JP2006245778A - Communication apparatus, communication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication apparatus wherein the security by encryption of multicast transmission data is strengthened. <P>SOLUTION: The communication apparatus includes: a public key / private key generating section 39 for generating a public key unique to its own communication apparatus and generating a private key in pairs with the public key; a multicast encryption key decryption section 19 for using the private key generated by the public key / private key generating section 39 to decrypt the multicast encryption key encrypted by the public key unique to its own communication apparatus; and a data decryption section 38 for using the multicast encryption key decrypted by the multicast encryption key decryption section 19 to decrypt the received multicast data. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication technology of communication devices belonging to a specific group.

As a conventional access network, an E-PON (Ethernet (registered trademark) -Passive Optical Network) system is known (see, for example, Patent Document 1). In this EPON system, multiple subscriber-side communication devices (ONU: Optical Network Unit) and station-side communication devices (OLT: Optical Line Terminal) are connected via an optical fiber cable via a star coupler, and Ethernet (registered) Trademark) service is transparently accommodated. The OLT is installed in the network operator station, and the ONU is installed in the subscriber's home or outdoors. The ONU accommodates one to a plurality of subscriber terminals.
In Patent Document 1, in an E-PON system, since all terminals can receive downlink traffic, encryption is required for downlink signals. In consideration of the VLAN (Virtual Local Area Network) function, unicast (one ONU) is required. For data transmission) and multicast (for data transmission to one or more ONUs belonging to a specific group), it is disclosed that individual encryption is required. Furthermore, in Patent Document 1, as a multicast encryption key notification method in the E-PON system, the OLT encrypts the multicast encryption key with a unique unicast encryption key and transmits the encrypted encryption key. A method for decrypting a received encrypted multicast encryption key with a unicast encryption key unique to each ONU is disclosed.

JP 2004-260556 A

  In the conventional communication device disclosed in Patent Document 1, each subscriber-side communication device transmits a unicast encryption key to the station-side communication device. At this time, it is also used for decrypting the multicast encryption key. There was a problem that the unicast encryption key could be leaked.

  The present invention has been made to solve the above-described problems, and aims to enhance security by encrypting data transmitted by multicast in a communication apparatus.

  The communication device according to the present invention generates a public key unique to the communication device, and generates a secret key that is paired with the public key, and the public key / secret key generation unit The multicast encryption key decryption unit for decrypting the multicast encryption key encrypted with the public key unique to the communication device using the secret key generated in step 1 and decrypted by the multicast encryption key decryption unit And a data decrypting unit that decrypts the received multicast data using the multicast encryption key.

  According to the present invention, security can be enhanced by encrypting data transmitted by multicast in a communication device.

  Before describing the embodiment of the present invention, an Internet Group Management Protocol (IGMP) and a Gigabit Ethernet (registered trademark) -Passive Optical Network (GE-PON) system to which the present invention is applied will be described.

  As a method for realizing multicast in IP (Internet Protocol) communication, there is a method using IGMP. IGMP is a protocol used to manage IP multicast groups, and is used by multicast routers that support multicast and hosts that receive multicast packets. The operation is as follows.

  A multicast router periodically multicasts a query message (Query message), and grasps members by the presence or absence of a report message (Report message) from each host. The host returns a report message when joining the group or in response to an inquiry message. When the host leaves the group, a leave message is notified. There are V.1 to V.3 in IGMP. In V.1, there is no leave message, and when the host leaves the group, it does not return a report message.

  On the other hand, in the GE-PON system, a bridge function is implemented in the OLT and a logical port is applied as a bridge port. A general bridge performs switching in units of physical ports. However, when performing communication between ONUs in a PON system that shares one transmission path with multiple ONUs, it is necessary to make the bridge aware of the ports for each ONU. is there. Furthermore, when ONU accommodates a plurality of user interface (UNI), in order to perform communication between UNIs of ONU, it is necessary to make the bridge aware of the port for each UNI. Such a port for each ONU or UNI is called a logical port. A logical port exists in OLT and ONU, and a network connecting between them is called a logical link.

  A logical link is identified by LLID (Logical Link Identifier) which is a unique identifier in PON. LLID is selected by OLT and notified to ONU. The LLID is defined in the preamble of a MAC (Media Access Control) frame and has a 16-bit configuration. This value is defined as 1 for all broadcast preambles.

Embodiment 1 FIG.
In the communication apparatus according to Embodiment 1 of the present invention, the station side communication apparatus encrypts and transmits the multicast encryption key with the public key unique to each subscriber side communication apparatus, and each subscriber side communication apparatus receives the reception. Since the encrypted multicast encryption key is decrypted with the secret key held in each subscriber side communication device, it is not necessary to transmit the encryption key necessary for decrypting the multicast encryption key. Security can be enhanced by encrypting multicast data.

1 is a block diagram showing a network system using a communication device according to Embodiment 1 of the present invention.
In FIG. 1, 1 is an optical fiber cable, 2 is a star coupler, 10 is a station side communication device (OLT: Optical Line Terminal), and 30 is a subscriber side communication device (ONU: Optical Network Unit). Here, ONU # 1 and ONU # 2 belong to multicast group # 1, and ONU # 3 belongs to multicast group # 2.

2 is a block diagram showing a station side communication apparatus according to Embodiment 1 of the present invention.
In FIG. 2, the OLT 10 includes an IGMP filter unit 16 as a multicast transmission destination determination unit that performs IGMP snooping, a data encryption unit 17 that encrypts data, and a multicast encryption key generation unit 19 that generates a multicast encryption key. And a multicast encryption key encryption unit 20 for encrypting the multicast encryption key.

FIG. 3 is a block diagram showing a subscriber side communication apparatus according to Embodiment 1 of the present invention.
In FIG. 3, the ONU 30 includes an IGMP filter unit 36 as a multicast transmission request unit corresponding to an IGMP snoop result, a data decryption unit 38 that decrypts data, and a public key for encrypting a multicast encryption key. A public key / private key generation unit 39 that generates a private key corresponding to the public key, and a multicast encryption key decryption unit 40 that decrypts the encrypted multicast encryption key, according to the result of the IGMP snoop, Cryptographic communication is performed between the OLT 10 and a plurality of ONUs 30 by transmitting and receiving MAC frames. The filtering conditions for IGMP snooping will be described later.

  FIG. 4 shows a multicast encryption key notification sequence when two ONUs are registered in the same multicast group, and FIG. 5 shows a multicast encryption key when two ONUs are not registered in the same multicast group. The notification sequence is shown. The OLT 10 IGMP snoops the multicast group in which the ONU 30 is registered, and transmits the encrypted multicast encryption key to the ONU 30 registered in the same multicast group based on the snoop result.

  In the communication device having such a configuration, the ONU 30 public key / secret key generation unit 39 encrypts the multicast encryption cipher using the ONU 30 multicast encryption key decryption unit 40 using the private key stored in the ONU 30. Since the key is decrypted, there is no need to pass the encryption key (in this case, the secret key) necessary for decrypting the multicast encryption key, so security is strengthened by encrypting the data sent by multicast. be able to.

This will be described in more detail below.
FIG. 6 is a block diagram showing a station side communication apparatus according to Embodiment 1 of the present invention.
In FIG. 6, an OLT 10 includes a PON interface (PON-IF: Passive Optical Network-Interface) 11 that accommodates one or more ONUs (subscriber side devices) via a splitter, and a layer 2 switch that performs MAC frame switching. (L2SW: Layer 2 Switch) 12, a service node interface (SNI) 13 for connecting to the IP network, and a CPU (Central Processing Unit) 14 are provided.

  The layer 2 switch 12 includes a multicast table 15 for switching not only unicast frames but also multicast frames. As shown in FIG. 7, the multicast table 15 manages a set of a destination MAC address (multicast address) 50 and a transfer destination PON port 51, for example. The layer 2 switch 12 identifies the transfer destination PON port according to the multicast table 15.

  The layer 2 switch 12 is an IGMP report message (hereinafter referred to as a report message), a leave message (hereinafter referred to as a leave message), and a data distribution server (described later) via the SNI 13 as a multicast IP protocol from the PON. Includes an IGMP filter unit 16 for snooping an IGMP Query message (hereinafter referred to as a query message). The filtering conditions for snooping these messages will be described later.

  The PON interface 11 of the OLT 10 includes a data encryption unit 17 that encrypts downstream (communication direction from OLT to ONU) data. The SNI 13 includes a multicast monitoring unit 18 that monitors reception of multicast frames.

  The CPU 14 of the OLT 10 includes a multicast encryption key generation unit 19 that generates a multicast encryption key, and a multicast encryption key encryption unit 20 that encrypts the encryption key with a public key unique to the ONU (LLID). , Multicast address / participating port (physical port where report message arrived) / ONU (LLID) / ONU (LLID) -specific multicast encryption key public key / IGMP snooping table information / unicast, multicast encryption key Is managed in the multicast management table 21 that stores the combinations. The CPU 14 includes an IGMP monitoring unit 22 that monitors report message reception from the PON, and a logical link control unit 23 that controls logical links on the PON, and an LLID management table that manages the usage status of LLID values for each PON port. Manage 24.

  OLT10 compares the result of IGMP snoop, generates the above encryption multicast encryption key for all ONUs 30 registered in the multicast group, stores all encryption multicast encryption keys in the frame, Deliver to the ONU. A frame storing the encryption key for encrypted multicast is identified as a frame other than the frame by setting a flag in the preamble. In addition, since the frame transmitted in the PON section is subjected to encryption processing regardless of whether it is unicast or multicast, these differences are also identified by setting a flag in the preamble of the MAC frame.

FIG. 8 is a block diagram showing a subscriber side communication apparatus according to Embodiment 1 of the present invention.
In FIG. 8, the ONU 30 includes a PON interface (PON-IF) 31 connected to the OLT via a splitter, a layer 2 switch (L2SW) 32 for switching MAC frames, and a UNI 33 for connecting to a subscriber terminal. CPU34.

  The layer 2 switch 32 of the ONU 30 includes a MAC address table 35 that manages learning contents of MAC addresses to be referred to when filtering. Further, the layer 2 switch 32 includes an IGMP filter unit 36 corresponding to an IGMP report message, a leaving message, and an inquiry message from the PON.

  The PON interface 31 of the ONU 30 includes a multicast monitoring unit 37 that monitors reception of multicast frames and reception of encrypted multicast encryption key storage frames, and a data decryption unit 38 that decrypts data.

  The CPU 34 of the ONU 30 includes a public key for encrypting the multicast encryption key, a public key / secret key generation unit 39 that generates a secret key corresponding to the public key, and an encrypted multicast encryption key in the ONU ( LLID) Multicast encryption key decryption unit 40 for decryption with a unique secret key, and a combination of multicast address / LLID value / ONU (LLID) unique secret key / IGMP filter information / unicast, multicast encryption key The stored multicast management table 41 is managed. The CPU 34 also includes an IGMP monitoring unit 42 that monitors the reception of inquiry messages from the PON and a logical link control unit 43 that controls the logical link accommodated by the ONU, and manages the usage status of the LLID value of the logical link. The LLID management table 44 to be managed is managed.

  When ONU30 receives the encrypted multicast encryption key corresponding to its own ONU (LLID), it decrypts it with the private key unique to ONU (LLID), stores the decrypted multicast encryption key inside ONU, and encrypts it When a multicast frame is received, it is decrypted with the multicast encryption key.

  Alternatively, when the ONU 30 receives the encrypted multicast encryption key, the ONU 30 sequentially decrypts the ONU (LLID) with a secret key unique to the ONU (LLID), and stores the multicast encryption key corresponding to the own ONU (LLID) inside the ONU. When the encrypted multicast frame is received, it is decrypted with the multicast encryption key.

  The combination of the unicast encryption key, the multicast encryption key, and the public / private key for encrypting / decrypting the multicast encryption key is updated at a predetermined timing.

  FIG. 9 shows a configuration example of a network in which the above-described OLT 10 and ONU 30 are arranged. The OLT 10 accommodates one or more PON interfaces 11 (only one PON interface is shown in FIG. 9). One PON interface 11 accommodates one to a plurality of ONUs 30. A subscriber's personal computer (PC) 45 is connected to the ONU 30. A multicast router 61 of the IP network 60 is connected to the SNI 13 of the OLT 10, and multicast data from the data distribution server 62 in the IP network 60 reaches the multicast router 61 connected to the OLT 10.

  Next, the operation will be described. In the OLT 10, the IGMP filter unit 16 snoops the report message received from the PON interface 11. Specifically, (1) a MAC frame destination address is a multicast address, and (2) a message that satisfies the filtering condition that the Type field in the IGMP message encapsulated in the IP packet is 0x12 or 0x16 is captured as a report message. . IGMP includes V.1, V.2, and V.3. In V.1, the Type field is 0x12, in V.2, 0x16, and in V.3, 0x22. The IGMP filter unit 16 supports all these versions. This report message stores the IP group address used for multicast communication.

  FIG. 10 shows the message format of IGMP V.2. The IGMP V.2 message format includes a Type field that identifies whether the message is a query message from the multicast router 61 or a message from the ONU 30, and a field that is used only by the query message until the report message is received. A Max Response Time field for designating a time, a Checksum field for a checksum, and a Group Address field for designating an IP group address are provided.

  The OLT 10 searches the multicast management table 21 using the IP group address as a key. Processing when a matching IP multicast address is found will be described later. If no matching IP multicast address is found, it is regarded as the first group entry, and the IP multicast address, entry port, and LLID are stored in the unused entry of the multicast management table 21. The entry port here indicates a PON interface that has received a report message from ONU (LLID), and LLID indicates an LLID value stored in a MAC preamble including the report message.

  The OLT 10 transmits the captured report message to the SNI 13 and stores the ONU (LLID) entered in the CPU 14. Specifically, the logical link control unit 23 refers to the LLID management table 24 and sets the multicast management table 21 based on the IGMP filter information.

  In addition, the OLT 10 generates a multicast encryption key in the CPU 14, and transmits this encryption key to the PON via the PON interface 11 as an encrypted multicast encryption key that is encrypted with a unique public key for each ONU (LLID). To do.

  By the way, the multicast encryption key is encrypted with the public key received from each ONU (LLID) and transmitted to the PON, so that the multicast encryption key is not wiretapped by other ONUs. The notification of the encryption key for encryption multicast is identified by the Flag bit of the preamble part of the frame including this encryption key. When the ONU 30 detects a frame including the encrypted multicast encryption key in the multicast monitoring unit 37, the multicast encryption key decryption unit 40 in the CPU 34 decrypts the encrypted multicast encryption key.

  Only after the notification of the multicast encryption key is completed, the OLT 10 stores the notified multicast encryption key in the multicast management table 21 and adds an entry port to the multicast table 15. In this case, since it is the first entry port, a new entry is created in the multicast table 15.

  Then, the multicast data arriving from SNI 13 is transferred to the entry port based on the contents of multicast table 15, and encrypted by data encryption unit 17 of PON interface 11 using the multicast encryption key corresponding to the multicast communication. And sent to the PON.

  Next, processing when an IP multicast address that matches the IP group address included in the report message is found from an entry in the multicast management table 21 will be described.

  The OLT 10 searches the multicast management table 21 using the IP group address of the imported report message as a key. If a matching IP multicast address is found here, the OLT 10 recognizes the second and subsequent entries, and determines the multicast management table 21. A new LLID is additionally stored in the matching entry.

  Further, the OLT 10 transmits the captured report message only to the SNI 13 on the assumption that the data distribution server 62 exists in the IP network 60, and stores the ONU (LLID) entered in the CPU 14. Specifically, when the logical link control unit 23 refers to the LLID management table 24 and a new ONU is accommodated in the same PON port as the ONU that has already entered, multicast management is performed based on the IGMP filter information. Update the table. When a new ONU is accommodated in a PON port different from an ONU that has already entered, a multicast management table is set based on IGMP filter information.

  In the latter case, that is, when a new ONU is accommodated in a PON port different from an ONU that has already entered, the OLT 10 additionally stores it in the multicast management table 21. Furthermore, the OLT 10 generates a multicast encryption key that is already used in the former case, and generates a new multicast encryption key that is used for this multicast communication in the latter case, and transmits it to the PON via the PON interface 11. To do.

  By the way, since the multicast encryption key is encrypted with the public key received from each LLID and transmitted to the PON, the multicast encryption key is not wiretapped by other ONUs. The OLT 10 stores the notified multicast encryption key in the multicast management table 21 and adds the entry port to the multicast table 15 only after the notification of the multicast encryption key is completed. In this case, since it is the second and subsequent entry ports, the entries already in the multicast table 15 are updated. Thereafter, the operation is the same as in the first entry.

  As described above, in the communication device according to the first embodiment of the present invention, the OLT 10 snoops the IGMP message, and based on the result of the snoop, the encrypted multicast encrypted with the public key unique to the registered ONU (LLID) The encryption key is transmitted, and the ONU decrypts the encrypted multicast encryption key with a secret key unique to the ONU (LLID). As a result, only registered ONUs can decode the multicast frame, and multicast communication that does not compress the bandwidth can be realized by an easy method without separately setting a tag for identifying the ONU. Furthermore, since it is not necessary to pass an encryption key (secret key) necessary for decrypting the multicast encryption key, security can be enhanced by encrypting data transmitted by multicast.

Embodiment 2. FIG.
Since the station side communication apparatus according to the second embodiment of the present invention receives a plurality of report messages from one port, it transmits only the first received report message to the SNI. The use can be made efficient.

In FIG. 9, when the multicast router 61 that performs IGMP receives even one report message from a certain port, it distributes data to that port. For this reason, even if all report messages captured by the OLT 10 are transmitted to the SNI 13, the second and subsequent report messages become useless messages that waste the bandwidth of the SNI 13.
Therefore, in the second embodiment, when a plurality of report messages are received by the OLT 10, only the first received report message is transmitted to the SNI 13, and the rest is not transmitted from the OLT 10.

The configuration of the second embodiment of the present invention is the same as that of the first embodiment shown in FIG. 6, FIG. 7, and FIG. However, the IGMP message control function is different.
First, the OLT 10 snoops the inquiry message received via the SNI 13. Inquiry messages include: (1) General Query message, (2) Group Specific Query message (IGMP V.2, V.3 only), (3) Group and Source Specific Query message (IGMP V.3 only) There are types. Only the first report message after receiving these inquiry messages is transmitted to the SNI 13, and the report messages received thereafter are not transmitted. Then, as shown in FIG. 11, a separate report transmission flag is provided in the multicast management table 21. This report transmission flag is prepared for each entry. For example, 1 is set (transmitted) when a report message is transmitted to the SNI 13, and is cleared to 0 (not transmitted) when an inquiry message is received.

  Next, the operation will be described. OLT 10 snoops inquiry messages in addition to snooping report messages. The IGMP filter unit 16 snoops the inquiry message received from the SNI 13. Specifically, (1) IP packet destination address is 224.0.0.1 or multicast address, and (2) Type field in IGMP message encapsulated in IP packet is 0x11. As an inquiry message.

  As described above, the inquiry message includes a general query message, a group specific query message, and a group and source specific query message. The IGMP filter unit 16 handles all of these. When the OLT 10 receives one of these inquiry messages, in the case of a general query message, the message is forwarded to all ONUs 30 participating in any multicast group, and the group specific query message or group and source specific query message In this case, the message is transferred to the ONU 30 that has joined the multicast group specified in the Group Address field. However, in the case of a Group and Source Specific Query message, specify the Source Address with Number of Source ≠ 0.

  Thereafter, the OLT 10 monitors the report message from the ONU 30 with the IGMP monitoring unit 22. The subscriber who has not transmitted the report message before receiving the next inquiry message determines that he / she has left the multicast communication, and deletes the entry port from the multicast table 15 and the multicast management table 21.

  If all the ONUs 30 have left the multicast communication, the entry for the multicast communication is deleted from the multicast table 15 and the multicast management table 21.

  The multicast encryption key and the combination of the public key and the secret key for encrypting / decrypting the multicast encryption key are updated at a predetermined timing based on the result of the IGMP snoop.

  As described above, according to the second embodiment, in the multicast router 61 that performs IGMP, when a plurality of report messages are received by the OLT 10, only the first received report message is transmitted to the SNI 13, and the bandwidth of the SNI 13 is wasted. Since it is not necessary to send a message, the bandwidth can be used effectively. In addition, since the OLT 10 snoops the departure of the ONU 30 from the multicast group using IGMP snoop and updates the multicast encryption key, the ONU cannot receive the multicast frame, and the security is improved.

Embodiment 3 FIG.
The station side communication apparatus according to the third embodiment of the present invention monitors a multicast frame, and even when a report message is not returned, the station side communication apparatus does not delete the entry while the multicast frame arrives, and transmits the broadcast data. Therefore, the PON bandwidth can be used efficiently.

  The configuration of the third embodiment of the present invention is the same as that of the first embodiment shown in FIG. 6, FIG. 7, and FIG. However, the control function of multicast data transfer is different.

  In general, the multicast router 61 continues to transmit multicast data for a while even if a report message is not returned from a certain port. According to the communication apparatus in the second embodiment, if no report message is returned within two inquiry periods, the OLT 10 immediately deletes the entry.

  When the multicast data of the entry deleted here arrives, the OLT 10 broadcasts it. That is, if a frame of a multicast address that is not registered in the multicast table 15 is discarded, the General Query message cannot be transferred, so that a broadcast is performed in the case of an unregistered multicast address. As a result, multicast data that should not be transferred is transferred, and PON bandwidth is wasted. Therefore, in such a case, in the OLT 10, it is desirable to stop the data transfer to the subscriber side without deleting the entry while the multicast router 61 is transferring the data.

  For this reason, in the third embodiment, the multicast monitoring unit 18 of the OLT 10 monitors the multicast frame even for the multicast communication in which the entry port disappears, and the multicast frame does not arrive as in the sequence shown in FIG. Then delete the entry. Further, it is assumed that the entry deletion from the multicast table 15 and the multicast management table 21 is performed after the multicast frame does not arrive as shown in FIG.

  The multicast encryption key and the combination of the public key and the secret key for encrypting / decrypting the multicast encryption key are updated at a predetermined timing based on the result of the IGMP snoop.

  As described above, according to the third embodiment, the OLT 10 does not delete the entry while the multicast router 61 is transferring data, and does not delete the broadcast data to the subscriber side. Can be used effectively. In addition, since the OLT 10 snoops the departure of the ONU 30 from the multicast group using IGMP snoop and updates the multicast encryption key, the ONU cannot receive the multicast frame, and the security is improved.

Embodiment 4 FIG.
The station side communication device according to the third embodiment of the present invention issues an inquiry message several times even when a withdrawal message is received from the subscriber side, and does not delete the entry until a certain period of time elapses without a response. Since the transmission is not performed, it is possible to make efficient use of PON bandwidth.

  The configuration of the third embodiment of the present invention is the same as that of the first embodiment shown in FIG. 6, FIG. 7, and FIG. However, the control function of multicast data transfer is different.

  In IGMP V.2, as described above, the subscriber sends a leave message indicating the withdrawal. In the fourth embodiment, the OLT 10 snoops this leave message in the IGMP filter unit 16. Specifically, a message that satisfies the filtering condition that (1) the destination address of the IP packet is 224.0.0.2 and (2) the Type field in the IGMP message encapsulated in the IP packet is 0x17 is used as a leave message. take in.

  Here, as shown in FIG. 14, when the OLT 10 receives the leave message, it sends out an inquiry message specifying the multicast address to the ONU 30 that sent the message several times. If there is no response, the ONU 30 It is determined that the group has left the multicast group, and the entry port is deleted from the multicast table 15 and the multicast management table 21.

  If all the ONUs 30 have left the multicast communication, the entry for the multicast communication is deleted from the multicast table 15 and the multicast management table 21.

  The multicast encryption key and the combination of the public key and the secret key for encrypting / decrypting the multicast encryption key are updated at a predetermined timing based on the result of the IGMP snoop.

  As described above, according to the fourth embodiment, even when the OLT 10 receives a leaving message from the subscriber side, the OLT 10 issues an inquiry message several times and does not delete the entry until a predetermined time elapses without a response. PON bandwidth can be used effectively so that broadcast data is not transferred to the other side. In addition, since the OLT 10 snoops the departure of the ONU 30 from the multicast group using IGMP snoop and updates the multicast encryption key, the ONU cannot receive the multicast frame, and the security is improved.

Embodiment 5. FIG.
Since the subscriber side communication device according to the fifth embodiment of the present invention stores the UNI from which the report message is received, only for the UNI actually entering the multicast communication, Data can be distributed.

  The configuration of the fifth embodiment of the present invention is the same as that of the first embodiment shown in FIGS. 6, 7, and 9. However, the control function of multicast data transfer is different.

  When the ONU 30 accommodates a plurality of UNIs, that is, subscriber ports, a logical link is set for each UNI in advance.

  When the ONU 30 receives a report message from a certain UNI, the ONU 30 notifies the OLT 10 of the report message from the logical port corresponding to the UNI. The ONU 30 stores the UNI from which the report message is received, and based on the stored data, transfers the received multicast data to the UNI that has received the report message, that is, the UNI that has actually entered the report message.

  As described above, according to the fifth embodiment, even in an ONU that accommodates a plurality of UNIs, data can be distributed only to UNIs that have actually entered multicast communication.

  As described above, in Embodiments 1 to 5 of the present invention, the case where the management of the multicast group is performed using IGMP is shown, but the method of managing the multicast group is not limited to this.

  In the first to fifth embodiments of the present invention, the case where an Ethernet (registered trademark) frame is used has been described. However, the frame format is not limited to this, and any frame compatible with packet communication may be used.

  In the first to fifth embodiments of the present invention, the case where the present invention is applied to the PON system has been described. Needless to say, the application system is not limited to this, and communication devices belonging to a specific group receive multicast transmission. Any system such as optical or electrical wired communication or wireless communication can be used.

1 is a configuration diagram showing a network system using a communication apparatus according to Embodiment 1 of the present invention. Configuration diagram showing a communication apparatus according to Embodiment 1 of the present invention Configuration diagram showing a communication apparatus according to Embodiment 1 of the present invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 1 of this invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 1 of this invention Configuration diagram showing a communication apparatus according to Embodiment 1 of the present invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 1 of this invention Configuration diagram showing a communication apparatus according to Embodiment 1 of the present invention 1 is a configuration diagram showing a network system using a communication apparatus according to Embodiment 1 of the present invention. Explanatory drawing for demonstrating the communication apparatus by Embodiment 1 of this invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 2 of this invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 3 of this invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 4 of this invention Explanatory drawing for demonstrating the communication apparatus by Embodiment 4 of this invention

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Station side communication apparatus 16 IGMP filter part 17 Data encryption part 19 Multicast encryption key generation part 20 Multicast encryption key encryption part 30 Subscriber side communication apparatus 36 IGMP filter part 38 Data decryption part 39 Public key / secret key generation 40 Encryption key decryption unit for multicast

Claims (9)

A public key unique to the communication device, and a public key / secret key generation unit that generates a private key paired with the public key;
A multicast encryption key decryption unit for decrypting a multicast encryption key encrypted with a public key unique to the own communication device, using a secret key generated by the public key / secret key generation unit;
A data decryption unit for decrypting the received multicast data using the multicast encryption key decrypted by the multicast encryption key decryption unit;
A communication apparatus comprising: A multicast transmission request unit for requesting multicast transmission using a multicast control message;
The communication apparatus according to claim 1, further comprising:   The communication apparatus according to claim 1, wherein the public key / secret key generation unit updates the public key and the secret key at a predetermined timing. A multicast encryption key generation unit for generating a multicast encryption key for encrypting multicast data to be transmitted by multicast; and
A data encryption unit that encrypts the multicast data using the multicast encryption key generated by the multicast encryption key generation unit;
A multicast encryption key encryption unit that encrypts the multicast encryption key generated by the multicast encryption key generation unit, using a public key unique to each communication device that receives the multicast data;
A communication apparatus comprising: A multicast destination determination unit that determines a multicast destination using a multicast control message;
The communication apparatus according to claim 4, further comprising:   The communication apparatus according to claim 4, wherein the multicast encryption key generation unit updates the multicast encryption key at a predetermined timing. Generating a public key unique to each communication device, and generating a private key paired with this public key within each communication device;
Multicast encryption key decryption for decrypting a multicast encryption key encrypted with a public key unique to each communication device using the secret key generated in the public key / secret key generation step within each communication device Steps,
A multicast data decryption step for decrypting multicast data received by each communication device using the multicast encryption key decrypted in the multicast encryption key decryption step;
A communication method comprising: A multicast encryption key generating step for generating a multicast encryption key for encrypting multicast data transmitted by multicast; and
A multicast data encryption step for encrypting the multicast data using the multicast encryption key generated in the multicast encryption key generation step;
A multicast cipher that encrypts the multicast encryption key generated in the multicast encryption key generation step using a public key unique to each communication device that receives the multicast data encrypted in the multicast data encryption step A key encryption step;
A communication method comprising:   A program for causing an electronic computer to execute the communication method according to claim 7 or 8.

Images