JP2017121026A - Multicast communication device and multicast communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a multicast communication device that does not transmit multicast data to a communication terminal not permitted to receive multicast data in IP multicast communication, and a multicast communication method performed by the multicast communication device.SOLUTION: A multicast communication device determines whether transmission of prescribed multicast data is permitted or prohibited at a dedicated port for transmitting the prescribed multicast data to a communication terminal connected via a dedicated line on the basis of terminal identification information included in a first prescribed signal received from the communication terminal, and does not transmit the prescribed multicast data at the dedicated port where the transmission is prohibited.SELECTED DRAWING: Figure 1

Description

The present invention relates to a multicast communication device that transmits multicast data and a multicast communication method that is executed in the multicast communication device.

Conventional IP multicast communication includes, for example, a data distribution terminal that is a communication terminal that transmits a series of data such as video and audio to other communication terminals, and a data reception terminal that is a communication terminal that receives the data and outputs the data. Is used as a communication means for transmitting and receiving the data.

In such a data distribution system, a network device compatible with IP multicast communication is used. The network device here refers to a communication device constituting a network such as a switch or a router. There are network devices that do not support IP multicast communication and network devices that do not support IP multicast communication. When network device receives multicast data, it treats it as broadcast data, and determines the port that received the multicast data. Broadcast transmission to other ports. In the present invention, when the presence / absence of support for IP multicast communication is not described, it refers to a network device compatible with IP multicast communication.

A data distribution terminal that transmits distribution data transmits distribution data by unicast to a network device to which the device itself is connected. The network device that has received the distribution data duplicates and transmits the packet of the distribution data only to a port connected to a data receiving terminal that receives the distribution data or another network device that receives the distribution data.

In other words, in IP multicast communication, packets are duplicated and transmitted over the network as much as necessary, so the processing load on the data distribution terminal or network device that transmits the packet, and the ratio of the packet occupying the communication bandwidth of the network It can be minimized.

By the way, a data distribution terminal that is a transmission source of multicast data distinguishes a multicast group that handles the multicast data by giving a predetermined multicast address to a transmission destination address of a packet to be multicast. Then, the data distribution terminal transmits a registration request message for registering the multicast group to the network device on the network.

The network device that has received the registration request message stores the multicast data transmission source address and the predetermined multicast address to be the target of the multicast group, registers the multicast group, and transmits to other network devices to be connected. The registration request message is transferred.

In addition, a data receiving terminal that receives the multicast data participates in a multicast group that handles the multicast data that is desired to be received, so that the network device on the network transmits the desired multicast data. For this purpose, the data receiving terminal transmits a reception request message for requesting reception of multicast data simultaneously with participation in the multicast group to the network device to which the data receiving terminal is connected.

The network device that has received the reception request message sets a port that has received the reception request message so as to transmit the target multicast data, and forwards the reception request message to another network device to be connected.

In this way, by repeating the transfer of the multicast group registration request message and reception request message between the network devices, the network device port is finally set to transmit multicast data from the data distribution terminal to the data reception terminal. Thus, the data receiving terminal can receive desired multicast data transmitted by the data distribution terminal.

In general, in IP multicast communication, a protocol for transmitting / receiving a message related to multicast and transferring multicast data between the data distribution terminal, the data reception terminal, and the network device as described above is IPv4 ( IGMP (Internet Group Management Protocol) for Internet Protocol version 4) and MLD (Multicast Listener Discovery) for IPv6 (Internet Protocol Version 6) are used.

Here, since IGMP and MLD are protocols corresponding to layer 3 (hereinafter referred to as L3) in the OSI reference model, a network device corresponding to layer 2 (hereinafter referred to as L2) conforms to the above-described IGMP and MLD to IP. For example, an IGMP snooping function or an MLD snooping function can be implemented to handle L3 packets corresponding to IGMP or MLD in order to transmit / receive multicast communication messages or transfer multicast data.

By the way, as a conventional technique for performing the IP multicast communication as described above, there is, for example, Patent Document 1. Patent Document 1 discloses a technique in which a distribution server that distributes content data distributes content to a client terminal in response to a content data distribution request from the client terminal.

However, in the method of Patent Document 1, for example, a network device that does not comply with IGMP or MLD is interposed between the distribution server and the client terminal, so that management and control of a port that transmits multicast data are appropriately performed. Otherwise, a client terminal connected to the network device can arbitrarily receive the multicast data by requesting reception of the desired multicast data. For example, in a conference system using a TV phone or a distribution system that distributes captured video of a surveillance camera, when video data and audio data are distributed by multicast, a client terminal that does not want to permit reception of the data. However, there is a security problem that the data can be received.

For example, there is IGMP + (Internet Group Management Protocol Plus), which is an IGMP extension protocol that combines IP multicast communication and authentication technology. By using a network device that implements such an authentication protocol, when a reception request message is received from an arbitrary communication terminal, the communication terminal is authenticated, and permission or prohibition of participation in the multicast group is determined. It becomes possible to do. When the authentication at this time is successful, the network device on the network permits the communication terminal that has succeeded in authentication to participate in the multicast group and transmits multicast data that is a target of the multicast group. It becomes like this. Also, if the authentication at this time fails, the network device on the network prohibits the communication terminal that has failed authentication from participating in the multicast group, and does not transmit multicast data that is the target of the multicast group. . By using such means, it is possible to prevent a communication terminal on the network from receiving multicast data arbitrarily.

JP2010-245654

In this way, by using a network device that authenticates a communication terminal that requests reception of predetermined multicast data, it is possible to permit only the communication terminal that has succeeded in authentication to receive the multicast data. However, when a network device that does not comply with IGMP or MLD is connected under the network device and a plurality of communication terminals are connected under the network device, one of the plurality of communication terminals is connected. If the authentication for receiving the predetermined multicast data is successful, the multicast data transmitted to the communication terminal that has succeeded in the authentication is broadcast in a network device that does not comply with IGMP or MLD. For other communication terminals that are not successfully authenticated , There is a problem that the multicast data has been transmitted.

The present invention is intended to solve the above-described problems, and a multicast communication device that does not transmit multicast data to a communication terminal that is not permitted to receive multicast data in IP multicast communication and the multicast communication thereof The present invention relates to a multicast communication method executed by an apparatus.

The present invention is included in a dedicated port that is connected to a communication terminal via a dedicated line and transmits predetermined multicast data to the communication terminal, and a first predetermined signal transmitted from the communication terminal and received by the dedicated port. Based on terminal identification information for identifying the communication terminal, a communication management unit that permits or prohibits transmission of the predetermined multicast data to the dedicated port connected to the communication terminal, and transmission is permitted by the communication management unit A multicast communication apparatus comprising: a communication communication unit that transmits the predetermined multicast data to the dedicated port and does not transmit the predetermined multicast data to the dedicated port prohibited from transmitting. is there.

In addition, the present invention provides a dedicated port for connecting to a communication terminal group to which at least one communication terminal belongs via a dedicated line and transmitting predetermined multicast data to the communication terminal group, and the dedicated port transmitted from the communication terminal. Based on the terminal identification information for identifying the communication terminal included in the first predetermined signal received in step (b), the communication terminal that permits or prohibits the communication terminal from receiving the predetermined multicast data, The communication terminal group that prohibits transmission of the predetermined multicast data to the dedicated port connected to the communication terminal group to which the communication terminal belongs, and does not belong to the communication terminal that is prohibited from receiving, and to which the communication terminal that is permitted to receive belongs. A communication management unit that permits transmission of the predetermined multicast data to the dedicated port connected to the network, and transmission by the communication management unit A multicast communication unit that transmits the predetermined multicast data to the permitted dedicated port and does not transmit the predetermined multicast data to the dedicated port prohibited from transmitting. It is a communication device.

In addition, the present invention is transmitted from the communication terminal connected in the dedicated connection step, the dedicated connection step of connecting a communication terminal and a dedicated port for transmitting predetermined multicast data to the communication terminal via a dedicated line. Transmission that permits or prohibits transmission of the predetermined multicast data to the dedicated port connected to the communication terminal based on terminal identification information that identifies the communication terminal included in the first predetermined signal received at the dedicated port The predetermined multicast data is transmitted to the dedicated port permitted to transmit in the permission determination step and the transmission permission determination step, and the predetermined multicast data is not transmitted to the dedicated port prohibited from transmission. There is a multicast communication method characterized by comprising a communication communication step.

Further, the present invention provides a dedicated connection step for connecting a communication terminal group to which at least one communication terminal belongs and a dedicated port for transmitting predetermined multicast data to the communication terminal group via a dedicated line, and the dedicated connection step. The predetermined multicast data is transmitted to the communication terminal based on terminal identification information for identifying the communication terminal included in the first predetermined signal transmitted from the communication terminal of the communication terminal group connected by the terminal and received at the dedicated port. A reception permission / prohibition determining step for permitting or prohibiting reception, and transmission of the predetermined multicast data to the dedicated port connected to the communication terminal group to which the communication terminals prohibited from reception belong in the reception permission determination step The communication terminal that is prohibited from receiving does not belong, and is connected to the communication terminal group to which the communication terminal that is permitted to receive belongs. In the transmission permission / inhibition determining step for permitting transmission of the predetermined multicast data to the dedicated port, and in the transmission permission / inhibition determining step, the predetermined multicast data is transmitted to the dedicated port permitted to transmit, and transmission is prohibited. And a communication step of not transmitting the predetermined multicast data to the dedicated port.

According to the present invention, the dedicated port of the multicast communication device and the communication terminal are directly connected via the dedicated line, and based on the terminal identification information of the communication device included in the first predetermined signal received by the dedicated port. Thus, it is possible to permit or prohibit transmission of the predetermined multicast data to a dedicated port connected to the communication terminal. As a result, there is an effect that transmission of the predetermined multicast data can be suppressed to a communication terminal that is not permitted to receive the predetermined multicast data regardless of the communication path between the multicast communication device and the communication terminal.

Further, according to the present invention, the network device connected to the communication terminal group to which at least one communication terminal belongs is connected to the dedicated port of the multicast communication device via the dedicated line, and the first port received by the dedicated port is received. Based on the terminal identification information of the communication device included in the predetermined signal, it is possible to permit or prohibit transmission of the predetermined multicast data to a dedicated port connected to the communication terminal group. As a result, when communication terminals that are not permitted to receive predetermined multicast data belong to a group of communication terminals connected to the dedicated port of the multicast communication device, it is possible to suppress transmission of the predetermined multicast data from the dedicated port Is obtained.

1 is a system configuration diagram showing an IP multicast communication system in a first embodiment. It is a block diagram which shows the hardware constitutions and software constitution of a multicast communication apparatus. It is a flowchart figure which shows the process which permits or prohibits transmission of predetermined multicast data in a multicast communication apparatus. 6 is a block diagram showing a hardware configuration and a software configuration of a multicast communication apparatus in Embodiment 2. FIG. It is a flowchart figure which shows the process which prohibits transmission of predetermined multicast data in a multicast communication apparatus. FIG. 10 is a block diagram illustrating a hardware configuration and a software configuration of a multicast communication apparatus in a third embodiment. It is a flowchart figure which shows the process which prohibits transmission of predetermined multicast data in a multicast communication apparatus.

In the embodiment described below, unless it is particularly necessary to distinguish between IPv4 and IPv6, addresses handled by both protocols are described as IP addresses.

Embodiment 1 FIG.
FIG. 1 is a system configuration diagram showing an IP multicast communication system in the first embodiment. The IP multicast communication system includes a multicast communication device 101, a multicast distribution terminal 102, an internal communication terminal 103, an external communication terminal 104, an internal network 105, an external network 106, and network devices 107 and 108.

The multicast communication device 101 of FIG. 1 and the multicast distribution terminal 102, the internal communication terminal 103, and the external communication terminal 104 are directly connected by VPN.

The network device 107 is a network device that supports IP multicast communication among communication devices that constitute a network such as a switch and a router, and is a device that has a function of performing multicast data transfer control in particular.

Multicast data transfer control refers to control for transferring multicast data to a communication terminal that receives predetermined multicast data. The network device 107 stores an IP address of a communication terminal such as the multicast distribution terminal 102 that is a transmission source of multicast data and a predetermined multicast address of a transmission destination of the multicast data. Then, the multicast group identified by the multicast address is registered according to the message from the communication terminal that is the multicast data transmission source. When the network device 107 that has registered the multicast group receives a reception request message requesting reception of multicast data that is a target of the multicast group, the network device 107 selects a port connected to the communication terminal that has transmitted the reception request message, and Set as the destination of multicast data.

Unlike the network device 107, the network device 108 is a network device that does not support IP multicast communication. For this reason, when multicast data is received, it is broadcast without being transferred to other ports except the received port.

The multicast communication apparatus 101 connects to the multicast distribution terminal 102, the internal communication terminal 103, or the external communication terminal 104 directly or via a network, and receives multicast data received from the multicast distribution terminal 102 as the internal communication terminal 103 or the external communication terminal 104. It is a communication apparatus which transmits with respect to. The network here refers to the internal network 105 or the external network 106. For example, in the distribution system for the captured video of the surveillance camera, the multicast communication apparatus 101 corresponds to the network device 107.

The multicast distribution terminal 102 is a communication terminal that distributes multicast data such as distribution data to the internal communication terminal 103 and the external communication terminal 104 that are the above-described data receiving terminals, such as the above-described data distribution terminal. The multicast distribution terminal 102 forms a multicast group as described above, and registers the multicast group in the network device 107 on the network such as the multicast communication apparatus 101 using a message conforming to a protocol such as IGMP or MLD. For example, in a distribution system for captured video of a surveillance camera, the multicast distribution terminal 102 corresponds to a surveillance camera having a communication function that transmits captured video data and collected audio data to a remote location.

The internal communication terminal 103 is a communication terminal that is connected to an internal network 105 as a LAN (Local Area Network) and receives multicast data distributed by the multicast distribution terminal 102. The external communication terminal 104 is a communication terminal that is connected to an external network 106 as a WAN (Wide Area Network) and receives multicast data distributed by the multicast distribution terminal 102.

The internal communication terminal 103 may be directly connected to the multicast communication device 101, or may be connected under the network device 107 or the network device 108 connected to the multicast communication device 101 as shown in FIG. The same applies to the external communication terminal 104.

The internal communication terminal 103 or the external communication terminal 104 transmits a reception request message for requesting reception of predetermined multicast data to a connected network device in accordance with a protocol such as IGMP or MLD, and the multicast group of the multicast data Multicast data is received from the network device 107 that has registered. For example, in the distribution system for the captured video of the surveillance camera, the internal communication terminal 103 and the external communication terminal 104 receive the video data captured by the surveillance camera and the collected audio data, and output the received data using a display device, a speaker, or the like. It corresponds to a monitoring monitor.

Here, for simplicity of explanation, the multicast distribution terminal 102, the internal communication terminal 103, and the external communication terminal 104 are collectively referred to as a multicast communication terminal 109, and the internal communication terminal 103 and the external communication terminal 104 are collectively referred to as a multicast receiving terminal 110. It describes.

Even when the multicast communication device 101 is connected to a plurality of multicast distribution terminals 102, a plurality of multicast groups are registered, and a plurality of multicast data are distinguished by a multicast address corresponding to each multicast group, and a multicast receiving terminal 110 can be transmitted. On the other hand, even when the multicast communication apparatus 101 handles a plurality of multicast groups, the multicast receiving terminal 110 can receive the multicast data by specifying a predetermined multicast group in the reception request message. .

The multicast communication device 101 does not have to be a communication device such as the network device 107. For example, the multicast communication device 101 includes a storage medium (not shown) such as a distribution server to hold distribution data and transmit the distribution data. It may be a device that performs.

By the way, when the multicast receiving terminal 110 transmits a reception request message to the multicast communication apparatus 101, predetermined authentication is performed between the multicast communication apparatus 101 and the multicast receiving terminal 110. At this time, the multicast communication apparatus 101 determines the success or failure of authentication based on the terminal identification information included in the authentication packet for predetermined authentication received from the multicast receiving terminal 110 and capable of identifying the multicast receiving terminal 110. Then, permission or prohibition of reception of predetermined multicast data that is a target of the reception request message is determined for the multicast receiving terminal 110. The predetermined authentication here may be started from the multicast communication apparatus 101 side or from the multicast receiving terminal 110 side.

For the predetermined authentication at this time, the means capable of identifying the multicast receiving terminal 110 such as the above-described IGMP +, or other protocols such as SIP (Session Initiation Protocol) or Radius (Remote Authentication Dial In User Service), for example. Is used.

Further, the process of authenticating the multicast receiving terminal 110 in the predetermined authentication may be performed by a functional unit included in the multicast communication apparatus 101. For example, information regarding the multicast receiving terminal 110 is obtained by communicating with an authentication server on a network (not shown). The multicast communication apparatus 101 may use the result of authentication performed by the authentication server.

As described above, when the multicast communication apparatus 101 handles a plurality of multicast groups, different authentications may be performed for each multicast group as the predetermined authentication. Thus, by performing different authentication corresponding to the multicast group, it is possible to determine the multicast receiving terminal 110 that permits reception for each multicast data.

FIG. 2 is a block diagram illustrating a hardware configuration and a software configuration of the multicast communication apparatus 101. The multicast communication apparatus 101 includes a LAN physical port 201 and a WAN physical port 202 as a hardware configuration, and a LAN logical port 203, a packet transfer unit 204, a VPN logical port generation unit 205, a VPN termination unit 206, and a bridge connection as software configurations. Unit 207 and communication management unit 208.

The LAN physical port 201 is a physical port for connecting to the multicast distribution terminal 102 and the internal communication terminal 103 via the internal network 105. The WAN physical port 202 is a physical port for connecting to the external communication terminal 104 via the external network 106. The LAN logical port 203 is a logical port that aggregates communications on the LAN physical port 201 side, and is generated on a memory (not shown), for example, when the multicast communication apparatus 101 is activated.

The packet transfer unit 204 is a functional unit that performs packet transfer corresponding to layer 3 of the OSI reference model between the WAN physical port 202 and the LAN logical port 203. By the transfer processing in the packet transfer unit 204, communication is possible between the multicast communication terminals 109 connected to the WAN physical port 202 side and the LAN logical port 203 side, respectively.

The VPN logical port generation unit 205 displays a VPN logical port 209 that is a logical port each time the multicast communication terminal 109 connects to the multicast communication apparatus 101 from the LAN physical port 201 or WAN physical port 202 side, for example, It is a functional part generated on the memory that does not.

In the first embodiment, the VPN logical port 209 is a dedicated port provided in the multicast communication apparatus 101 in one-to-one correspondence with the connected multicast communication terminal 109 and is connected to the connected multicast communication terminal 109 by VPN. To do. VPN here refers to L2VPN, but may be VPN other than L2VPN.

The VPN termination unit 206 is a functional unit that establishes a VPN connection between the multicast communication terminal 109 and the VPN logical port 209 and terminates the VPN communication. At this time, the VPN termination unit 206 controls the VPN logical port generation unit 205 to generate the VPN logical port 209 corresponding to the multicast communication terminal 109. The VPN at this time uses a protocol such as L2TP (Layer 2 Tunneling Protocol) that allows direct two-way communication without depending on the communication path.

The bridge connection unit 207 is a communication communication unit, and is a functional unit that communicates communication among the LAN physical port 201, the LAN logical port 203, and the generated VPN logical port 209. As means for communicating the communication at this time, for example, there is a connection by a software bridge such as an L2 software bridge or a hardware bridge. The bridge connection unit 207 can set whether or not to transmit / receive a packet designated by the communication management unit 208 to each bridge-connected port according to the control of the communication management unit 208 described later.

In particular, the multicast distribution terminal 102 and the multicast reception terminal 110 and the VPN logical port 209 are connected by L2VPN, and the bridge connection unit 207 communicates communication between the VPN logical ports 209 using the L2 software bridge, so that the multicast communication apparatus 101, even when the multicast distribution terminal 102 and the multicast receiving terminal 110 belong to different network segments such as remote locations, it is possible to perform IP multicast communication over a secure network without being aware of the difference in network segments. .

The communication management unit 208 is a functional unit that manages and controls connection and communication between the VPN logical port 209 generated in the multicast communication apparatus 101 and the multicast communication terminal 109.

The process of connecting the VPN logical port 209 of the multicast communication apparatus 101 and the multicast communication terminal 109 via VPN is as follows. First, the communication management unit 208 establishes communication with the multicast communication terminal 109 connected to the LAN physical port 201 or the WAN physical port 202 via the bridge connection unit 207. Next, the VPN termination unit 206 acquires information of the multicast communication terminal 109 from the communication management unit 208 and generates a VPN logical port 209 that is a dedicated port corresponding to the multicast communication terminal 109. Next, the VPN termination unit 206 uses the communication established by the communication management unit 208 to establish a VPN connection between the generated VPN logical port 209 and the multicast communication terminal 109. When the VPN connection is established, communication can be performed directly between the multicast communication terminal 109 and the VPN logical port 209 via the VPN.

Each multicast communication terminal 109 that is VPN-connected to the VPN logical port 209 can perform communication between any VPN logical ports 209 that are bridge-connected by appropriately setting the bridge connection in the bridge connection unit 207. Communication between the multicast communication terminals 109 is also possible.

Further, the communication management unit 208 receives the reception request message transmitted from the multicast receiving terminal 110 and transmits / receives an authentication packet in the predetermined authentication after that via the VPN termination unit 206.

In this way, the communication management unit 208 determines the success or failure of authentication based on the terminal identification information included in the authentication packet for predetermined authentication received from the multicast receiving terminal 110, and Thus, permission or prohibition of reception of predetermined multicast data can be determined.

In the present invention, a signal including terminal identification information for identifying a communication terminal, such as an authentication packet or a SIP message for the predetermined authentication described above, is set as a first predetermined signal. That is, the success of the predetermined authentication by the communication terminal indicates that the communication terminal is determined to be properly connected based on the terminal identification information included in the first predetermined signal transmitted by the communication terminal. Failure of the predetermined authentication indicates that the communication terminal is determined to be illegally connected based on the terminal identification information included in the first predetermined signal transmitted by the communication terminal.

Then, when the multicast receiving terminal 110 succeeds in the predetermined authentication, the communication management unit 208 permits the multicast receiving terminal 110 to receive the predetermined multicast data, and the VPN logic in which the multicast receiving terminal 110 is VPN-connected. When the transmission of the predetermined multicast data is permitted to the port 209 and the predetermined authentication fails, the multicast receiving terminal 110 is prohibited from receiving the predetermined multicast data and the VPN to which the multicast receiving terminal 110 is connected to the VPN The transmission of the predetermined multicast data is prohibited to the logical port 209.

Further, the communication management unit 208 refers to the permission or prohibition state of transmission of the predetermined multicast data in the VPN logical port 209, and once prohibits transmission of the predetermined multicast data to the VPN logical port 209, Even if the multicast receiving terminal 110 that is VPN-connected to the VPN logical port 209 is permitted to receive the predetermined multicast data, the VPN logical port 209 may not be permitted to transmit the predetermined multicast data. The reception of the predetermined multicast data may not be permitted to the multicast receiving terminal 110 that is VPN-connected to the VPN logical port 209 that is prohibited from transmitting the predetermined multicast data.

In this way, if the multicast receiving terminal 110 that is VPN-connected to the VPN logical port 209 fails even once, the predetermined multicast data is not transmitted to the multicast receiving terminal 110 from the viewpoint of security. As described above, it is possible to obtain an effect of maintaining the transmission of the predetermined multicast data in a prohibited state with respect to the VPN logical port 209 that is VPN-connected to the multicast receiving terminal 110.

Also, the communication management unit 208 determines whether the multicast communication terminal 109 is appropriate when establishing communication with the multicast communication terminal 109 or establishing a VPN connection between the VPN logical port 209 and the multicast communication terminal 109. In order to determine whether or not, predetermined authentication or other authentication may be performed, and the result of the authentication at this time may be used to determine whether or not predetermined multicast data can be received.

The connection between the VPN logical port 209 and the multicast communication terminal 109 may not be a wired connection, and the multicast communication device 101 and the multicast communication terminal 109 include wireless communication hardware (not shown), and the VPN logical port 209 and the multicast communication terminal 109 109 may be wirelessly connected to the network via the bridge of the bridge connection unit 207.

FIG. 3 is a flowchart showing processing for permitting or prohibiting transmission of predetermined multicast data in the multicast communication apparatus 101. Here, the multicast communication apparatus 101 and the multicast receiving terminal 110 are connected by VPN at the VPN logical port 209.

In process S301, the communication management unit 208 determines whether or not a reception request message requesting reception of predetermined multicast data has been received from the multicast receiving terminal 110. If a reception request message has been received, the process proceeds to step S302. If no reception request message has been received, the process returns to step S301.

In step S302, the communication management unit 208 performs predetermined authentication with the multicast receiving terminal 110 that has transmitted the reception request message. Then, it progresses to process S303.

In step S303, the communication management unit 208 determines whether the multicast receiving terminal 110 has succeeded in predetermined authentication. As described above, the process for determining success or failure of authentication at this time may be performed by performing authentication with the communication management unit 208, or performing authentication with another authentication server installed on the network, The determination may be made by acquiring the authentication result. If the authentication is successful, the process proceeds to step S304. If the authentication fails, the process proceeds to step S306.

In step S304, the communication management unit 208 permits the multicast receiving terminal 110 that has been successfully authenticated to receive predetermined multicast data, and transmits the predetermined multicast data to the VPN logical port 209 to which the multicast receiving terminal 110 is connected. Is notified and the bridge connection unit 207 is notified of this. Then, it progresses to process S305.

In process S305, when the bridge connection unit 207 receives the notification from the communication management unit 208 in process S304, the bridge connection unit 207 is configured to transmit predetermined multicast data to the VPN logical port 209 connected to the multicast receiving terminal 110 that has been successfully authenticated. I do. Thereafter, the process ends.

As a result of the processing S305, the multicast communication apparatus 101 transmits the predetermined multicast data only to the VPN logical port 209 connected to the multicast receiving terminal 110 that is permitted to receive the predetermined multicast data. Only the multicast receiving terminal 110 that is directly connected with the VPN can receive the predetermined multicast data.

In step S306, the communication management unit 208 prohibits the multicast receiving terminal 110 that has failed in authentication from receiving predetermined multicast data, and transmits the predetermined multicast data to the VPN logical port 209 to which the multicast receiving terminal 110 is connected. Is prohibited and the fact is notified to the bridge connection unit 207. Then, it progresses to process S307.

In process S307, when the bridge connection unit 207 receives the notification from the communication management unit 208 in process S306, the bridge connection unit 207 is configured not to transmit predetermined multicast data to the VPN logical port 209 connected to the multicast reception terminal 110 that has failed in authentication. I do. Thereafter, the process ends.

As a result of step S307, the multicast communication apparatus 101 does not transmit the predetermined multicast data to the VPN logical port 209 connected to the multicast receiving terminal 110 that is prohibited from receiving the predetermined multicast data. Multicast receiving terminal 110 directly connected with VPN cannot receive the predetermined multicast data.

Here, after the multicast communication apparatus 101 receives a reception request message from the multicast receiving terminal 110 or transmits an authentication packet for predetermined authentication to the multicast receiving terminal 110, the multicast receiving terminal within a predetermined time. When an authentication packet is not received from 110, the multicast receiving terminal 110 may be prohibited from receiving predetermined multicast data. By doing so, the illegally connected multicast receiving terminal 110 does not perform the predetermined authentication or does not succeed in the predetermined authentication, so that the illegally connected multicast receiving terminal 110 is more reliably detected. Thus, reception of predetermined multicast data can be prohibited. Here, a signal corresponding to the first predetermined signal described above, which is transmitted from the multicast communication apparatus 101 to the multicast receiving terminal 110, is defined as a second predetermined signal.

In this way, the VPN logical port 209 of the multicast communication apparatus 101 and the multicast receiving terminal 110 are directly VPN-connected, and the terminal of the multicast receiving terminal 110 included in the authentication packet of the predetermined authentication received at the VPN logical port 209. Based on the identification information, it becomes possible to permit or prohibit transmission of the predetermined multicast data to the VPN logical port 209 connected to the multicast receiving terminal 110. As a result, regardless of the communication path between the multicast communication device 101 and the multicast receiving terminal 110, transmission of the predetermined multicast data can be suppressed to the multicast receiving terminal 110 that is not permitted to receive the predetermined multicast data. An effect is obtained.

According to the first embodiment, the VPN logical port 209 of the multicast communication apparatus 101 and the multicast receiving terminal 110 are directly VPN-connected, and the multicast receiving terminal included in the first predetermined signal received by the VPN logical port 209 Based on the terminal identification information for identifying 110, transmission of the predetermined multicast data can be permitted or prohibited for the VPN logical port 209 connected to the multicast receiving terminal 110. As a result, regardless of the communication path between the multicast communication device 101 and the multicast receiving terminal 110, transmission of the predetermined multicast data can be suppressed to the multicast receiving terminal 110 that is not permitted to receive the predetermined multicast data. An effect is obtained.

Further, according to the first embodiment, after receiving the reception request message from the multicast receiving terminal 110 or transmitting the second predetermined signal to the multicast receiving terminal 110, the multicast receiving terminal within a predetermined time. When the first predetermined signal is not received from 110, the multicast receiving terminal 110 is prohibited from receiving predetermined multicast data, and the reception request is sent to the VPN logical port 209 that has received the reception request message. It is possible to prohibit transmission of predetermined multicast data to be a message target. As a result, since the illegally connected multicast receiving terminal 110 does not transmit the first predetermined signal or is not determined to be appropriate based on the first predetermined signal, the illegally connected multicast receiving terminal 110 is detected. Thus, an effect of suppressing transmission of predetermined multicast data can be obtained.

Further, according to the first embodiment, it is possible to connect the multicast distribution terminal 102 and the multicast reception terminal 110 and the VPN logical port 209 with L2VPN, and to communicate the communication between the VPN logical ports 209 using the L2 software bridge. It becomes. As a result, even when the multicast communication device 101, the multicast distribution terminal 102, and the multicast reception terminal 110 belong to different network segments such as remote locations, IP multicast communication is performed by a secure network without being aware of the difference in network segments. The effect that can be performed is obtained.

Embodiment 2. FIG.
In the first embodiment, in the multicast communication apparatus 101, the multicast receiving terminal 110 and the VPN logical port 209 corresponding to the multicast receiving terminal 110 are directly connected by VPN, and predetermined authentication is performed between the multicast receiving terminal 110 and the multicast receiving terminal 110. The predetermined multicast data is transmitted to the multicast receiving terminal 110 that is not permitted to receive the predetermined multicast data by permitting or prohibiting the transmission of the multicast data to the VPN logical port 209 according to the result. Suppressed that. In the second embodiment, reception of the predetermined multicast data is permitted under the VPN logical port 209 that is permitted to transmit predetermined multicast data based on the result of performing predetermined authentication with the multicast receiving terminal 110. It is detected that another multicast receiving terminal 110 that is not connected is connected, and multicast data is prevented from being transmitted to the other multicast receiving terminal 110.

As shown in FIG. 1, the VPN logical port 209 of the multicast communication apparatus 101 is connected not only to the multicast receiving terminal 110 but also to a communication device such as the network device 107 or 108, and a plurality of subordinates under the communication device. If the network configuration connects the multicast receiving terminal 110, the multicast receiving terminal 110 and the VPN logical port 209 do not correspond one-to-one, and a plurality of multicast receiving terminals 110 correspond to the VPN logical port 209.

In such a network configuration, for example, at least one multicast receiving terminal 110 connected under the network device 108 to which the VPN from the VPN logical port 209 has terminated succeeds in predetermined authentication. The communication management unit 208 permits the VPN logical port 209 to transmit predetermined multicast data that is the target of the reception request message.

Then, the predetermined multicast data may be transmitted to other multicast receiving terminals 110 that are connected under the network device 108 and are not permitted to receive the predetermined multicast data. This is a security issue. In the second embodiment, means for solving such a problem will be described.

FIG. 4 is a block diagram showing a hardware configuration and a software configuration of multicast communication apparatus 101 in the second embodiment. The multicast communication apparatus 101 further includes a message search unit 401 and a storage unit 402. Other configurations are the same as those in FIG.

The message search unit 401 searches the reception request message received by any one of the LAN physical port 201, the LAN logical port 203, or the VPN logical port 209 in the bridge connection unit 207, and notifies information related to the reception request message. It is a functional part. The message snooping unit 401 sends to the communication management unit 208 information on the port that has received the reception request message, identification information of the multicast receiving terminal 110 that has transmitted the reception request message, and multicast that is the target of the received reception request message. Notify the data identification information.

The identification information of the multicast receiving terminal 110 is information for identifying the multicast receiving terminal 110 on the network, such as an IP address or a MAC address. Further, the multicast data identification information is information for identifying a multicast group, such as a multicast address or a source address assigned to a destination address. The present invention will be described using an IP address as identification information of the multicast receiving terminal 110 and a multicast address as identification information of multicast data.

The storage unit 402 is a storage medium that stores the VPN logical port 209, the IP address of the multicast receiving terminal 110, and the multicast address of predetermined multicast data in association with each other.

The communication management unit 208 sends the IP address of the multicast receiving terminal 110 that has transmitted the reception request message and succeeded in the predetermined authentication, and the multicast address of the predetermined multicast data permitted to be received by the multicast receiving terminal 110 to the multicast The information is stored in the storage unit 402 in association with the VPN logical port 209 corresponding to the receiving terminal 110.

Here, the VPN logical port 209 is VPN-connected to a communication device such as the network device 107 or 108, and a plurality of multicast receiving terminals 110 are permitted to receive predetermined multicast data for one VPN logical port 209. When the status corresponds, the multicast addresses of the plurality of multicast receiving terminals 110 and predetermined multicast data may be stored in the storage unit 402 in association with the VPN logical port 209.

If the notified port is the VPN logical port 209 in response to the notification from the message search unit 401, the communication management unit 208 refers to the storage unit 402 and notifies the notified multicast receiving terminal 110. When it is determined whether reception of the notified multicast data has already been permitted and it is determined that reception has not yet been permitted, the multicast reception terminal 110 that has transmitted the reception request message is notified of the predetermined multicast data. In addition to prohibiting reception, the VPN logical port 209 that has received the reception request message is prohibited from transmitting predetermined multicast data that is the target of the reception request message.

Further, the communication management unit 208 refers to the permission or prohibition state of transmission of the predetermined multicast data in the VPN logical port 209, and once prohibits transmission of the predetermined multicast data to the VPN logical port 209, The multicast receiving terminal 110 connected to the end of the VPN logical port 209 that is prohibited from transmitting the predetermined multicast data is not permitted to receive the predetermined multicast data.

In this way, if the multicast receiving terminal 110 connected to the end of the VPN logical port 209 fails even once, the predetermined multicast data is transmitted to the multicast receiving terminal 110 from the viewpoint of security. As a result, the transmission of the predetermined multicast data to the VPN logical port 209 to which the multicast receiving terminal 110 is connected can be maintained in a prohibited state.

FIG. 5 is a flowchart showing processing for prohibiting transmission of predetermined multicast data in the multicast communication apparatus 101. Here, the flowchart of FIG. 5 starts when predetermined authentication is performed between the multicast communication apparatus 101 and the multicast receiving terminal 110 and reception of predetermined multicast data is permitted.

In the process S501, when the communication management unit 208 permits the multicast receiving terminal 110 connected to the VPN logical port 209 directly or via the network to receive predetermined multicast data, the information on the VPN logical port 209, The IP address of the multicast receiving terminal 110 and the multicast address of the multicast data are associated and stored in the storage unit 402. Then, it progresses to process S502.

In process S502, the message search unit 401 determines whether a reception request message has been received at any of the LAN physical port 201, the LAN logical port 203, or the VPN logical port 209. If received, the process proceeds to step S503. If not received, the process S502 is performed again.

In step S503, the message search unit 401 sends to the communication management unit 208 the port that received the reception request message in step S502, the IP address of the multicast receiving terminal that transmitted the reception request message, and the multicast that is the target of the reception request message. Notify the data multicast address. Then, it progresses to process S504.

In step S504, the communication management unit 208 determines whether the port that received the reception request message is the VPN logical port 209 based on the information notified from the message snooping unit 401 in step S503. If it is the VPN logical port 209, the processing proceeds to step S505. If it is not the VPN logical port 209, the process S502 is performed again.

In process S505, the communication management unit 208 applies the target of the reception request message to the multicast receiving terminal 110 that has transmitted the reception request message based on the information stored in the storage unit 402 and the information notified from the message snooping unit 401. It is determined whether or not reception of multicast data is already permitted. If permitted, the process S502 is performed again. If not permitted, the process proceeds to step S506.

In step S506, the communication management unit 208 prompts the multicast receiving terminal 110 that has transmitted the reception request message to perform predetermined authentication. Here, when predetermined authentication is started from the multicast receiving terminal 110 side and an authentication packet is received, the communication management unit 208 performs the started authentication processing, and predetermined authentication starts from the multicast receiving terminal 110 side. If not, a predetermined authentication may be started from the communication management unit 208 side and an authentication packet may be transmitted, or the authentication packet may be received from the multicast receiving terminal 110 within a predetermined time. Then, it progresses to process S507.

In step S507, the communication management unit 208 determines whether or not the multicast receiving terminal 110 that has transmitted the reception request message has succeeded in the predetermined authentication. The determination of the predetermined authentication here is the same as in the first embodiment, and may be determined based on the result of transmitting / receiving the authentication packet, or may be determined depending on whether the authentication packet is received within a predetermined time. May be. If the predetermined authentication is successful, step S501 is performed. If the predetermined authentication is not successful, the process proceeds to step S508.

In process S508, the bridge connection unit 207 determines the multicast data that is the target of the reception request message for the VPN logical port 209 that has received the reception request message in process S502 based on the determination of the communication management unit 208 in process S505. Prohibit sending. Thereafter, the process ends.

By the way, in the flowchart of FIG. 5, the multicast receiving terminal 110 that has succeeded in the predetermined authentication and is permitted to receive the predetermined multicast data receives the other multicast data that is the target of another registered multicast group. When the reception request message is transmitted, since the multicast address of the other multicast data is not associated with the storage unit 402, not only the reception of other multicast data is not permitted, but also the predetermined multicast data that has already been permitted to be received. May not be able to be received.

For this reason, in step S505 of the flowchart of FIG. 5, when the information stored in the storage unit 402 and the information of the received reception request message are compared and only the multicast address is different, the predetermined authentication fails in step S506. However, reception of already permitted multicast data may not be prohibited. In this way, for example, when a properly connected multicast receiving terminal 110 wishes to add or change the received multicast data, it is not necessary to prohibit the reception of already permitted multicast data. It is possible to improve the convenience of reception.

In step S508, the communication management unit 208 may notify the multicast receiving terminal 110 that has already permitted the reception of multicast data that the transmission of the multicast data is changed from permitted to prohibited.

In this way, when at least one multicast receiving terminal 110 is connected to the network device 108 to which the VPN from the VPN logical port 209 of the multicast communication apparatus 101 is terminated, the predetermined authentication received at the VPN logical port 209 is received. Based on the terminal identification information of the multicast receiving terminal 110 included in the authentication packet, the VPN logical port 209 connected to the network device 108 can be permitted or prohibited from transmitting the predetermined multicast data. As a result, when a multicast receiving terminal 110 that is not permitted to receive predetermined multicast data is connected to the network device 108 that is connected to the VPN logical port 209 of the multicast communication apparatus 101, An effect of suppressing transmission of the predetermined multicast data can be obtained.

Further, the multicast communication device 101 stores information related to the multicast receiving terminal 110 that has succeeded in the predetermined authentication, so that when the reception request message transmitted from the multicast receiving terminal 110 is received, the multicast receiving terminal already has 110 determines whether or not the reception of the predetermined multicast data is permitted. When it is determined that the reception is not permitted, the VPN logical port 209 that has received the reception request message is notified of the reception request message. It becomes possible to prohibit transmission of predetermined multicast data as a target. As a result, when the multicast receiving terminal 110 connected to the VPN logical port 209 transmits a reception request message to receive predetermined multicast data, it is possible to detect the illegally connected multicast receiving terminal 110, There is an effect that transmission of the predetermined multicast data can be suppressed to the illegally connected multicast receiving terminal 110.

According to the second embodiment, when at least one multicast receiving terminal 110 is connected to the network device 108 to which the VPN from the VPN logical port 209 of the multicast communication apparatus 101 is terminated, reception is performed at the VPN logical port 209. Based on the terminal identification information of the multicast receiving terminal 110 included in the first predetermined signal, the VPN logical port 209 connected to the network device 108 can be permitted or prohibited from transmitting the predetermined multicast data. Become. As a result, when a multicast receiving terminal 110 that is not permitted to receive predetermined multicast data is connected to the network device 108 that is connected to the VPN logical port 209 of the multicast communication apparatus 101, An effect of suppressing transmission of the predetermined multicast data can be obtained.

Further, according to the second embodiment, the multicast communication apparatus 101 stores information related to the multicast reception terminal 110 that is determined to be appropriate based on the information included in the first predetermined signal. When the received reception request message is received, it is determined whether or not the multicast receiving terminal 110 is already permitted to receive the predetermined multicast data, and when it is determined that the reception is not permitted, the reception is performed. The VPN logical port 209 that has received the request message can be prohibited from transmitting predetermined multicast data that is the target of the reception request message. As a result, when the multicast receiving terminal 110 connected to the VPN logical port 209 transmits a reception request message to receive predetermined multicast data, it is possible to detect the illegally connected multicast receiving terminal 110, There is an effect that transmission of the predetermined multicast data can be suppressed to the illegally connected multicast receiving terminal 110.

Further, according to the second embodiment, after receiving the reception request message from the multicast receiving terminal 110 or transmitting the second predetermined signal to the multicast receiving terminal 110, the multicast receiving terminal within a predetermined time. When the first predetermined signal is not received from 110, the multicast receiving terminal 110 is prohibited from receiving predetermined multicast data, and the reception request is sent to the VPN logical port 209 that has received the reception request message. It is possible to prohibit transmission of predetermined multicast data to be a message target. As a result, since the illegally connected multicast receiving terminal 110 does not transmit the first predetermined signal or is not determined to be appropriate based on the first predetermined signal, the illegally connected multicast receiving terminal 110 is detected. Thus, an effect of suppressing transmission of predetermined multicast data can be obtained.

Embodiment 3 FIG.
In the second embodiment, even when a plurality of multicast receiving terminals 110 are connected to the VPN logical port 209 of the multicast communication apparatus 101, information regarding the multicast receiving terminal 110 that has succeeded in the predetermined authentication is stored. By comparing the information contained in the received reception request message with the stored information, the multicast receiving terminal 110 illegally connected to the VPN logical port 209 is detected, and transmission of predetermined multicast data to the VPN logical port 209 is detected. And the transmission of the predetermined multicast data to the illegally connected multicast receiving terminal 110 is suppressed. In the third embodiment, the transmission of multicast data to the VPN logical port 209 is prohibited for any packet received at the VPN logical port 209, thereby further improving the security.

FIG. 6 is a block diagram showing a hardware configuration and a software configuration of multicast communication apparatus 101 in the third embodiment. The multicast communication apparatus 101 further includes a packet snooping unit 601. Other configurations are the same as those in FIG.

The packet search unit 601 is a functional unit that searches for a packet received by the VPN logical port 209 in the bridge connection unit 207 and notifies information about the packet. The packet searching unit 601 notifies the communication management unit 208 of information on the VPN logical port 209 that has received the packet and identification information on the multicast receiving terminal 110 that has transmitted the packet. The identification information of the multicast receiving terminal 110 is information for identifying the multicast receiving terminal 110 on the network, such as an IP address or a MAC address. In the present invention, description will be made using an IP address as identification information of the multicast receiving terminal 110.

Note that packets sought by the packet snooping unit 601 may include those transmitted by devices other than the multicast receiving terminal 110 such as communication devices such as the network devices 107 and 108. Information on packets to be excluded is set in advance.

FIG. 7 is a flowchart showing processing for prohibiting transmission of predetermined multicast data in the multicast communication apparatus 101. Here, the flowchart of FIG. 7 starts from a point in time when predetermined authentication is performed between the multicast communication apparatus 101 and the multicast receiving terminal 110 and reception of predetermined multicast data is permitted.

The process S701 is the same as the process S501 in FIG. Then, it progresses to process S702.

In step S702, the packet snooping unit 601 determines whether a packet has been received by the VPN logical port 209. If received, the process proceeds to step S703. If not received, the process S702 is performed again.

In step S703, the packet search unit 601 notifies the communication management unit 208 of the port that received the packet in step S702 and the IP address of the multicast receiving terminal that transmitted the packet. Then, it progresses to process S704.

In step S704, the communication management unit 208 determines whether the multicast receiving terminal 110 that has transmitted the packet has already succeeded in the predetermined authentication based on the information stored in the storage unit 402 and the information notified from the packet snooping unit 601. Determine if. If the predetermined authentication is successful, the process S702 is performed again. If the predetermined authentication is not successful, the process proceeds to step S705.

In step S705, the communication management unit 208 prompts the multicast receiving terminal 110 that has transmitted the packet to perform predetermined authentication. Here, when predetermined authentication is started from the multicast receiving terminal 110 side and an authentication packet is received, the communication management unit 208 performs the started authentication processing, and predetermined authentication starts from the multicast receiving terminal 110 side. If not, a predetermined authentication may be started from the communication management unit 208 side and an authentication packet may be transmitted, or the authentication packet may be received from the multicast receiving terminal 110 within a predetermined time. Then, it progresses to process S706.

In step S706, the communication management unit 208 determines whether or not the multicast receiving terminal 110 that has transmitted the reception request message has succeeded in predetermined authentication. The determination of the predetermined authentication here is the same as in the first embodiment, and may be determined based on the result of transmitting / receiving the authentication packet, or may be determined depending on whether the authentication packet is received within a predetermined time. May be. If the predetermined authentication is successful, the process S701 is performed. If the predetermined authentication is not successful, the process proceeds to step S707.

In step S707, the bridge connection unit 207 prohibits transmission of all permitted multicast data to the VPN logical port 209 that has received the packet in step S702, based on the determination of the communication management unit 208 in step S704. Thereafter, the process ends.

In step S707, the communication management unit 208 may notify the multicast receiving terminal 110 that has already permitted the reception of multicast data that the transmission of all multicast data is changed from permitted to prohibited.

Thus, based on information included in an arbitrary packet transmitted from the multicast receiving terminal 110, it is possible to determine whether or not the multicast receiving terminal 110 has already been permitted to receive predetermined multicast data. As a result, for example, transmission of predetermined multicast data is permitted to the VPN logical port 209 by the operation of the properly connected multicast receiving terminal 110, and the network device 108 under the VPN logical port 209 is illegally connected. Even if the multicast receiving terminal 110 that has been illegally connected does not perform an operation for requesting reception of the predetermined multicast data because the predetermined multicast data has already been transmitted to the multicast receiving terminal 110 that has received the VPN logical port. By receiving an arbitrary packet such as an ARP packet in 209, an effect of detecting the presence of an illegally connected multicast receiving terminal 110 can be obtained.

According to Embodiment 3, based on information included in an arbitrary packet transmitted from multicast receiving terminal 110, it is determined whether multicast receiving terminal 110 has already been permitted to receive predetermined multicast data. It becomes possible. As a result, for example, transmission of predetermined multicast data is permitted to the VPN logical port 209 by the operation of the properly connected multicast receiving terminal 110, and the network device 108 under the VPN logical port 209 is illegally connected. Even if the multicast receiving terminal 110 that has been illegally connected does not perform an operation for requesting reception of the predetermined multicast data because the predetermined multicast data has already been transmitted to the multicast receiving terminal 110 that has received the VPN logical port. By receiving an arbitrary packet such as an ARP packet in 209, an effect of detecting the presence of an illegally connected multicast receiving terminal 110 can be obtained.

Embodiment 4 FIG.
In Embodiments 2 and 3, using the reception request message and packet information received at the VPN logical port 209 of the multicast communication apparatus 101, it is determined whether the multicast reception terminal 110 has already permitted reception of predetermined multicast data, The presence of the multicast receiving terminal 110 illegally connected to the VPN logical port 209 is detected, and transmission of predetermined multicast data to the VPN logical port 209 is prohibited. In the fourth embodiment, transmission is permitted again to the VPN logical port 209 that has been changed from permitted to prohibited transmission of predetermined multicast data in the second and third embodiments.

The multicast communication apparatus 101 further includes transmission recovery means for resetting the VPN logical port 209 that has been changed from permission to prohibition for transmission of predetermined multicast data. The transmission restoration means includes those performed from the multicast data communication apparatus 101 and those performed from the multicast receiving terminal 110 properly connected.

First, means performed from the multicast data communication apparatus 101 will be described.

The multicast data communication apparatus 101 further includes a timer management unit (not shown) that notifies that a predetermined time has elapsed. The timer management unit can set a plurality of timers and outputs timer information for distinguishing the set timers.

The communication management unit 208 performs setting to notify the timer management unit of the elapse of a predetermined time when the transmission of predetermined multicast data is prohibited from being permitted to the VPN logical port 209. At this time, the communication management unit 208 associates the multicast address of the predetermined multicast data, the VPN logical port 209, and timer information of the set timer, and stores them in the storage unit 402.

Then, when there is a notification from the timer management unit, the communication management unit 208 refers to the information stored in the storage unit 402, and for the VPN logical port 209 associated with the timer information of the notified timer, Similarly, the transmission of the predetermined multicast data associated therewith is permitted again.

Next, means performed from the multicast receiving terminal 110 will be described.

The communication management unit 208 uses a protocol such as SIP from the multicast receiving terminal 110 that is properly connected to the VPN logical port 209 that is permitted to prohibit transmission of the predetermined multicast data and is permitted to receive the predetermined multicast data. Then, an operation of permitting again transmission of the predetermined multicast data on the VPN logical port 209 is performed. The communication management unit 208 again permits the transmission of the predetermined multicast data to the VPN logical port 209 according to the operation at this time.

Before performing the above-described transmission recovery means, there is an illegally connected multicast receiving terminal 110 that causes the change of transmission of predetermined multicast data from permitted to prohibited at the target VPN logical port 209. It is desirable to confirm that there is not.

For this purpose, the communication management unit 208 stores the identification information of the multicast receiving terminal 110 that causes the transmission into the storage unit 402 when the transmission of the predetermined multicast data to the VPN logical port 209 is prohibited from being permitted. By storing the information, it is possible to easily confirm the presence of the multicast receiving terminal 110 that is a factor.

According to the fourth embodiment, it is possible to change again the change in which the transmission of predetermined multicast data is prohibited from being permitted to the VPN logical port 209 of the multicast communication apparatus 101 to permission again. As a result, an effect is obtained in which transmission of the predetermined multicast data can be resumed with respect to the multicast receiving terminal 110 that is permitted to receive the predetermined multicast data.

Embodiment 5. FIG.
In the first to third embodiments, transmission of predetermined multicast data to the VPN logical port 209 is permitted or prohibited based on information included in an authentication packet received by the VPN logical port 209 of the multicast communication apparatus 101. In the fifth embodiment, the multicast communication apparatus 101 designates a specific VPN logical port 209 and does not prohibit transmission of multicast data to the VPN logical port 209.

The multicast communication apparatus 101 further includes port designation means for designating a specific VPN logical port 209. The port designation means may be operated, for example, via an external interface unit (not shown) provided in the multicast communication apparatus 101, or a maintenance communication terminal connected to any port of the multicast communication apparatus 101 is provided in advance. Then, the operation may be performed from the maintenance communication terminal.

As information for designating a specific VPN logical port 209, each time a VPN logical port 209 is generated, identification information for distinguishing the VPN logical port 209 may be assigned and used. The identification information of the connected multicast receiving terminal 110 may be used.

The communication management unit 208 does not prohibit the multicast receiving terminal 110 connected to the VPN logical port 209 designated by the port designating means from receiving multicast data, and therefore transmits multicast data to the VPN logical port 209. Is not prohibited.

As described above, when a specific VPN logical port 209 is connected to a secure network and the multicast receiving terminal 110 connected to the network is known to have no security threat, the port designation unit is used. As a result, it is possible to transmit predetermined multicast data to the specific VPN logical port 209 in response to a request from the connected multicast receiving terminal 110 while ensuring security for the other VPN logical port 209. Is obtained.

According to the fifth embodiment, by designating a specific VPN logical port 209 using the port designating means, the predetermined multicast data is sent to any multicast receiving terminal 110 connected to the specific VPN logical port 209. Can be prohibited. As a result, when a specific VPN logical port 209 is connected to a secure network and the multicast receiving terminal 110 connected to the network is known to have no security threat, other VPN logical ports As a result, it is possible to efficiently transmit predetermined multicast data to the specific VPN logical port 209 in accordance with a request from the multicast receiving terminal 110 to be connected, while ensuring security for the H.209.

DESCRIPTION OF SYMBOLS 101 Multicast communication apparatus 102 Multicast delivery terminal 103 Internal communication terminal 104 External communication terminal 105 Internal network 106 External network 107,108 Network equipment 109 Multicast communication terminal 110 Multicast receiving terminal 201 LAN physical port 202 WAN physical port 203 LAN logical port 204 Packet transfer Unit 205 VPN logical port generation unit 206 VPN termination unit 207 bridge connection unit 208 communication management unit 209 VPN logical port 401 message search unit 402 storage unit 601 packet search unit

Claims (9)

A dedicated port for connecting to a communication terminal via a dedicated line and transmitting predetermined multicast data to the communication terminal;
Transmission of the predetermined multicast data to the dedicated port connected to the communication terminal based on terminal identification information for identifying the communication terminal included in the first predetermined signal transmitted from the communication terminal and received at the dedicated port A communication management section that permits or prohibits
A communication communication unit that transmits the predetermined multicast data to the dedicated port permitted to transmit by the communication management unit, and does not transmit the predetermined multicast data to the dedicated port prohibited from transmission;
A multicast communication apparatus comprising: The communication management unit
2. The multicast communication apparatus according to claim 1, wherein transmission of the predetermined multicast data to the dedicated port connected to the communication terminal that has transmitted a reception request message requesting reception of the predetermined multicast data is permitted or prohibited. . The communication management unit
If the first predetermined signal is not received from the communication terminal within a predetermined time after receiving the reception request message transmitted from the communication terminal or after transmitting the second predetermined signal, The multicast communication apparatus according to claim 2, wherein transmission of the predetermined multicast data to the dedicated port connected to the communication terminal is prohibited. A dedicated port for connecting to a communication terminal group to which at least one communication terminal belongs via a dedicated line, and transmitting predetermined multicast data to the communication terminal group;
Based on terminal identification information for identifying the communication terminal included in the first predetermined signal transmitted from the communication terminal and received at the dedicated port, the communication terminal is permitted or prohibited from receiving the predetermined multicast data;
A communication management unit that permits or prohibits transmission of the predetermined multicast data to the dedicated port connected to the communication terminal group to which the communication terminal to which reception of the predetermined multicast data is permitted or prohibited belongs;
A communication communication unit that transmits the predetermined multicast data to the dedicated port permitted to transmit by the communication management unit, and does not transmit the predetermined multicast data to the dedicated port prohibited from transmission;
With
The communication management unit
In the dedicated port where transmission of the predetermined multicast data is not prohibited,
When the communication terminals belonging to the connected communication terminal group are permitted to receive the predetermined multicast data, the dedicated port is permitted to transmit the predetermined multicast data,
When the communication terminal belonging to the connected communication terminal group is prohibited from receiving the predetermined multicast data, the dedicated port is prohibited from transmitting the predetermined multicast data,
In the dedicated port where transmission of the predetermined multicast data is prohibited,
Even if the communication terminal belonging to the connected communication terminal group is permitted or prohibited to receive the predetermined multicast data, the dedicated port is not permitted to transmit the predetermined multicast data.
A multicast communication apparatus characterized by the above. The communication management unit
5. The multicast communication apparatus according to claim 4, wherein reception of the predetermined multicast data is permitted or prohibited for the communication terminal that has transmitted a reception request message requesting reception of the predetermined multicast data. The communication management unit
If the first predetermined signal is not received from the communication terminal within a predetermined time after receiving the reception request message transmitted from the communication terminal or after transmitting the second predetermined signal, Prohibiting the communication terminal from receiving the predetermined multicast data;
The multicast communication apparatus according to claim 5. The dedicated line is an L2VPN, the dedicated port is an L2VPN port, and the communication communication unit is an L2 software bridge for communicating communication between the L2VPN ports.
The multicast communication apparatus according to claim 1, wherein A dedicated connection step of connecting a communication terminal and a dedicated port for transmitting predetermined multicast data to the communication terminal via a dedicated line;
Based on terminal identification information for identifying the communication terminal included in the first predetermined signal transmitted from the communication terminal connected in the dedicated connection step and received at the dedicated port, the dedicated port connected to the communication terminal A transmission permission / inhibition determining step for permitting or prohibiting transmission of the predetermined multicast data;
A communication communication step of transmitting the predetermined multicast data to the dedicated port permitted to transmit in the transmission permission / inhibition determining step and not transmitting the predetermined multicast data to the dedicated port prohibited from transmitting;
A multicast communication method characterized by comprising: A dedicated connection step of connecting, via a dedicated line, a communication terminal group to which at least one communication terminal belongs, and a dedicated port for transmitting predetermined multicast data to the communication terminal group;
Based on terminal identification information for identifying the communication terminal included in the first predetermined signal transmitted from the communication terminal of the communication terminal group connected in the dedicated connection step and received by the dedicated port, the communication terminal A reception availability determination step for permitting or prohibiting reception of the predetermined multicast data;
Transmission permission / prohibition permitting or prohibiting transmission of the predetermined multicast data to the dedicated port connected to the communication terminal group to which the communication terminal to which the reception of the predetermined multicast data is permitted or prohibited is received in the reception permission / prohibition determining step. A decision process;
A communication communication step of transmitting the predetermined multicast data to the dedicated port permitted to transmit in the transmission permission / inhibition determining step and not transmitting the predetermined multicast data to the dedicated port prohibited from transmitting;
Have
In the transmission permission / inhibition determining step,
In the dedicated port where transmission of the predetermined multicast data is not prohibited,
When the communication terminals belonging to the connected communication terminal group are permitted to receive the predetermined multicast data, the dedicated port is permitted to transmit the predetermined multicast data,
When the communication terminal belonging to the connected communication terminal group is prohibited from receiving the predetermined multicast data, the dedicated port is prohibited from transmitting the predetermined multicast data,
In the dedicated port where transmission of the predetermined multicast data is prohibited,
Even if the communication terminal belonging to the connected communication terminal group is permitted or prohibited to receive the predetermined multicast data, the dedicated port is not permitted to transmit the predetermined multicast data.
A multicast communication method characterized by the above.

Images