JP2012004915A - Station-side apparatus and multicast control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an OLT and a multicast control method in which a load of an ONU is reduced, uniqueness based on a pair of an IP multicast group address and an IP source address can be maintained, multicast can be identified while including the IP source address of IGMPv3 or MLDv2 and security against a DoS attack caused by excessive multicast view starting requests is strengthened.SOLUTION: According to an OLT and a multicast control method, a multicast channel is statically or dynamically registered on the basis of an IP multicast group address and an IP source address.

Description

  The present invention relates to a technique for performing multicast communication in a packet communication system in which a plurality of terminal-side communication devices are connected to a single station-side communication device through a network that performs packet communication.

  In the conventional access transmission system, in order to transfer various protocols such as IPv4 and IPv6, a configuration having a layer 2 transfer function independent of the layer 3 protocol type is adopted. In a network composed of layer 2 forwarding apparatuses, multicast communication packets are forwarded to all terminals belonging to the same segment as broadcast packets. In a terminal that does not view the multicast channel, such a multicast packet is discarded by the terminal, and thus there is no particular problem in a normal LAN (Local Area Network).

  However, in an access network constituting a public network, a multicast packet being viewed by another person is transferred to a terminal of another user accommodated in the same access network. For this reason, such a transfer situation is not preferable from the viewpoint that the viewing behavior needs to be concealed from others and that the bandwidth of the user side network is wasted.

  Therefore, a first technique has been proposed in order to control transfer in response to a viewing request from a terminal in multicast communication (see, for example, Non-Patent Document 1). In the first technique, only the multicast requested to be viewed by IGMP (Internet Group Management Protocol) in IPv4 or MLD (Multicast Listener Discovery) in IPv6 is transferred to the terminal that made the request.

  On the other hand, the transfer situation as described above also occurs in a PON (Passive Optical Network) system that has recently been introduced in a broadband public network.

  To apply the conventional first technology to the PON system, it is necessary to deploy the IGMP / MLD proxy function, which is a layer 3 function, on the subscriber side device. is there.

  In the second technique, a station side device (OLT: Optical Line Terminal) has a multicast management table. The multicast management table includes a multicast MAC address, a PON port number representing a plurality of PON ports connected to a subscriber side device (ONU: Optical Network Unit), a VID (Virtual LAN ID), and a UNI (User Node Interface) in the ONU. A set of LLIDs (Logical Link IDs) representing logical links is described.

  It is assumed that a MAC (Media Access Control) frame is input to the OLT from an SNI (Service Node Interface) interface that connects the OLT and the IP network. If the destination MAC address of the MAC frame is a multicast address described in the multicast management table, the OLT assigns a VID corresponding to the MAC frame, otherwise assigns a Null Tag, and is provided in the OLT. Bridge transfer to the PON port of the PON interface via the layer 2 switch. Thereafter, the OLT transmits only the MAC frame of the VID or the Null Tag corresponding to the PON port described in the multicast management table for each PON port, and multicasts the transmitted MAC frame to the ONU.

Further, the OLT peeks at (snooping) a multicast control message such as IGMP (Internet Group Management Protocol) from the ONU and operates as follows.
(1) If the message is a viewing start request and the multicast address is already registered in the multicast management table, the request source LLID is registered in association with the multicast address and VID.
(2) If the message is a viewing start request and the multicast address is not registered in the multicast management table, a VID corresponding to the requested multicast address is newly set and associated with the request source LLID for multicast management Register in the table.
(3) If the message is a viewing leaving request and there is another LLID that is viewing the multicast address, the request source LLID is deleted from the requested multicast address column of the multicast management table.
(4) If the message is a viewing leaving request and there is no other LLID viewing the multicast address, the requested multicast address column in the multicast management table is deleted.

  The ONU has a VID filtering unit associated with the LLID, and receives the MAC frame when the VID assigned to the transferred MAC frame is a VID or Null Tag set to itself. The OLT notifies the ONU having the LLID registered in the multicast management table to transmit the MAC frame having the VID associated with the LLID.

RFC 4605 Internet Group Management Protocol (IGMP) / Multicast Listener Discovery (MLD) -Based Multicast Forwarding (“IGMP / MLD Proxing”)

  However, in IPv4 and IPv6, uniqueness is not guaranteed in the mapping of the IP multicast group address to the destination MAC address. For this reason, the second technique has a first problem that a multicast different from a multicast to be controlled in IPv4 or IPv6 is transferred under the UNI, or a multicast to be transferred is blocked. is there.

  In IP communication, OSPF (Open Shortest Path First), NTP (Network Time Protocol), VRRP (Virtual Router Redundy Protocol), NDP (Neighbor Discovery Protocol), NDP (Neighbor Discovery Protocol), and NDP (Neighbor Discovery Protocol). Normally, the ONU does not transmit a multicast viewing start request signal and a multicast viewing withdrawal request signal for these multicasts. The second technique has a second problem that the multicast transfer as described above may be interrupted because the VID setting is performed only for the multicast that issues the viewing start / leave signal.

  In IGMPv3 (IGMP version 3) and MLDv2 (Multicast Listener Discovery version 2), a multicast channel is specified by a combination of an IP multicast group address and an IP source address. The second technique has a third problem that multicast identification including the IP source address of IGMPv3 or MLDv2 cannot be performed because the destination MAC address of the MAC frame input to the SNI is associated with the VID.

  Furthermore, the second technique newly registers the multicast requested in the multicast control message in the multicast management table without selecting it. For this reason, the second technology may be out of control due to a table overflow when there is a DoS (Denial of Services) attack such as an excessive multicast viewing start request, and strengthens the security related to the DoS attack. There is a fourth problem that must be met.

  Therefore, in order to solve the above-described problems, the present invention has a small ONU load, can guarantee uniqueness by a combination of an IP multicast group address and an IP source address, and can identify multicast including IP source addresses of IGMPv3 and MLDv2. An object of the present invention is to provide an OLT and a multicast control method with enhanced security against a DoS attack caused by an excessive multicast viewing start request.

  In order to achieve the above object, the OLT and multicast control method according to the present invention registers a multicast channel statically or dynamically based on an IP multicast group address and an IP source address.

  Specifically, the OLT according to the present invention includes a SNI that connects to an IP network, a port that connects to a plurality of ONUs, and a multicast channel that includes a set of IP multicast group addresses and IP source addresses that include a plurality of ONUs. Set, assign a predetermined VID to each multicast channel in a predetermined range (static setting), and assign one of the VIDs in a predetermined range to the other multicast channels ( Dynamic setting), and a control unit for transferring a signal between the SNI and the port for each multicast channel.

  The multicast control method according to the present invention sets a multicast channel composed of a set of an IP multicast group address and an IP source address including a plurality of ONUs, and assigns a predetermined VID to each multicast channel in a predetermined range. (Static setting), one of VIDs in a predetermined range is assigned to the multicast channel in another range (dynamic setting).

  Since the OLT controls the VID filter for the ONU and performs transfer control by this, it is not necessary to mount a proxy on the ONU. Therefore, the OLT and multicast control method of the present application can also reduce the load on the ONU.

  The OLT and the multicast control method of the present application identify a multicast channel by a pair of an IP multicast group address and an IP source address, and use a VID associated with the pair of the IP multicast group address and the IP source address to use the VID filter of the ONU. Transfer control is performed to control. This transfer control prevents the multicast that is different from the multicast to be controlled from being transferred under the UNI and the multicast that should be transferred is blocked.

  Furthermore, the transfer control of the OLT and the multicast control method of the present application can prevent the interruption of the multicast transfer that does not transmit the multicast viewing start request signal and the multicast viewing release request signal.

Furthermore, the transfer control of the OLT and the multicast control method of the present application can identify multicast including the IP source address.
Thus, the OLT and multicast control method of the present application can solve the first to third problems.

By assigning a VID statically to a specific multicast channel and assigning a VID to another specific multicast channel by limiting the range of the VID, even if there is an excessive multicast viewing request, a predetermined range can be set. The VID does not increase beyond that, and multicast transfer with enhanced security against DoS attacks due to excessive multicast viewing start requests can be realized.
Thus, the OLT and the multicast control method of the present application can solve the fourth problem.

  Therefore, according to the present invention, the ONU load is small, uniqueness by the combination of the IP multicast group address and the IP source address can be secured, multicast including the IP source address of IGMPv3 or MLDv2 can be identified, and excessive multicast It is possible to provide an OLT and a multicast control method with enhanced security against a DoS attack due to a viewing start request.

  The OLT and multicast control method according to the present invention is characterized in that the multicast channel is set by a setting request from the ONU, and the multicast channel is released by a withdrawal request from the ONU.

  The present invention has a small ONU load, can guarantee uniqueness by the combination of IP multicast group address and IP source address, can identify multicast including IP source address of IGMPv3 and MLDv2, and start excessive multicast viewing It is possible to provide an OLT and a multicast control method with enhanced security against a requested DoS attack.

It is a figure explaining OLT concerning the present invention. It is a figure explaining a multicast viewing management information table. It is a figure explaining a multicast channel setting management information table. It is a flowchart explaining the multicast control method which concerns on this invention. It is a flowchart explaining the multicast control method which concerns on this invention. It is a flowchart explaining the multicast control method which concerns on this invention.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

  FIG. 1 is a diagram for explaining the OLT 301. The OLT 301 sets the SNI 11 connected to the IP network, the port 12 connected to a plurality of ONUs (not shown), and a multicast channel composed of a combination of an IP multicast group address and an IP source address including a plurality of ONUs, and is designated in advance. A predetermined VID is assigned to each multicast channel in a predetermined range, and one of the VIDs in a predetermined range is assigned to the other multicast channel, and the SNI and the port are assigned to each multicast channel. And a control unit (not shown) for transferring signals to and from.

  The OLT 301 operates based on an instruction from the control unit. The ONU side interface 13 including the port 12, the SNI 11, the multicast viewing request signal reading function 14, the multicast setting management information table 15, the multicast channel determination function 16, the multicast viewing management information table 17 VLAN tag setting function 18 and VID filter setting function 19. The ONU side interface 13 may be a single port 12 or a plurality of ports 12. Further, the port 12 may be connected to a single ONU, or may be connected to a PON having a structure in which optical signals of a plurality of ONUs are branched by an optical splitter.

  The multicast viewing request signal reading function 14 reads a multicast control signal from the ONU side. The multicast setting management information table 15 manages VIDs set in advance for ranges of IP multicast group addresses (hereinafter referred to as G) and IP source addresses (hereinafter referred to as S).

  The ONU transmits a multicast control signal of a viewing start request or a viewing leaving request using its own LLID, a pair of S and G (hereinafter, represented as <S, G>). The multicast channel determination function 16 compares the LLID and <S, G> included in the multicast control signal with <S, G> stored in the multicast setting management information table 15 and stores them in the multicast viewing management information table 17. Write.

  The multicast viewing management information table 17 manages a set of destination IP address (hereinafter referred to as DA), transmission source IP address (hereinafter referred to as SA), VID, and LLID in association with each other. The VLAN tag setting function 18 sets a VLAN tag in a packet input from the SNI 11 based on information stored in the multicast viewing management information table 17.

  The VID filter setting function 19 controls the operation of the VID filter that the ONU has based on the information stored in the multicast viewing management information table 17. Under the control of the VID filter setting function 19, since the packet transferred to the ONU other than the ONU that requested the viewing start is discarded by the VID filter, only the ONU that requested the viewing start can receive the packet.

  FIG. 2 is an example of the multicast viewing management information table 17. In FIG. 2, iii: iii: iii: iii to xxx: xxxx: xxxx: xxx represents an IP address. The multicast viewing management information table 17 associates a VID with a pair of DA and SA, and also manages an LLID that is viewing the multicast in association with each other.

  The VLAN tag setting function 18 sets the VLAN tag having the corresponding VID in the packet if the DA and SA of the packet input from the SNI 11 are stored in the multicast viewing management information table 17, and otherwise. Set the Null tag.

  The VID filter setting function 19 notifies the ONU corresponding to the LLID so that the packet having the VID corresponding to the LLID described in the multicast viewing management information table 17 is set to be transparent.

  The multicast viewing request signal reading function 14 reads the multicast viewing request signal input from the ONU side interface 13. Then, the multicast viewing request signal reading function 14 transmits the LLID corresponding to the ONU that has transmitted the multicast viewing request signal, <S, G> to be controlled, and the control content that is the viewing start request or the viewing leaving request to the multicast channel. Output to the determination function 16.

FIG. 3 is an example of the multicast channel setting management information table 15. In FIG. 3, aaaa: aaaa: aaaa: aaa to zzzz: zzzz: zzzz: zzzz represent IP addresses. In this example,
G is aaaa: aaaa: aaaa: aaaa to hhhh: hhhh: hhhh: hhhh
And yyyy: yyyy: yyyy: yyyy to zzzz: zzzz: zzzz: zzzz
The range is excluded from control. G is iii: iiii: iii: iii-jjjj: jjjj: jjjj: jjjj
And S is pppp: pppp: pppp: pppp-uuuu: uuuu: uuuu: uuuu
<S, G> are set as static setting targets, and VIDs of 100 to 199 are set in advance. G is kkkk: kkkk: kkkk: kkkk to xxxx: xxxx: xxxx: xxxx
And S is pppp: pppp: pppp: pppp-uuuu: uuuu: uuuu: uuuu
<S, G> can be set as a dynamic setting target, and any of VIDs 200 to 299 can be set.

  The multicast viewing management information table 17 in FIG. 2 registers a set of <S, G> and VID to be statically set in the multicast setting management information table 15 in FIG. Also, the multicast viewing management information table 17 in FIG. 2 also registers a set of VIDs set in <S, G> that are dynamically set in the multicast setting management information table 15 in FIG.

  4 to 6 are flowcharts for explaining the multicast control method of the OLT 301. FIG. This multicast control method is performed by the multicast channel determination function 16. When a multicast viewing control signal is input from the multicast viewing request signal reading function 14 (step S01), the multicast channel determination function 16 searches the multicast setting management information table 15 for <S, G> to be controlled (step S02). ). The multicast channel determination function 16 ends the process if the VID corresponding to <S, G> to be controlled is Null (steps S03, S99).

  If the VID is not Null in step S03, the multicast channel determination function 16 determines whether the VID corresponding to the control target <S, G> is a static setting target or a static setting target (step S11). If it is a static setting target, the multicast channel determination function 16 determines whether it is a viewing start request or a viewing withdrawal request (step S12). If it is a viewing start request, the multicast channel determination function 16 writes the request source LLID in the <S, G> column of the multicast viewing management information table 17 and ends the processing (steps S13 and S99). On the other hand, if it is a viewing leaving request, the multicast channel determination function 16 deletes the request source LLID from the <S, G> column of the multicast viewing management information table 17 and ends the processing (steps S14 and S99).

  If the VID corresponding to <S, G> to be controlled is a dynamic setting target in step S11, the multicast channel determination function 16 determines whether it is a viewing start request or a viewing leaving request (step S21). If it is a viewing start request, the multicast channel determination function 16 searches the multicast viewing management information table for other LLIDs that are viewing the requested <S, G> (step S22). If there is another LLID that is viewing <S, G> in step S23, the multicast channel determination function 16 writes the request source LLID in the <S, G> field requested by the multicast viewing management information table 17, The process ends (steps S24 and S99). On the other hand, if there is no other LLID that is currently viewing <S, G> in step S23, the multicast channel determination function 16 has a dynamic setting target VID specified in the multicast setting management information table 15 within the range. The multicast viewing management information table 17 is searched for an unused VID (step S25).

  If there is an unused dynamic setting target VID in step S26, the multicast channel determination function 16 selects one of the unused dynamic setting target VIDs, and selects <S, G>, VID, and LLID. The set is written in the viewing management information table, and the process ends (steps S26, S27, S99). If there is no unused dynamic setting target VID in step S26, the multicast channel determination function 16 ends the process (step S99).

  If it is a viewing leaving request in step S21, the multicast channel determination function 16 searches the multicast viewing management information table 17 for other LLIDs viewing the requested <S, G> (step S28). If there is another LLID that is viewing <S, G> in step S29, the multicast channel determination function 16 deletes the request source LLID from the requested <S, G> column of the multicast viewing management information table 17 Then, the process ends (steps S30 and S99). If there is no other LLID that is viewing <S, G> in step S29, the multicast channel determination function 16 deletes the <S, G> field from the multicast viewing management information table and ends (step S31, S99).

  With the above operation, a corresponding VID is assigned in advance to a specific static control target <S, G>, and only for a corresponding LLID in response to a viewing start request for the <S, G>. A packet having SA and DA corresponding to the <S, G> is transferred from the UNI. At this time, the table size of the multicast viewing management information table 17 related to the number of VIDs for <S, G> to be statically controlled does not depend on the viewing start request except for the number of registered LLIDs.

  On the other hand, the table size of the multicast viewing management information table 17 related to the number of VIDs for <S, G> to be dynamically controlled depends on the viewing start request. In other words, the more <S, G> requested to start viewing, the greater the number of VIDs required, especially when there is a DoS attack due to an excessive viewing start request. However, the OLT 301 limits the range of VIDs corresponding to <S, G> that are dynamic control targets. For this reason, the table size of the multicast viewing management information table 17 related to the number of VIDs is limited, and SAs corresponding to <S, G> only for LLIDs that can be handled in response to a viewing start request within the range of VIDs. A packet with DA is transferred from UNI.

  For example, the OLT 301 uses a method of statically assigning a VID to a high-priority multicast channel that must be transferred, and dynamically assigning a VID to a low-priority multicast channel that may not be distributed in some cases. A method becomes possible.

  As described above, the OLT 301 transfers only the multicast in the viewing state from the UNI under the viewing request target, statically assigns a VID to a specific multicast channel, and limits the range to another specific multicast channel. By assigning the VID, multicast transfer with enhanced security against DoS attacks due to excessive multicast viewing requests can be realized.

11: SNI
12: Port 13: ONU side interface 14: Multicast viewing request signal reading function 15: Multicast setting management information table 16: Multicast channel determination function 17: Multicast viewing management information table 18: VLAN tag setting function 19: VID filter setting function 301: OLT

Claims (4)

A service node interface (SNI: Service Node Interface) connected to the IP network;
Ports connected to a plurality of subscriber side devices (ONU: Optical Network Unit);
A multicast channel composed of a set of an IP multicast group address and an IP source address including a plurality of ONUs is set, a predetermined VID (Virtual LAN ID) is assigned to each multicast channel in a predetermined range, A controller that assigns any of a predetermined range of VIDs to the multicast channel in the range and forwards a signal between the SNI and the port for each multicast channel;
A station side device (OLT: Optical Line Terminal). The controller is
The OLT according to claim 1, wherein the multicast channel is set by a setting request from the ONU, and the multicast channel is released by a withdrawal request from the ONU.   A multicast channel composed of a set of an IP multicast group address and an IP source address including a plurality of ONUs is set, a predetermined VID is assigned to each multicast channel in a predetermined range, and the multicast channel in another range is assigned. A multicast control method for allocating any of a predetermined range of VIDs.   4. The multicast control method according to claim 3, wherein the multicast channel is set by a setting request from the ONU, and the multicast channel is released by a withdrawal request from the ONU.

Images