3 module is formed to implement the following functions:

The cPCE in each domain that the optimal abstract multicast tree routing information passes through calculates the intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree-building request R2 form a tree-building request R3; the cPCE in each domain will create a tree-building request R3 is sent to pPCE;

A tree-building request R4 module is formed to implement the following functions:

Determine the allocated wavelength; combine all the intra-domain multicast tree routing information obtained in the R3 module to form a tree-building request to form a strict multicast tree routing information; the strict multicast tree routing information and the allocated wavelength form a tree-building request R4; pPCE will create a tree-building request R4 Sent to the cPCE that manages the source node or branch node;

A tree-building request R5 module and a tree-building request R5' module are formed to implement the following functions:

After receiving the tree-building request R4, the cPCE that manages the source node or branch node in the tree-building request R4 module uses the TCP-AO mechanism to perform source authentication on the tree-building request R4; the cPCE that manages the source node or the branch node reads the tree-building request R4 respectively. Take the strict multicast tree routing information, and the cPCE managing the source node intercepts the routing information between the source node and the branch node in the domain where it is located. To the source node; the cPCE of the management branch node intercepts the routing information between the branch nodes in the domain, the routing information and the allocated wavelength generate a tree-building request R5', and the cPCE of the management branch node sends the tree-building request R5' to each branch node ;

PATH messages form modules that implement the following functions:

After the source node and each branch node receive the tree-building request R5, they use the TCP-AO mechanism to perform source authentication on the tree-building request R5, and respectively obtain the routing information between the source node and the branch nodes and the routing information between each branch node, and both are obtained. Obtain the allocated wavelength; the source node and each branch node start the RSVP-TE protocol, respectively form the PATH message with the routing information and the wavelength information, and send the PATH message to the downstream node;

Transport PATH message module, used to implement the following functions:

When the downstream node receives the PATH message, it determines whether the allocated wavelength is occupied on the link between the downstream node and the next node. If it is not occupied, the PATH message is transmitted to the next node; if it is occupied, the Enter to form a tree to request the R4 module;

Generate a RESV message module to implement the following functions:

After receiving the PATH message, all the tail nodes in the transmission process in the transmitting PATH message module use the TCP-AO mechanism to authenticate the source of the PATH message, generate a RESV message, and transmit it to the upstream source node and the upstream source node along the transmission path in step 8. Each branch node completes the wavelength configuration on the link between adjacent nodes according to the assigned wavelength;

The confirmation message generation module is used to implement the following functions:

After the source node and all branch nodes receive the RESV message, they each generate an acknowledgment message and send the acknowledgment message to the cPCE in their respective domains; the cPCE forwards the acknowledgment message to the pPCE; after the pPCE confirms receipt of all the acknowledgment messages, the pPCE sends the acknowledgment message to the source node. The cPCE in the domain where it is located sends a tree establishment success message, and the cPCE in the domain where the source node is located sends a tree establishment success message to the source node; the source node can then start multicasting to send data.

Compared with the prior art, the present invention has the following technical effects: while ensuring its own security, it can realize the calculation and establishment of a multi-domain optical network security optical tree, and has a lower blocking rate and a smaller optical tree establishment. time delay.

The solution of the present invention will be further explained and described in detail below in conjunction with the accompanying drawings and embodiments.

Description of drawings

Figure 1 is a graph showing the relationship between the number of multicast requests and the average blocking rate;

Figure 2 is a graph of the relationship between the number of domains and the average blocking rate;

Figure 3 is the relationship between network load and average optical tree setup time;

Figure 4 shows the relationship between the number of network signaling and the network running time.

Detailed ways

For the bidirectional authentication method based on the nested hash chain, please refer to the patent document: Hash function-based bidirectional authentication method and system, patent document: application number CN 200910168758, publication number CN 101662366A, publication date: March 3, 2010.

Multi-domain optical network security multicast routing algorithm based on artificial immunity and trust degree, please refer to the literature: Geng Xinyuan Wu Qiwu Jiang Lingzhi, Multi-domain optical network security multicast routing algorithm based on artificial immunity and trust degree [J]; "Science and Technology" and Engineering, 2017, Issue 33, pp. 291-296.

The multi-domain optical network security optical tree establishment method based on the layered PCE of the present invention, in the present invention, the source node and the destination node are not in the same domain, and specifically includes the following steps:

Step 1, the source node in the optical network receives the multicast connection request of the customer network, and the source node sends a tree-building request R1 to the cPCE of the domain where the source node is located;

Step 2, the cPCE of the domain where the source node is located receives the tree-building request R1 and uses the two-way authentication method based on the nested hash chain to perform identity authentication on the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication on the tree-building request R1. If the source node is not in a domain, the tree-building request R1 is a cross-domain tree-building request, and the cPCE of the domain where the source node is located sends the tree-building request R1 to the pPCE;

Step 3, after receiving the tree-building request R1 sent by the cPCE of the domain where the source node is located, the pPCE uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to source the tree-building request R1. Authentication; According to the domain where the source node is located and the domain where the destination node is located, the optimal abstract multicast tree routing information is calculated by using the multi-domain optical network security multicast routing calculation algorithm based on artificial immunity and trust degree; The abstract multicast tree routing information forms a tree establishment request R2, and the pPCE sends the tree establishment request R2 to the cPCE in the domain where the optimal abstract multicast tree routing information passes.

In step 4, the cPCE in each domain that the optimal abstract multicast tree routing information passes through is calculated to obtain the intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree-building request R2 form a tree-building request R3; the cPCE in each domain Send the tree-building request R3 to pPCE;

Step 5, using the first hit algorithm to obtain the allocated wavelength, optionally, the maximum utilization algorithm or the minimum utilization algorithm can also be used to obtain the allocated wavelength here; The tree routing information is combined to form the strict multicast tree routing information; the strict multicast tree routing information and the allocated wavelength form the tree establishment request R4; the pPCE sends the tree establishment request R4 to the cPCE that manages the source node or branch node;

Step 6, after the cPCE of the management source node or branch node in step 5 receives the tree-building request R4, utilizes the TCP-AO mechanism to perform source authentication on the tree-building request R4;

Each cPCE reads the strict multicast tree routing information from the tree establishment request R4, and the cPCE managing the source node intercepts the routing information between the source node and the branch node in the domain where the cPCE is located, and the routing information and the assigned wavelength generate the tree establishment request R5 , the cPCE of the management source node sends the tree-building request R5 to the source node; the cPCE of the management branch node intercepts the routing information between the branch nodes in the domain where the cPCE of the management branch node is located, and the routing information and the assigned wavelength generate the tree-building request R5 ', the cPCE managing the branch nodes sends a tree-building request R5' to each branch node.

Step 7, after the source node and each branch node receive the tree-building request R5 and the tree-building request R5', use the TCP-AO mechanism to perform source authentication on the tree-building request R5 and the tree-building request R5', and obtain the route between the source node and the branch node respectively. The source node and each branch node start the RSVP-TE protocol, respectively form a PATH message with the routing information and wavelength information, and send the PATH message to the downstream node.

Step 8: After the downstream node receives the PATH message, it is judged whether the allocated wavelength is occupied on the link between the downstream node and the next node, and if it is not occupied, the PATH message is transmitted to the next node; If it is occupied, go back to step 5.

Step 9: After all the tail nodes in the transmission process in Step 8 receive the PATH message, they use the TCP-AO mechanism to authenticate the source of the PATH message, generate a RESV message, and transmit it to the upstream source node in the reverse direction along the transmission path in Step 8. and each branch node, and complete the wavelength configuration on the link between adjacent nodes according to the assigned wavelength.

Step 10: After the source node and all branch nodes receive the RESV message, they each generate an acknowledgment message, and send the acknowledgment message to the cPCE in the domain; the cPCE forwards the acknowledgment message to the pPCE; after the pPCE confirms that it has received all the acknowledgment messages, it specifies the wavelength. After the resource configuration is completed, the pPCE sends a tree establishment success message to the cPCE in the domain where the source node resides, and the cPCE in the source node's domain sends a tree establishment success message to the source node; the source node can then start multicast sending data.

Another aspect of the present invention provides a multi-domain optical network security optical tree establishment system based on layered PCE, including a module for receiving a tree-building request R1, a module for sending a tree-building request R1, a module for forming a tree-building request R2, a module for forming a tree-building request R3, a module for forming a tree-building request tree-building request R4 module, tree-building request R5 module, PATH message forming module, transmission PATH message module, generating RESV message module and confirmation message generating module, wherein,

Receive the tree-building request R1 module, which is used to implement the following functions:

The source node in the optical network receives the multicast connection request, and the source node sends a tree-building request R1 to the cPCE of the domain where the source node is located;

Send a tree-building request to the R1 module to implement the following functions:

The cPCE of the domain where the source node is located receives the tree-building request R1 and uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication for the tree-building request R1; the cPCE of the domain where the source node is located Send the tree-building request R1 to pPCE;

A tree-building request R2 module is formed to implement the following functions:

After receiving the tree-building request R1 sent by the cPCE in the domain where the source node is located, the pPCE uses the two-way authentication method based on the nested hash chain to authenticate the tree-building request R1, and uses the TCP-AO mechanism to perform source authentication for the tree-building request R1; The multi-domain optical network security multicast routing calculation algorithm based on artificial immunity and trust degree calculates the optimal abstract multicast tree routing information; the tree establishment request R1 and the optimal abstract multicast tree routing information form the establishment request R2, and pPCE will establish the tree Request R2 to send to the cPCE in the domain through which the optimal abstract multicast tree routing information passes;

A tree-building request R3 module is formed to implement the following functions:

The cPCE in each domain that the optimal abstract multicast tree routing information passes through calculates the intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree-building request R2 form a tree-building request R3; the cPCE in each domain will create a tree-building request R3 is sent to pPCE;

A tree-building request R4 module is formed to implement the following functions:

Determine the allocated wavelength; combine all the intra-domain multicast tree routing information obtained in the R3 module to form a tree-building request to form a strict multicast tree routing information; the strict multicast tree routing information and the allocated wavelength form a tree-building request R4; pPCE will create a tree-building request R4 Sent to the cPCE that manages the source node or branch node;

A tree-building request R5 module and a tree-building request R5' module are formed to implement the following functions:

After receiving the tree-building request R4, the cPCE that manages the source node or branch node in the tree-building request R4 module uses the TCP-AO mechanism to perform source authentication on the tree-building request R4; the cPCE that manages the source node or the branch node reads the tree-building request R4 respectively. Take the strict multicast tree routing information, and the cPCE managing the source node intercepts the routing information between the source node and the branch node in the domain where it is located. To the source node; the cPCE of the management branch node intercepts the routing information between the branch nodes in the domain, the routing information and the allocated wavelength generate a tree-building request R5', and the cPCE of the management branch node sends the tree-building request R5' to each branch node ;

PATH messages form modules that implement the following functions:

After the source node and each branch node receive the tree-building request R5 and the tree-building request R5', use the TCP-AO mechanism to perform source authentication on the tree-building request R5 and the tree-building request R5', and obtain the routing information between the source node and the branch node and each of them respectively. The routing information between the branch nodes is all assigned wavelengths; the source node and each branch node start the RSVP-TE protocol, respectively form the routing information and the wavelength information into a PATH message, and send the PATH message to the downstream node;

Transport PATH message module, used to implement the following functions:

When the downstream node receives the PATH message, it determines whether the allocated wavelength is occupied on the link between the downstream node and the next node. If it is not occupied, the PATH message is transmitted to the next node; if it is occupied, the Enter to form a tree to request the R4 module;

Generate a RESV message module to implement the following functions:

After receiving the PATH message, all the tail nodes in the transmission process in the transmitting PATH message module use the TCP-AO mechanism to authenticate the source of the PATH message, generate a RESV message, and transmit it to the upstream source node and the upstream source node along the transmission path in step 8. Each branch node completes the wavelength configuration on the link between adjacent nodes according to the assigned wavelength;

The confirmation message generation module is used to implement the following functions:

After the source node and all branch nodes receive the RESV message, they each generate an acknowledgment message and send the acknowledgment message to the cPCE in their respective domains; the cPCE forwards the acknowledgment message to the pPCE; after the pPCE confirms receipt of all the acknowledgment messages, the pPCE sends the acknowledgment message to the source node. The cPCE in the domain where it is located sends a tree establishment success message, and the cPCE in the domain where the source node is located sends a tree establishment success message to the source node; the source node can then start multicasting to send data.

Example

The present invention adopts the multi-domain optical network simulation system SSANS based on NS-2 to verify the effectiveness of the present invention (PB-PCE). The optical path request of the present invention is generated by Poisson distribution, and the connection time satisfies the exponential distribution; the network load unit is Erl (Erlang); W wavelengths are set, and the bandwidth of the wavelength is 2.5Gbps; attack. The simulation results are as follows:

(1) Connection blocking rate

Figure 1 is a simulation experiment performed when the number of domains is 10, and the effect of the blocking rate with the number of multicast requests is given; Figure 2 is a simulation experiment performed when the network load is 100Erlang, and the number of domains is given Impact on average connection blocking rate.

Analysis of the simulation experiment in Figure 1 shows that when the number of wavelengths W of the optical network is set to 10, 15, and 20 respectively, as the number of multicast requests increases, the connection blocking rate increases significantly, and when the number of wavelengths increases, The connection blocking rate has been significantly improved.

The following results can be obtained by analyzing the simulation experiment in Figure 2. When the number of wavelengths W of the optical network is set to 10, 15, and 20, respectively, when the number of domains increases, the connection blocking rate increases relatively smoothly. This is because the parallel branch tree building method is adopted in the present invention to establish the multicast tree, which effectively reduces the resource conflict caused by wavelength contention, and applies various security mechanisms to sanction malicious behavior, which can improve the connection efficiency. As the number of wavelengths increases, the connection blocking rate decreases.

(2) Multicast tree establishment time

Under the condition that the number of wavelengths is 10, the time delay of optical tree establishment is simulated by the influence of network load. Figure 3 shows the effect of network load on the average optical tree setup time.

Analysis of the simulation results in Figure 3 shows that when the number of domains D is set to 5, 10, and 15 respectively, when the load of the optical network increases, the growth is slow when the load is small, and begins to increase linearly when the load is high. . This is because the branch parallel tree building method is adopted in the method of the present invention, and the increase of the number of light trees in the low load time domain will not lead to a significant increase in the establishment time of the optical tree; and in the case of excessive load, services such as routing and wavelength allocation The number of computing and tree-building request messages exceeds the carrying capacity of the PCE, and the resource shortage caused by the increase in message volume will also cause a rapid increase in the optical tree setup time; however, due to the secure wavelength allocation mechanism, resources can be reasonably allocated to effectively avoid wavelength conflicts. The setup delay is still acceptable.

(3) Message load

The simulation is carried out under the condition that the number of domains is 10 and the number of wavelengths is 10. Figure 4 shows the relationship between the signaling number and the network running time.

It can be seen from Figure 4 that when the network load L is set to 50Erl and 100Erl respectively, when the number of domains of the optical network increases, the number of signaling increases linearly with time. However, when the load is 150Erl, the wavelength resources of the optical network are tight, and a large amount of signaling needs to be sent to call multiple modules to reduce the pressure on the entire network. Therefore, when the load is 150Erl, the total number of signaling increases rapidly, but it is still within the acceptable range of the optical network.

Claims (2)

1. A method for establishing a multi-domain optical network security optical tree based on a layered PCE is characterized by comprising the following steps:

step 1, a source node in an optical network receives a multicast connection request, and the source node sends a tree building request R1 to a cPCE of a domain where the source node is located;

step 2, the cPCE of the domain where the source node is located receives the tree building request R1, performs identity authentication on the tree building request R1 by using a two-way authentication method based on a nested hash chain, and performs source authentication on the tree building request R1 by using a TCP-AO mechanism; the cPCE of the domain where the source node is located sends a tree building request R1 to the pPCE;

step 3, after receiving a tree building request R1 sent by a cPCE of a domain where a source node is located, the pPCE performs identity authentication on the tree building request R1 by using a two-way authentication method based on a nested hash chain, and performs source authentication on the tree building request R1 by using a TCP-AO mechanism; calculating to obtain optimal abstract multicast tree routing information by adopting a multi-domain optical network secure multicast routing calculation algorithm based on artificial immunity and trust; the tree building request R1 and the optimal abstract multicast tree routing information form a tree building request R2, and the pPCE sends the tree building request R2 to the cPCE in the domain through which the optimal abstract multicast tree routing information passes;

step 4, the cPEC in each domain through which the optimal abstract multicast tree routing information passes is calculated to obtain intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree building request R2 form a tree building request R3; the cPCE in each domain sends a tree building request R3 to the pPCE;

step 5, determining the distribution wavelength; combining all intra-domain multicast tree routing information obtained in the step 4 to form strict multicast tree routing information; strictly multicasting tree routing information and wavelength allocation to form a tree building request R4; the pPCE sends a tree building request R4 to a cPCE of a management source node or a branch node;

step 6, after receiving the tree building request R4, the pcec managing the source node or the branch node in step 5 performs source authentication on the tree building request R4 by using a TCP-AO mechanism; the cPCE of the management source node or the branch node respectively reads strict multicast tree routing information from the tree building request R4, the cPCE of the management source node intercepts the routing information between the source node in the domain and the branch node, the routing information and the allocated wavelength generate a tree building request R5, and the cPCE of the management source node sends the tree building request R5 to the source node; the cPCE of the management branch node intercepts routing information among the branch nodes in the domain, the routing information and the allocated wavelength generate a tree building request R5 ', and the cPCE of the management branch node sends the tree building request R5' to each branch node;

step 7, after the source node and each branch node receive the tree building request R5 and the tree building request R5 ', the TCP-AO mechanism is utilized to perform source authentication on the tree building request R5 and the tree building request R5', so as to respectively obtain the routing information between the source node and each branch node and the routing information between each branch node, and respectively obtain the distribution wavelength; the source node and each branch node start an RSVP-TE protocol, respectively form routing information and wavelength information into PATH information, and send the PATH information to a downstream node;

step 8, after the downstream node receives the PATH message, judging whether the allocated wavelength is occupied on the link between the downstream node and the next node, if not, transmitting the PATH message to the next node; if the vehicle is occupied, returning to the step 5;

step 9, after all tail nodes in the transmission process in step 8 receive the PATH message, performing source authentication on the PATH message by using a TCP-AO mechanism to generate an RESV message, transmitting the RESV message to the upstream source node and each branch node in the reverse direction along the transmission PATH in step 8, and completing wavelength configuration on links between adjacent nodes according to the allocated wavelengths;

step 10, after receiving the RESV messages, the source node and all the branch nodes respectively generate confirmation messages and send the confirmation messages to the cPCE of the domain where the source node and all the branch nodes respectively belong; the cPEC forwards the confirmation message to the pPCE; after the pPCE confirms that all confirmation messages are received, the pPCE sends a tree building success message to the cPCE of the domain where the source node is located, and the cPCE of the domain where the source node is located sends the tree building success message to the source node; the source node can start multicasting the transmission data.

2. A multi-domain optical network security optical tree establishment system based on hierarchical PCE is characterized by comprising a tree building request receiving R1 module, a tree building request sending R1 module, a tree building request forming R2 module, a tree building request forming R3 module, a tree building request forming R4 module, a tree building request forming R5 module, a PATH message forming module, a PATH message transmitting module, a RESV message generating module and a confirmation message generating module, wherein,

receiving a tree building request R1 module for realizing the following functions:

a source node in an optical network receives a multicast connection request, and the source node sends a tree building request R1 to a cPCE of a domain where the source node is located;

a send tree construction request R1 module for implementing the following functions:

the cPCE of the domain where the source node is located receives the tree building request R1, performs identity authentication on the tree building request R1 by using a two-way authentication method based on a nested hash chain, and performs source authentication on the tree building request R1 by using a TCP-AO mechanism; the cPCE of the domain where the source node is located sends a tree building request R1 to the pPCE;

a tree building request R2 module is formed for implementing the following functions:

after receiving a tree building request R1 sent by a cPCE of a domain where a source node is located, the pPCE performs identity authentication on the tree building request R1 by using a two-way authentication method based on a nested hash chain, and performs source authentication on the tree building request R1 by using a TCP-AO mechanism; calculating to obtain optimal abstract multicast tree routing information by adopting a multi-domain optical network secure multicast routing calculation algorithm based on artificial immunity and trust; the tree building request R1 and the optimal abstract multicast tree routing information form a tree building request R2, and the pPCE sends the tree building request R2 to the cPCE in the domain through which the optimal abstract multicast tree routing information passes;

a tree building request R3 module is formed for implementing the following functions:

the cPCE in each domain through which the optimal abstract multicast tree routing information passes calculates to obtain intra-domain multicast tree routing information; the intra-domain multicast tree routing information and the tree building request R2 form a tree building request R3; the cPCE in each domain sends a tree building request R3 to the pPCE;

a tree building request R4 module is formed for implementing the following functions:

determining an allocation wavelength; combining all intra-domain multicast tree routing information obtained by a tree building request R3 forming module to form strict multicast tree routing information; strictly multicasting tree routing information and wavelength allocation to form a tree building request R4; the pPCE sends a tree building request R4 to a cPCE of a management source node or a branch node;

form a request to build R5 module and a request to build R5' module for implementing the following functions:

after receiving the tree building request R4, the cPCE forming the management source node or the branch node in the tree building request R4 module performs source authentication on the tree building request R4 by utilizing a TCP-AO mechanism; the cPCE of the management source node or the branch node respectively reads strict multicast tree routing information from the tree building request R4, the cPCE of the management source node intercepts the routing information between the source node in the domain and the branch node, the routing information and the allocated wavelength generate a tree building request R5, and the cPCE of the management source node sends the tree building request R5 to the source node; the cPCE of the management branch node intercepts routing information among the branch nodes in the domain, the routing information and the allocated wavelength generate a tree building request R5 ', and the cPCE of the management branch node sends the tree building request R5' to each branch node;

a PATH message forming module, configured to implement the following functions:

after the source node and each branch node receive the tree building request R5 and the tree building request R5 ', the TCP-AO mechanism is utilized to carry out source authentication on the tree building request R5 and the tree building request R5', and the routing information between the source node and the branch node and the routing information between each branch node are respectively obtained and the distributed wavelengths are obtained; the source node and each branch node start an RSVP-TE protocol, respectively form routing information and wavelength information into PATH information, and send the PATH information to a downstream node;

a transmit PATH message module to implement the following functions:

after receiving the PATH message, the downstream node judges whether the allocated wavelength is occupied on a link between the downstream node and the next node, and if not, the PATH message is transmitted to the next node; if the tree is occupied, entering a tree building request R4 module;

the RESV message generation module is used for realizing the following functions:

after all tail nodes in the transmission process in the PATH message transmission module receive the PATH message, source authentication is carried out on the PATH message by utilizing a TCP-AO mechanism to generate an RESV message, the RESV message is transmitted to an upstream source node and each branch node along the transmission PATH in the step 8 in the reverse direction, and wavelength configuration on a link between adjacent nodes is completed according to the allocated wavelength;

the confirmation message generation module is used for realizing the following functions:

after receiving the RESV message, the source node and all the branch nodes respectively generate confirmation messages and send the confirmation messages to the cPCE of the domain where the source node and all the branch nodes are located; the cPEC forwards the confirmation message to the pPCE; after the pPCE confirms that all confirmation messages are received, the pPCE sends a tree building success message to the cPCE of the domain where the source node is located, and the cPCE of the domain where the source node is located sends the tree building success message to the source node; the source node can start multicasting the transmission data.

Images