CN1545265A - Method for implementing virtual MAC address in digital subscriber line access server equipment - Google Patents

Abstract

The invention provides a method that a DSLAM device implements virtual MAC addresses, including; when learning the basic functions and addresses of an exchanger, according to user configured VMAC mapping method, a DSLAM device generates a VMAC address corresponding to the user MAC address, and when configuring user data in a Radius or broadband connection sever, inputs user marked VMAC and binds it with user name. The invention completes a two-way MAC address conversion operation by hardware device in order to implement the only mark of the user, which ensures transmitting performance of the system.

Description

Digital Subscriber Line access server equipment is realized the method for virtual media access control address

Affiliated technical field

The invention belongs to the association area of broadband network access device security of system and user management, be specifically related to the method that a kind of DSLAM equipment is realized virtual mac address.

Background technology

Large scale construction along with broadband infrastructure, the continuous expansion of broadband user colony, some security of system problems loom large day by day, as account embezzlement, IP address embezzlement or the like, and the telecommunications operator does not have enough means to position when solving safety issue, its reason mainly is that the network schemer of networking by two-layer structure built in present broadband, a plurality of Digital Subscriber Line access servers (digital subscriber linermultiplexer, DSLAM) equipment is through access band access server (BRAS) after the switch aggregation, after user's PPPOE authentication data packet arrives BRAS, BRAS or certificate server Radius are difficult to the user of authentication is carried out unique sign, thereby what can not be distinguished is right user, and what is the user of malice.

Summary of the invention

The present invention overcomes the deficiency of above-mentioned broadband network access device security of system, and a kind of building method of the virtual mac address according to operator's particular demands dynamic-configuration is provided, and the forwarding performance of broadband network access device system is protected.

Technology contents of the present invention: a kind of Digital Subscriber Line access server equipment is realized the method for virtual media access control address, comprising:

When (1) DSLAM equipment carries out basic function, the address learning of switch,, generate the VMAC address of this user's MAC address correspondence according to the mapping method of user configured VMAC;

(2) on the Radius server or on the BAS Broadband Access Server, during the configure user data, the VMAC of input user ID binds itself and user name.

Further comprise: after (1) DSLAM equipment is received user data, determine corresponding VMAC address, after replacing, send to BAS Broadband Access Server according to user's MAC address;

(2) after receiving the data that BAS Broadband Access Server sends, carry out the replacement of a VMAC address to MAC address after, send to corresponding subscriber equipment.

The generation module of the administration interface definition VMAC address by DSLAM equipment when the user distributes telephone numbers, after the DSLAM network management interface is finished the user data configuration, according to the generation template of VMAC, generates the unique identification VMAC address of this user's correspondence.

The mapping method of described VMAC comprises:

(1) basic element S set that participate in to calculate of configuration=E1, E2 ..., En};

(2) set the original position Bi of basic element in the MAC Address of 48 bit lengths, determine its length L i simultaneously;

(3) VMAC's is generated as complete 1 constant and, the combination of the Bi position that moves to left that individual element Ei and length are Li.

The basic element that described configuration participates in calculating comprises:

(1) DSLAM device numbering;

(2) the VLAN ID that connects between DSLAM and the BRAS;

(3) user's corresponding equipment port numbering;

(4) under a plurality of user situations of unique user port, each user's numbering;

(5) the self-defining VMAC address prefix of operator.

Technique effect of the present invention: according to certain strategy 48 user's MAC address of packet are shone upon, be transformed to virtual mac address, realize that BRAS or Radius finish user's unique identification according to this virtual mac address.Because hardware device is finished two-way MAC Address conversion work, the forwarding performance of system will be protected.And user MAC can be finished by the logic or the ASIC of special use to the mapping of virtual mac address, can the forwarding performance of system not had any impact, and simultaneously, the building method of VMAC can carry out flexible customization according to the demand difference of operation.

Embodiment:

The DSLAM data forwarding flow process of VMAC of the present invention is:

Carry out the basic function of switch for a DSLAM equipment, in the time of address learning, can calculate the VMAC address of this user's MAC address correspondence according to the mapping method of user configured VMAC, then these two MAC Address are written in the relevant hardware forwarding unit.After the hardware forwarding unit is received user data, determine corresponding VMAC address, after replacing, send to BRAS according to user's MAC address; After receiving the data that BRAS sends, carry out the replacement of a VMAC address to MAC address.Hardware device is finished two-way MAC Address conversion work.

Wherein, the operation mode of VMAC:

1, passes through the mapping of the equipment control interface configurations VMAC of DSLAM, just define the generation template of 48 VMAC addresses.

2, when the user distributes telephone numbers, after the DSLAM network management interface is finished the user data configuration, will generate the unique identification VMAC address of this user's correspondence according to the generation template of VMAC.

3, on the Radius server or on the BRAS, during the configure user data, the VMAC of input user ID binds itself and user name, reaches the sign for the user.

4, certificate server Radius can realize according to VMAC adress analysis and consumer positioning by expanding.

The mapping relations of user MAC and VMAC:

1, basic element S set that participate in to calculate of configuration=E1, E2 ..., En}.

If 2 DSLAM equipment participate in calculating, configuration DSLAM device number.

If 3 have the VMAC address prefix, the address prefix of configuration VMAC.

4, set the original position Bi of basic element in the MAC Address of 48 bit lengths, determine its length L i simultaneously.

5, VMAC's is generated as complete 1 constant and, the combination of the Bi position that moves to left that individual element Ei and length are Li.

Wherein, a user's of unique identification information basic element comprises:

1, DSLAM device numbering, operator can adopt the combination of linear numbering or office point numbering oil (gas) filling device number.

2, the VLAN ID that connects between DSLAM and the BRAS.

3, user's corresponding equipment port numbering comprises the combination of corresponding service groove number and groove inner port numbering.

4, under a plurality of user situations of unique user port, each user's numbering.

5, the self-defining VMAC address prefix of operator, the high position by definition VMAC reaches the division of VMAC address.

With IP kernel intelligence DSLAM, its built-in ISPU (IN service processing unit) finishes the two-way mapping of user's MAC address and VMAC address and the forwarding of user PPPOE packet is an example, and technical scheme of the present invention is described.

The element that is configured to down participate in calculating by webmastering software is: user port number, the VLAN ID that DSLAM equipment is connected with BRAS, VMAC address prefix.Be provided with wherein in the user port number, the bit position of the inner slogan of groove is that bit0 is to bit5, the bit position of professional groove number is that bit6 is to bit9, the bit position of VLAN ID is that bit10 is to the bit21 position, and the prefix of VMAC address is 00:05:00:00:00:00, VLAN ID is 118, and the user for 2:10 (2 grooves, 10 ports) with the VMAC address of calculating is so:

VMAC(2:10)＝0x000500000000|((118&0x0FFF)＜＜10)|((2&0x000F)

＜＜6)|(10&0x003F)＝0x00050001D88A

The 2:10 user's MAC address and the VMAC address of calculating above are written among the ISPU, after this user's PPPOE datagram arrives ISPU so, ISPU will revise the source MAC of ethernet frame becomes VMAC, data forwarding is to BRAS, after the descending packet of BRAS arrives ISPU, ISPU will become the VMAC reduction user's MAC Address.BRAS will send to certificate server Radius in authentication data packet, certificate server is finished the unique identification inspection of user name.

Can adopt device number or other information field structure VMAC equally.

Claims (5)

1. a DSLAM equipment is realized the method for virtual mac address, it is characterized in that:

When (1) DSLAM equipment carries out basic function, the address learning of switch,, generate the VMAC address of this user's MAC address correspondence according to the mapping method of user configured VMAC;

(2) on the Radius server or on the BAS Broadband Access Server, during the configure user data, the VMAC of input user ID binds itself and user name.

2. DSLAM equipment as claimed in claim 1 is realized the method for virtual mac address, it is characterized in that further comprising:

(1) after DSLAM equipment is received user data, determines corresponding VMAC address, after replacing, send to BAS Broadband Access Server according to user's MAC address;

(2) after receiving the data that BAS Broadband Access Server sends, carry out the replacement of a VMAC address to MAC address after, send to corresponding subscriber equipment.

3. DSLAM equipment as claimed in claim 1 or 2 is realized the method for virtual mac address, it is characterized in that: the generation module that defines the VMAC address by the administration interface of DSLAM equipment, when the user distributes telephone numbers, after the DSLAM network management interface is finished the user data configuration, according to the generation template of VMAC, generate the unique identification VMAC address of this user's correspondence.

4. DSLAM equipment as claimed in claim 1 or 2 is realized the method for virtual mac address, and it is characterized in that: the mapping method of described VMAC comprises:

(1) basic element S set that participate in to calculate of configuration=E1, E2 ..., En};

(2) set the original position Bi of basic element in the MAC Address of 48 bit lengths, determine its length L i simultaneously;

(3) VMAC's is generated as complete 1 constant and, the combination of the Bi position that moves to left that individual element Ei and length are Li.

5. DSLAM equipment as claimed in claim 4 is realized the method for virtual mac address, it is characterized in that: the basic element that described configuration participates in calculating comprises:

(1) DSLAM device numbering;

(2) the VLAN ID that connects between DSLAM and the BRAS;

(3) user's corresponding equipment port numbering;

(4) under a plurality of user situations of unique user port, each user's numbering;

(5) the self-defining VMAC address prefix of operator.