JP2008060631A - Communication equipment and multicast user authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform the authentication of multicast communication by a switch. <P>SOLUTION: A switch 30 receives a distribution request including a group address and a terminal address from terminals 41 to 43 via a port. The switch 30 specifies a VLAN ID of a VLAN to which the port belongs. The switch 30 snoops the distribution request and refers to an authentication table to determine whether a pair of the terminal address and the VLAN ID are stored with respect to the group address included in the distribution request or not. In the case that the pair are stored, the switch 30 stores the group address and the port identifier of the port in a forwarding table. When receiving multicast data including the group address from a router 20, the switch 30 refers to the forwarding table to specify the port identifier corresponding to the group address and transmits the multicast data to the terminals. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication apparatus and a multicast user authentication method, and more particularly, to a communication apparatus and a multicast user authentication method for distributing multicast data in an IP network system only to specific terminals permitted to receive the data.

  Currently, a data distribution technique using a multicast relay function is being used in an IP network system. As techniques for controlling this multicast data, there are, for example, IGMP / MLD (Internet Group Management Protocol / Multicast Listener Discovery) and IGMP / MLD snooping techniques (see, for example, Non-Patent Documents 1, 2, and 3).

  As shown in FIG. 1, the terminal 1 (141) and the terminal 2 (142) transmit the reception request by the IGMP / MLD addressed to the group 1 (G1) to the router 120, so that the multicast sender 110 transmits. The multicast data (D110) can be received by the terminal 1 (141) and the terminal 2 (142).

  Also, multicast data (D110) is not transmitted to the terminal 3 (143) that has not made a reception request by IGMP / MLD by operating IGMP / MLD snooping with the switch. Thereby, for example, it is possible to prevent divergence of multicast data. If the terminal 3 (143) transmits a reception request to the switch 130 or the like in order to receive multicast data (D110) by IGMP / MLD, the terminal 3 (143) can receive the multicast data. .

  Further, a communication system in which a snooping device is installed between a client device and a routing device is disclosed (for example, see Patent Document 1). In this system, the snooping device transmits an IGMP reception request with authentication to the routing device as it is, and determines whether the authentication server device matches a database in which, for example, a user ID, password, multicast address, etc. are registered. ing.

JP 2004-357200 A RFC2236 Internet Group Management Protocol Version 2 RFC2710 Multilist Listener Discovery (MLD) for IPv6 Internet-Draft IGMP and MLD snooping switches draft-ietf-magma-snoop-10. txt IGAP (IGMP for Authentication Protocol) draft-andou-igmp-auth-01. txt MLDA (Multicast Listener Discovery Authentication Protocol) draft-hayashi-mlda-01. txt

  While multicast relay can easily distribute data to a large number of specific users, it can be received regardless of good intentions or bad intentions when a terminal makes a participation request for specific data distribution. For example, in each of the above systems, any terminal that can connect to the system can receive the multicast data (D110) as described above. However, for example, there is a case where multicast data of a certain multicast group is permitted to be distributed only to a specific terminal and not distributed to other terminals.

As what implement | achieves the system which delivers a multicast only to such a specific terminal, the following can be considered, for example.
(1) Authentication of access to the system itself Regardless of data types such as unicast and multicast, security is provided for the entire system by providing authentication for access to the system itself.
(2) Authentication by protocol by IGAP / MLDA In a system using multicast, the router and the terminal authenticate using the protocol, and only the authorized terminal can receive (for example, refer to Non-Patent Documents 4 and 5).
(3) Access filter in network device By setting an access filter based on a destination IP address or MAC address for a physical port in a router or switch, only authorized terminals can receive.

In multicast data communication, it is conceivable to maintain security by using any of the above-mentioned means, but each has the following problems.
In the system (1) described above, any multicast data can be received by simply making a reception request using IGMP or MLD as long as access to the system is permitted. Further, as described in (2) above, for authentication by protocol, the router and the terminal need to support the protocol. That is, for example, when applied to an in-company network, hardware and software of all routers and terminals in the company are replaced, which is too expensive. Furthermore, in the access filter described in (3) above, when the multicast data increases, the number of filtering entries increases and consumes a lot of router and switch resources. In addition, even if the terminal is moved within the same router or switch, it is necessary to change the setting, which increases the man-hours for the administrator.

  In addition to limiting the terminals that are distributed for each multicast group, there are cases where it is desired to further limit the area, port, and VLAN (Virtual LAN, virtual network) from which the terminal receives multicast data.

For example, in a corporate network, in addition to information that can be seen by everyone (distributable to the terminal), information that can be seen by regular employees, information that can be seen by temporary employees, information that can be seen by employees from other companies, etc. There is a case. In addition, information such as information on regular employees and temporary employees can be appropriately combined. In addition, there is information that can be seen only by regular employees who are above a certain position. In the case of a merger of companies, a reorganization of business units, etc., for example, there are cases where it is desired to distribute only to one employee before the merger.
Furthermore, even for the same multicast group and the same terminal, there is a need to restrict distribution in a public place such as a hall and permit distribution in a conference room.

  In view of the above, an object of the present invention is to provide a communication device and a multicast user authentication method in which authentication for multicast communication is performed by a switch (communication device). Another object of the present invention is to minimize changes in the system and to reduce the introduction cost. For example, an object of the present invention is to change only a switch from an existing system. An object of the present invention is to provide a switch capable of improving security in performing multicast data communication and capable of multicast distribution of important data.

  An object of the present invention is to limit terminals and VLANs to be distributed for each multicast group. Further, the present invention restricts distribution when a terminal is in a certain place or belongs to a certain VLAN even if it is the same multicast group or the same terminal, and in the case of being in another place or belonging to another VLAN. An object is to provide a switch and an authentication method that can permit distribution.

  In FIG. 2, the switch 30 performs a member report (multicast data reception request or distribution request) (D20) from the terminal 1 (41) by IGMP / MLD (D20), and the source MAC address (snooping, monitoring, peeping) Authentication is performed using (source MAC address). The switch 30 relays the membership report (D20) to the router 20 after confirming that it is the source MAC address of the terminal 1 (41) permitted by the setting in advance. The router 20 that has received the membership report (D20) regards it as a multicast data reception request transmitted from the multicast sender 10, and transmits the multicast data (D10) to the switch 30. The switch 30 that has received the multicast data (D10) refers to the MAC address forwarding table and transmits the multicast data (D10) to the receiver terminal 41 connected to the port 1.

In the present invention, for example, the multicast authentication function is realized by linking the IGMP / MLD snooping function and the authentication function.
According to the first solution of the present invention,
A plurality of virtual networks having a first port for receiving multicast data and a plurality of second ports for transmitting the multicast data to the terminal, and including one or more of the second ports Multiple ports to be
Corresponding to a group identifier for identifying a group of multicast data, a set of the address of the terminal that is permitted in advance to receive the multicast data of the group in a specific virtual network and the identifier of the virtual network is stored. Authentication table,
A forwarding table in which a port identifier of the second port for transmitting the received multicast data of the group is stored corresponding to the group identifier of the multicast data;
In response to a multicast data distribution request from the terminal, an authentication process for determining whether or not reception is permitted, and a transfer process for transmitting the received multicast data to the terminal according to the forwarding table A processing unit, wherein the authentication process is performed by the processing unit,
Receiving from the terminal a distribution request including a group identifier and the address of the terminal via one of the second ports;
Identifying an identifier of a virtual network to which the second port belongs based on the second port that has received the distribution request;
Referencing the authentication table and determining whether a set of the address of the terminal and the identified virtual network identifier included in the distribution request is stored corresponding to the group identifier included in the received distribution request When,
If determined to be stored in the authentication table, the group identifier included in the received distribution request and the port identifier of the second port that has received the distribution request are stored in the forwarding table; and If it is determined that it is not stored in the authentication table, a communication device including discarding the received distribution request is provided.

According to the second solution of the present invention,
A virtual network comprising a communication device having a first port for receiving multicast data and a plurality of second ports for transmitting the multicast data to a terminal, and including one or more of the second ports In a network with multiple
Receiving a delivery request including a group identifier and a terminal address from a terminal;
Identifying the identifier of the virtual network to which the port that received the distribution request belongs;
Corresponding to a group identifier for identifying a group of multicast data, a set of an address of a terminal that is permitted in advance to receive the multicast data of the group in a specific virtual network and the identifier of the virtual network is stored Referring to the authentication table and determining whether a set of the address of the terminal included in the distribution request and the identifier of the identified virtual network is stored corresponding to the group identifier included in the received distribution request;
If it is determined that it is stored in the authentication table, the group identifier included in the received distribution request and the port identifier of the port that received the distribution request are stored in the forwarding table and stored in the authentication table. If not, discarding the received delivery request;
Transmitting the received multicast data to a terminal connected to the port according to a forwarding table.

  ADVANTAGE OF THE INVENTION According to this invention, the said communication apparatus and multicast user authentication method which perform the authentication with respect to multicast communication only by a switch (communication apparatus) can be provided. Further, according to the present invention, changes in the system can be minimized and the introduction cost can be kept low. For example, according to the present invention, a change from an existing system can be only a switch. According to the present invention, it is possible to provide a switch capable of improving security in performing multicast data communication and enabling multicast distribution of important data.

  According to the present invention, it is possible to restrict terminals and VLANs to be distributed for each multicast group. Further, according to the present invention, even if the same multicast group and the same terminal are used, the distribution is restricted when the terminal is in a certain place or belongs to a certain VLAN, and when the terminal is in another place or belongs to another VLAN. Can provide a switch and an authentication method that can permit distribution.

FIG. 2 shows a system configuration diagram of the present embodiment.
The system includes, for example, an apparatus (hereinafter referred to as a multicast sender) 10 that distributes multicast data, a router 20 that transfers data such as multicast data, and a switch (communication apparatus) 30.
In this system, a multicast sender 10 and a router 20 that relays IP packets (unicast, multicast) are connected to a network (IP10). Further, the DHCP server 1 may be provided in an appropriate place such as a network (IP10).

  Further, for example, a switch 30 having an IGMP / MLD snooping function and a MAC address authentication function is connected to the router 20. In the example of FIG. 2, the switch 30 includes a terminal 1 (41) in which reception of multicast data (D10) transmitted from the multicast sender 10 is permitted in advance and a terminal 2 (42) in which reception is not permitted. The terminal 3 (43) that is permitted to receive but does not intend to receive is connected.

  The terminal 1 (41) in FIG. 2 transmits IGMP / MLD member report and can receive multicast data since the MAC address and VLAN ID are registered in advance in the switch. The terminal 2 (42) transmits IGMP / MLD membership report, but cannot receive multicast data because the MAC address or the like is not registered in the switch 30. The terminal 3 (43) does not receive the multicast data because it does not transmit the IGMP / MLD membership report.

  The switch 30 includes, for example, a plurality of ports, an authentication table 31, a forwarding table 32, and a processing unit. The authentication table 31 and the forwarding table 32 will be described later.

  The plurality of ports are, for example, a first port that is connected to the router 20 and receives multicast data, and a second port (P1 to Pn) that is connected to the terminal and transmits multicast data to the terminal. Including. In the example of FIG. 2, for example, ports 1, 2, and 3 belong to the VLAN 100. Port n belongs to VLAN 200. These VLANs can be appropriately set in advance and managed by the switch 30. For example, you may further have a VLAN management part which matched the port and VLAN.

  In response to a multicast data distribution request addressed to a desired group address (group identifier) from a terminal belonging to a certain VLAN, the processing unit performs an authentication process for permitting or rejecting distribution of the multicast data addressed to the group address. Do. The processing unit performs a transfer process of transferring the received multicast data to the terminal.

  For example, consider a case in which the router 20 and the switch 30 have VLAN 100 (V100) and VLAN 200 (V200), and the terminal 1 (41) in the VLAN 100 (V100) moves to the VLAN 200 (V200). In the case of a conventional switch, the terminal 1 (41) moves from the VLAN 100 to the VLAN 200, and sends a membership report D20 from the VLAN 200 to the switch 30, so that the terminal 1-2 (41-2) receives the multicast data D10 in the VLAN 200. It becomes possible to receive.

  However, in the setting of the authentication function of the switch 30 in the present embodiment, it is possible to set which multicast data can be received by the MAC address (terminal) belonging to which VLAN. As described in the switch authentication setting of FIG. 3 described later, the MAC address (MAC1) can be received only by the VLAN 100 (V100), and if the VLAN 200 is not set, the terminal 1-2 (44) is addressed to the group 1. The multicast data (D10) cannot be received by the VLAN 200. In this way, a VLAN that can receive multicast data can be specified within the same switch. For example, it is possible not to receive at a specific place (port corresponding to the place) even on the same floor. For example, the ports 1 to 3 of the VLAN 100 are conference room ports, and the port n of the VLAN 200 can be associated with a hall port.

  Here, the switch 30 of the present embodiment has an advantage that, for example, setting of a table is easy as compared with the case where the same security is applied by an access filter using a MAC address.

  Usually, a corporate network accommodates each terminal by arranging at least one switch on each floor, for example. If there is one switch on each floor, 10 switches are arranged in a 10-story building.

  When setting security for multicast data with an access filter under these conditions, either set a specific terminal so that it cannot receive specific multicast data for all physical ports provided in the switch, or set it for each VLAN. Need to be set in the same way. If this is set for all floors, the total number of entries is the number of MAC addresses to be filtered x the number of multicast data x the number of physical ports (or the number of VLANs) x the number of switches (for example, 10), making the setting complicated. . Further, setting time, personnel, and memory capacity are required, and it takes time for memory search in the authentication process. In some cases, the number of terminals permitted to receive multicast data is set to be greater than the number of terminals. In addition, it is necessary to clarify to which port of which switch each terminal belongs, which places a burden on the terminal user in addition to the work man-hours of the administrator.

  On the other hand, in the case of the present embodiment, it is only necessary to set the destination group address, the MAC address, and the VLAN ID as shown in FIG. It is only necessary to set the number of terminals that are permitted to receive multicast data, and it is not necessary to set all VLANs and physical ports.

FIG. 3 is an explanatory diagram of a switch authentication table.
The authentication table 31 corresponds to, for example, a group identifier for identifying a group of multicast data, an address of a terminal permitted to receive the multicast data of the group in a specific virtual network, and an identifier of the virtual network A set with (VLAN ID) is stored in advance. For example, a MAC address can be used as the terminal address. In addition to the MAC address, an appropriate identifier for identifying the terminal may be used. Further, the ID is not limited to the VLAN ID but may be an appropriate network or group ID.

  The MAC address (MAC1) of terminal 1 (41) is set to allow reception of group 1 (G1), which is the destination group address of multicast data, in VLAN 100 (V100) in FIG. The first row of the table). Regarding the terminal 2 (42), since reception of multicast data addressed to any group is not permitted, it is not registered in the authentication table 31. Regarding the terminal 3 (43), as with the terminal 1 (41), the MAC address (MAC3) registration is permitted to be received in the VLAN 100 (V100) of FIG. 2 which is the VLAN to which the destination group address of the multicast data belongs ( The second row of the table).

  In the example of FIG. 3, the terminal 1 (41) can receive multicast data addressed to the group 1 in the VLAN 100, but the VLAN 200 is not registered in the authentication table 31, so the multicast data of the group 1 is received by the VLAN 200. I can't do it.

  In addition, for the multicast data of group 2 (G2), for example, the terminal 3 (MAC3) can be received by the VLAN 100 (the fourth row of the table). For example, the multicast data of group 2 is not registered in the authentication table 31 because the terminal 1 (41) is not permitted to receive. In this way, it is possible to set a terminal capable of receiving for each multicast group.

  Furthermore, in addition to setting the destination group address and VLAN for the MAC address of the terminal that is permitted to receive multicast data, MAC address registration that allows multicast data addressed to all group addresses to be received by any VLAN is also possible. Is possible. Further, it is possible to perform registration such that multicast data addressed to a specific group address can be received by any VLAN, or multicast data addressed to all group addresses can be received by a specific VLAN. In the example of FIG. 3, the MAC address (MAC3) of the terminal 3 is set to allow reception in any VLAN for the destination group address of the group 3 (G3) (the fifth row of the table). In short, it is possible to freely select the destination group address and the VLAN for the setting of the MAC address for the terminal. Note that the above-described example of the table configuration is an example, and not all of the above-described entries may be stored.

FIG. 4 is an explanatory diagram of the MAC address forwarding table of the switch (30).
The forwarding table 32 stores, for example, a port identifier of a port that transmits multicast data corresponding to the group address of the multicast data. Further, the VLAN ID of the VLAN corresponding to the port identifier may be stored. Here, the MAC address generated from the destination group address (for example, IP address) in FIG. 3 is used as the group address. As a method for converting a multicast IP address into a MAC address, an appropriate method can be used. An IP address may be used.

  Normally, an entry of the MAC address forwarding table 32 for multicast data is not created in a switch in which IGMP / MLD snooping is not operating. This is a switch characteristic, and when multicast data is received from a physical port belonging to the VLAN, the multicast data is relayed to all physical ports belonging to the VLAN (this is called flooding). In order to suppress this characteristic, in the IGMP / MLD snooping function, a multicast MAC address is registered in the MAC address forwarding table only for a port that has received a membership report. As a result, flooding to a port that has not requested multicast data is suppressed by membership report.

  In the present embodiment, a terminal that transmits a membership report (D20) is referred to the above-described authentication table 31 to determine whether the terminal is a reception-permitted terminal or a VLAN. For example, the destination MAC address, transmission port, VLAN ID, etc. are stored in the forwarding table 32. Thereby, when receiving multicast data, the switch 30 refers to the forwarding table 32 and can output data only to the port corresponding to the terminal permitted to receive.

  In this example, in the VLAN 100 shown in FIG. 2, there are a terminal 1 (41) and a terminal 2 (42) that transmit a membership report (D20). In the authentication table 31 of FIG. Since only the MAC address is permitted by the authentication setting, the MAC address M100 is registered in the MAC address forwarding table 32 of FIG. 4 for the VLAN 100 to which the terminal 1 (41) belongs and for the port 1 (P1). Thus, the switch 30 that has received the multicast data (D10) addressed to the destination MAC address M100 from the router 20 refers to the MAC address forwarding table 32 and only to the port 1 (P1) that accommodates the terminal 1 (41). Multicast data (D10) is transmitted. When a plurality of transmission ports are stored for the same destination MAC address in the MAC address forwarding table 32, the switch 30 can appropriately copy and transmit the received multicast data.

(Authentication / registration process)
Next, a flow when the switch 30 performs terminal MAC address authentication in the present embodiment will be described.
FIG. 5 is an operation flowchart of the switch 30 at the time of MAC address authentication.
First, the switch 30 receives the IGMP / MLD membership report transmitted from the terminal (F10). For example, reception is performed via one of a plurality of ports (here, for example, port x). The IGMP / MLD membership report includes, for example, a transmission source MAC address and a destination group address of multicast data that the terminal requests for distribution. Further, data related to the VLAN may be included. Here, the source MAC address is the MAC address of the terminal.

  The switch 30 determines whether the destination group address included in the received IGMP / MLD membership report is an authentication target (F20). For example, a destination group address to be authenticated can be stored in advance and compared with this.

  If NO in step F20, the switch 30 determines whether to permit communication without authentication because it is an IGMP / MLD membership report addressed to a destination group address that is not an authentication target (F30). Whether to allow unauthenticated communication can be set in advance. If the determination in step F30 is YES, the switch 30 transmits the received IGMP / MLD membership report to the router 20 (F40). In this case, the data received from the router 20 is relayed to the terminal that transmitted the reception request.

  On the other hand, it is also possible to set so that communication addressed to a destination group address that is not subject to authentication is not allowed to communicate without authentication. In this case, the switch 30 determines NO in step F30 and does not transmit the IGMP / MLD membership report to the router, but discards it in the switch 30 (F60). Also, the switch 30 does not register the multicast MAC address in the MAC address forwarding table 32 even for the port that has received the IGMP / MLD membership report. For this reason, the switch 30 does not relay data to the terminal that has issued the reception request.

  When the switch 30 determines in step F20 that the destination group address of the IGMP / MLD member report is the authentication target (F20, YES), the process proceeds to step F80. In Step F80, the switch 30 acquires the source MAC address from the Ethernet (registered trademark) header of the IGMP / MLD membership report packet received from the terminal (F80). For example, the switch 30 identifies the VLAN ID of the VLAN to which the port x belongs from the port x that has received the IGMP / MLD member report report packet. For example, the port and the VLAN ID of the VLAN to which the port belongs are managed correspondingly, and the VLAN ID can be specified by referring to this.

  The switch 30 uses the acquired transmission source MAC address as a key for authentication, and performs terminal authentication determination (F90). For example, the switch 30 refers to the authentication table 31 and, for the destination group address included in the received IGMP / MLD member report report packet, the combination of the acquired terminal MAC address and the specified VLAN ID is authenticated. Whether it is stored in the table 31 is determined. If the combination of the MAC address and the VLAN ID is stored (F90, YES), for example, the switch 30 determines that the MAC address or the terminal is permitted to receive, and if not stored (F90, NO), It is determined that the MAC address or terminal is not permitted to receive.

  If the MAC address is not permitted in this determination (F90, NO), the switch 30 discards the IGMP / MLD membership report from the terminal and does not register the destination MAC address addressed to the port in the MAC address table ( F100). Thereby, the data is not distributed to the unauthorized terminal.

  On the other hand, if the switch 30 determines in the authentication in step F90 that the MAC address or the terminal is permitted (F90, YES), whether or not there is a terminal that has already received data addressed to the destination group address. A determination is made (F120). For example, data reception history may be stored and referred to, or a flag indicating that data is received for each multicast group may be provided. If there is a terminal that has already received the data addressed to the destination group address (F120, YES), since the switch 30 has received the data from the router 20, an IGMP / MLD member report is sent to the router 20. There is no need to send. The switch 30 starts registration processing of the forwarding table 32 (F130). Specifically, the switch 30 registers in the MAC address forwarding table 32 the multicast MAC address permitted to be received, the physical port number that received the IGMP / MLD membership report, and the VLAN to be applied (F140). Here, the multicast MAC address can be stored by converting the destination group address included in the received IGMP / MLD membership report from an IP address to a MAC address, for example. For the conversion process, a method similar to the conventional method can be used. When the information is registered in the MAC address forwarding table 32, the authentication / registration process is completed (F150). In the present embodiment, authentication and registration may be collectively referred to as authentication processing.

  On the other hand, when the switch 30 determines in step F120 that there are no other terminals participating in the group (F120, NO), the switch 30 relays the IGMP / MLD membership report from the terminal to the router 20 (F190). As a result, the switch 30 can receive the multicast data addressed to the group address from the router 20. The operations from Step F200 to F220 are the same as the operations from Step F130 to F180 described above.

(Transfer process)
FIG. 6 is a flowchart of multicast data transfer processing. Here, it is assumed that data has already been registered in the MAC address forwarding table 32 by the above-described authentication / registration process.

  First, the switch 30 receives multicast data including the destination group address from the router 20 (F160). Next, the switch 30 specifies the physical port x corresponding to the destination group address in accordance with the MAC address forwarding table 32, and transmits multicast data to the terminal via the physical port x (F170). If there are a plurality of physical ports corresponding to the destination group address, the switch appropriately copies and transmits the multicast data. As a result, a terminal that is permitted to receive can receive multicast data in a predetermined VLAN.

FIG. 7 is a sequence diagram when permitting group member registration.
For example, the terminal 1 (41) will be described as an example. First, the terminal 1 (41) performs login authentication (F1) to the system. At that time, as an example, system authentication can be made such that an IP address can be distributed only to a MAC address registered in DHCP. This system login authentication is not related to the data type. Thereafter, the terminal 1 (41) permitted to communicate is allowed to communicate with the system.

  In this state, when multicast data distribution (multicast) is started from a specified time, the router 20 transmits a general query to the switch 30 according to reception of the multicast data, for example, periodically. The switch 30 transmits this to the terminal 1 (41) connected to each port and inquires whether to join the group.

  Thereafter, for example, when the terminal 1 (41) desires to participate in the group, for example, by transmitting an IGMP / MLD membership report in accordance with an input from the user, a group participation request is made for the multicast data currently being distributed. (Receiving request for multicast data). The switch 30 receives the packet via port 1. The switch 30 snoops the IGMP / MLD membership report packet, and confirms whether the source MAC address matches the authentication setting managed by the switch 30 itself. This process corresponds to the process shown in FIG.

  In this example, since the source MAC address of the terminal 1 (41) is permitted by setting in advance, the switch 30 relays the IGMP / MLD membership report to the router 20. The router 20 receives the IGMP / MLD member report and relays multicast data from the multicast sender 10 to the switch 30 by registering as a group member. Here, the router 20 generates a MAC address from the IP group address as the destination address of the multicast data.

In accordance with the MAC address forwarding table 32, the switch 30 relays multicast data to the port 1 to which the terminal 1 (41) that requested reception is connected, and does not relay to other ports here.
This enables multicast data authentication in the switch 30 to operate.

FIG. 8 is a sequence when group member registration is not permitted.
For example, the terminal 2 (42) will be described as an example. First, the terminal 2 (42) performs login authentication (F1) to the system. At that time, as an example, system authentication can be made such that an IP address can be distributed only to a MAC address registered in DHCP. This system login authentication is not related to the data type. Thereafter, the terminal 2 (42) permitted to communicate is allowed to communicate into the system.

  In this state, when multicast data distribution (multicast) is started from a specified time, the router 20 transmits a general query to the switch 30 according to reception of the multicast data, for example, periodically. The switch 30 transmits this to the terminal 2 (42) connected to each port and inquires whether to join the group.

  Thereafter, for example, when the terminal 2 (42) desires to participate in the group, for example, by transmitting IGMP / MLD membership report according to the input from the user, the group participation request for the currently distributed multicast data is performed. (Receiving request for multicast data). The switch 30 receives the packet via port 1. The switch 30 snoops the IGMP / MLD membership report packet, and confirms whether the source MAC address matches the authentication setting managed by the switch 30 itself. This process corresponds to the process shown in FIG.

  Since the source MAC address of the terminal 2 (42) is not permitted by the setting of the switch 30, the switch 30 does not relay the IGMP / MLD membership report to the router 20, but discards it.

As a result, the router 20 does not receive the group participation request from the terminal, and therefore does not distribute multicast data to the switch 30. If there is another terminal already participating in the same group, the multicast data has arrived at the switch 30, but the data is transmitted to the port 2 to which the terminal 2 (42) is connected. Is not set in the forwarding table 32, multicast data is not relayed to the terminal 2 (42).
This enables multicast data authentication in the switch 30 to operate.

  The present invention can be used, for example, when performing multicast distribution in an IP network system.

The conventional multicast operation | movement schematic diagram. The system configuration | structure and operation | movement outline | summary figure of multicast user authentication. Explanatory drawing of the authentication table of a switch. Explanatory drawing of a MAC address forwarding table. The operation | movement flowchart at the time of MAC address authentication. 7 is a multicast data transfer flowchart. The authentication sequence figure at the time of group member registration permission. The authentication sequence figure at the time of group member registration non-permission.

Explanation of symbols

10: Multicast distribution device (multicast sender)
20: Router 30: Switch 31: Authentication table 32: MAC address forwarding table 41-43: Terminal

Claims (7)

A plurality of virtual networks having a first port for receiving multicast data and a plurality of second ports for transmitting the multicast data to the terminal, and including one or more of the second ports Multiple ports to be
Corresponding to a group identifier for identifying a group of multicast data, a set of the address of the terminal that is permitted in advance to receive the multicast data of the group in a specific virtual network and the identifier of the virtual network is stored. Authentication table,
A forwarding table in which a port identifier of the second port for transmitting the received multicast data of the group is stored corresponding to the group identifier of the multicast data;
In response to a multicast data distribution request from the terminal, an authentication process for determining whether or not reception is permitted, and a transfer process for transmitting the received multicast data to the terminal according to the forwarding table A processing unit, wherein the authentication process is performed by the processing unit,
Receiving from the terminal a distribution request including a group identifier and the address of the terminal via one of the second ports;
Identifying an identifier of a virtual network to which the second port belongs based on the second port that has received the distribution request;
Referencing the authentication table and determining whether a set of the address of the terminal and the identified virtual network identifier included in the distribution request is stored corresponding to the group identifier included in the received distribution request When,
If determined to be stored in the authentication table, the group identifier included in the received distribution request and the port identifier of the second port that has received the distribution request are stored in the forwarding table; and And a communication device including discarding the received distribution request when it is determined that it is not stored in the authentication table. The transfer process is performed by the processing unit.
Receiving multicast data including a group identifier from the device that distributes or forwards multicast data via the first port;
By referring to the forwarding table based on the group identifier, specifying one or a plurality of corresponding port identifiers and the multicast data received via the second port indicated by the identified port identifier or the multicast The communication apparatus according to claim 1, further comprising transmitting data obtained by copying data to the terminal. The processor is
When it is determined that a set of the address of the terminal and the identifier of the virtual network is stored in the authentication table, the received distribution request is further transmitted to an apparatus for distributing or transferring multicast data,
The communication apparatus according to claim 2, wherein multicast data is received from the apparatus that has received the distribution request. The virtual network is one in which one or a plurality of ports connected to the terminal in a predetermined area are combined to constitute a virtual network,
4. The communication apparatus according to claim 1, wherein reception of multicast data is permitted or rejected according to an area. The authentication table stores an address of the first terminal and a virtual network identifier corresponding to the group identifier,
5. The communication apparatus according to claim 1, wherein when the distribution unit receives a distribution request from the second terminal, the processing unit discards the received distribution request according to the authentication table. The authentication table stores an address of the first terminal and a first virtual network identifier corresponding to the group identifier,
When the processing unit receives a distribution request from the first terminal via the second port corresponding to the second virtual network, the processing unit discards the received distribution request according to the authentication table. The communication apparatus according to claim 1. A virtual network including a communication device having a first port for receiving multicast data and a plurality of second ports for transmitting the multicast data to a terminal, the virtual network including one or more of the second ports In a network with multiple
Receiving a delivery request including a group identifier and a terminal address from a terminal;
Identifying the identifier of the virtual network to which the port that received the distribution request belongs;
Corresponding to a group identifier for identifying a group of multicast data, a set of an address of a terminal that is permitted in advance to receive the multicast data of the group in a specific virtual network and the identifier of the virtual network is stored Referring to the authentication table and determining whether a set of the address of the terminal included in the distribution request and the identifier of the identified virtual network is stored corresponding to the group identifier included in the received distribution request;
If it is determined that it is stored in the authentication table, the group identifier included in the received distribution request and the port identifier of the port that received the distribution request are stored in the forwarding table and stored in the authentication table. If not, discarding the received delivery request;
Transmitting multicast data received to a terminal connected to the port according to a forwarding table.

Images