JP4188253B2 - Multicast communication system and packet authentication method - Google Patents

Description

  The present invention relates to a multicast communication system and a packet authentication method for authenticating a packet in multicast communication.

As a method for realizing multicast communication that broadcasts data to a plurality of clients, a multicast data communication system that identifies a multicast path by a server address and an identifier that is unique within the server is known.
For example, in the multicast data communication system of Patent Document 1, a multicast path is identified by a server and a tree ID that is uniquely assigned within the server. The client transmits a reception request describing the tree ID to the server. The device that relayed the reception request thereafter becomes a branch point in the multicast route. When data is received from the server, the device copies the data and distributes it to the recipient who has received the reception request.
In this multicast data communication system, a method of creating a routing table after waiting for a response from the server is also disclosed in order to avoid creating a multicast routing table due to a reception request to a nonexistent server.
Patent Document 2 discloses a multicast communication system that authenticates a device based on device information described in a reception request. When receiving a reception request from each device, the router inquires the authentication server about its validity, and relays data only when it is recognized as valid.
JP 2003-32300 A JP 2003-264577 A

In the multicast data communication system disclosed in Patent Document 1 described above, only the problem is whether or not a server actually exists in data distribution. For this reason, if it is a real server, it is possible to distribute data using the multicast function of the network. That is, it cannot be determined whether the server has the right to distribute data using the multicast function.
Further, in the multicast communication system disclosed in Patent Document 2, the authentication server or the router itself must manage the information of each device individually. For this reason, the amount of data that the router must manage becomes very large. Also, when the router receives a reception request, it must search for information on the device from the information on the device.

  The present invention has been made in view of the above circumstances, and reduces the load for authenticating the validity of a packet related to multicast distribution in a branching apparatus that branches a data packet transmitted by multicast distribution to a plurality of clients. An object of the present invention is to provide a multicast communication system and a packet authentication method.

  The present invention has been made to solve the above-described problems, and the invention according to claim 1 is directed to relaying packets in which one or more servers and two or more clients are exchanged between the server and the clients. In a multicast communication system connected via one or more branch devices that control the network, the branch device is exchanged between the client and the server, and a server address for identifying a multicast route and the server An operation result obtained by performing a predetermined operation using a packet receiving unit that receives a packet including a unique identifier, a server address included in the packet, and a secret number held therein is obtained. A comparison unit that determines that the packet is valid when it matches an identifier included in the packet. Chikyasuto is a communication system.

  The invention according to claim 2 is the multicast communication system according to claim 1, wherein the comparison unit includes a server address included in the packet and a plurality of secret numbers held therein. When any one of the calculation results obtained by performing a predetermined calculation using and matches the identifier included in the packet, it is determined that the packet is valid.

  A third aspect of the present invention is the multicast communication system according to the first aspect, wherein the branching device internally holds a plurality of numbered identifiers, and the packet includes an identifier instead of the identifier. The comparison unit includes a server address included in the packet, and a secret number corresponding to a number included in the packet among secret numbers held in the packet. When any one of the calculation results obtained by performing a predetermined calculation using is matched with an identifier included in the packet, the packet is determined to be valid.

  A fourth aspect of the present invention is the multicast communication system according to any one of the first to third aspects, wherein the packet is composed of a predetermined upper bit and a lower bit having the identifier. A multicast address to be included.

  The invention according to claim 5 is a multicast communication in which one or more servers and two or more clients are connected via one or more branching devices that control relay of packets exchanged between the server and the clients. A packet authentication method used in a system, wherein the branching device is exchanged between the client and the server and includes a server address for identifying a multicast path and an identifier that is unique within the server And when the result of a predetermined calculation using the server address included in the packet and the secret number held in the packet matches the identifier included in the packet It is a packet authentication method characterized by judging that the packet is valid.

  The invention according to claim 6 is the packet authentication method according to claim 5, wherein the branching device includes a server address included in the packet and a plurality of secret numbers held therein. When any one of the calculation results obtained by performing a predetermined calculation using and matches the identifier included in the packet, it is determined that the packet is valid.

  A seventh aspect of the present invention is the packet authentication method according to the fifth aspect, wherein the branching device internally holds a plurality of numbered identifiers, and a number corresponding to the identifier instead of the identifier. Is received using a server address included in the packet and a secret number corresponding to a number included in the packet among secret numbers held in the packet. It is characterized in that if any one of the operation results obtained by performing the above operation matches an identifier included in the packet, the packet is determined to be valid.

  The invention according to claim 8 is the packet authentication method according to any one of claims 5 to 7, wherein the packet is composed of a predetermined upper bit and a lower bit having the identifier. A multicast address to be included.

  According to the present invention, a branching device that replicates a data packet by multicast distribution and distributes it to a client that is a receiver holds it when it receives a packet related to multicast distribution exchanged between the server and the client. By comparing the value calculated from the secret number and the server address included in the packet with the identifier included in the packet, the validity of the packet can be confirmed. As a result, it is not necessary to prepare an enormous storage capacity for storing individual information for each device and each user involved in multicast distribution in the branch device, and for checking the validity of the packet in the branch device. The processing load can be reduced.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows the configuration of a multicast communication system to which an embodiment of the present invention is applied. The multicast communication system to which this embodiment is applied is formed by connecting one or more servers 1 and two or more clients via one or more branching devices 2. Here, the servers 11 and 21 and the clients 12, 13, 22, and 23 are connected by the branch device 2. The branching device 2 stores therein a secret number 1 used for authentication of packets related to multicast distribution, the server 11 stores the multicast address 10 used by itself, and the server 21 stores the multicast address 20 used by itself. .
The purpose of the multicast communication system shown in this embodiment is to limit multicast distribution from an unauthorized server, and not to authenticate individual clients.

  In this multicast communication system, a multicast route through which multicast data is distributed is identified by a set of a server address of a distribution source server and a multicast address used by the server. In this embodiment, this multicast address determination method is the key. This multicast address is determined by the network administrator who manages the branch device 2, and is assigned to the server administrator who manages the server such as the server 11 or the server 21, and is allowed to be used. The server administrator can perform data distribution only when using the multicast address assigned by the network administrator.

The network administrator determines the multicast address used by each server by the following method.
The multicast address in IPv4 (Internet Protocol version 4) is an IP address in the range of 224.0.0.0 to 239.255.255.255. Therefore, an IP address in the range of 239.0.0.0 to 239.255.255.255 is used here. The network administrator determines the multicast address used by each server from the IP addresses in this range. Specifically, the server address and the secret number known only by the server administrator of the server are given to the hash function, and the lower 24 bits of the calculation result are set as the lower 24 bits of the multicast address. For example, if the hash function is f, the relationship between the multicast address, the server address, and the secret number can be expressed by the following (formula 1). “%” Indicates that the remainder of division is calculated.

  Multicast address lower 24 bits = f (server address, secret number)% 2 ^ 24 (Formula 1)

  The hash function is an operation for generating a fixed-length pseudo-random number from a given numerical value. As a specific example, a hash function such as MD5 or SHA-1 can be used. Then, the network administrator stores the secret number used for this calculation in each branch device 2 on the multicast communication system. The determined multicast address is notified to the server administrator and set in the server.

Hereinafter, an example of data distribution using a valid multicast address in the multicast communication system shown in FIG. 1 will be described with reference to FIGS. Here, the manner in which the clients 12 and 13 receive valid data from the server 11 will be described.
First, the network administrator uses the server address of the server 11 and the secret number 1, and uses the following (Formula 2) to obtain a predetermined range of IP addresses (239.0.0.0 to 239.255.255.255). Then, the multicast address 10 assigned to the server 11 is obtained.

  Lower 24 bits of multicast address 10 = f (server 11 address, secret number 1)% 2 ^ 24 (Formula 2)

  Then, the network administrator assigns this multicast address 10 as a multicast address used for multicast distribution from the server 11. Further, the secret number 1 used for the calculation of the multicast address 10 is stored in the branching device 2.

  When the administrator of the server 11 receives a notification of the multicast address 10 used by the server 11 for multicast distribution from the network administrator, the administrator of the server 11 stores the multicast address 10 in the server 11. Further, the multicast address recipient and the address of the server 11 are notified to the recipient of the multicast distribution. Each receiver sets a set of the notified multicast address 10 and the address of the server 11 to the clients 12 and 13 used for receiving the multicast data.

  Then, the clients 12 and 13 transmit a multicast distribution data reception request to the server 11. The multicast address 10 is described in this reception request. Hereinafter, the reception request of the client 12 will be described, but the same processing is performed for the reception request from the client 13. FIG. 2 shows a state immediately after the client 12 transmits the reception request 30 to the server 11.

  Subsequently, in FIG. 3, when the reception request 30 arrives at the branch device 2, the branch device 2 confirms the validity of the reception request 30. Specifically, the address of the server 11 that is the destination of the reception request 30 and the secret number 1 stored therein are given to the hash function, and the multicast address 110 for confirming the validity according to (Equation 3). The lower 24 bits of are calculated.

  Lower 24 bits of multicast address 110 = f (server 11 address, secret number 1)% 2 ^ 24 (Formula 3)

Here, since the multicast address 110 obtained as a result of the calculation matches the multicast address 10 described in the reception request 30, it is assumed that the validity of the reception request 30 is confirmed. Then, as shown in FIG. 4, the branching device 2 stores the client 12 as a receiver of the data addressed to the multicast address 10 transmitted from the server 11 in the delivery table managed by itself, and sends the reception request 30 to the server. 11 for transfer.
Then, as illustrated in FIG. 5, when the reception request 30 reaches the server 11, the server 11 transmits data using the multicast address 10 to the branch device 2. Then, as shown in FIG. 6, the branching device 2 refers to the delivery table stored therein, and is described as a delivery destination corresponding to the server 11 of the data transmission source and the multicast address 10 being used. Data is transferred to the client 12.

Next, the case where the server 21 attempts illegal data distribution in the state where the branching apparatus 2 holds the secret number 1 as described above will be described with reference to FIGS. 7 and 8.
Since the administrator of the server 21 does not have the right to perform multicast distribution using the branch device 2, no multicast address is given by the network administrator. Therefore, it is assumed that the multicast address 20 used for the multicast distribution is randomly determined and illegal distribution is attempted.

  The administrator of the server 21 notifies the receiver having the clients 22 and 23 of the set of the address of the server 21 and the multicast address 20. The clients 22 and 23 in which the set of the address of the server 21 and the multicast address 20 is set transmit a reception request describing the multicast address 20 to the server 21. Hereinafter, the reception request from the client 22 will be described, but the same processing is performed for the reception request from the client 23. In FIG. 7, the client 22 transmits a reception request 40 describing the multicast address 20 to the server 21.

  Subsequently, as shown in FIG. 8, when the reception request 40 arrives at the branching device 2, the branching device 2 confirms the validity of the reception request 40. Specifically, the address of the server 21 that is the destination of the reception request 40 and the secret number 1 stored therein are given to the hash function, and the multicast address 120 for confirming the validity by (Equation 4) Calculate the lower 24 bits.

  Lower 24 bits of multicast address 120 = f (server 21 address, secret number 1)% 2 ^ 24 (Formula 4)

  Here, since the multicast address 120 obtained as a result of the calculation does not match the multicast address 20 described in the reception request 40, it is confirmed that the reception request 40 is not valid. Then, the branching device 2 discards the reception request 40. In addition, no information is registered in the delivery table. In this way, the branching device 2 can confirm the legitimacy of the reception request by the secret number 1 and simple calculation without having information for each device such as a server and a client relating to multicast distribution.

When permitting delivery of a plurality of programs to one server, a plurality of multicast addresses are generated using a plurality of secret numbers. A plurality of secret numbers are also stored in each branch device 2. At this time, a number corresponding to the secret number used to generate the multicast address is written in each packet related to multicast distribution. The branching device 2 generates the lower 24 bits of the multicast address by using the secret number corresponding to this number among the plurality of secret numbers stored therein, and the lower 24 bits of the multicast address described in the packet. Check validity against bit. If the number is not described, the packet is discarded.
Alternatively, the branching device 2 checks the validity of all the secret numbers, and discards the packet when it is determined that the secret numbers are not valid. That is, any of the lower 24 bits of the multicast address obtained from each of all secret numbers stored in the server and the server address matches the lower 24 bits of the multicast address described in the packet. Sometimes it is determined that a packet is valid.

  In addition, there is a multicast method such as Xcast in which no reception request packet exists. In this method, all recipients are listed in the header portion of the data packet distributed by multicast, and the packet is duplicated as necessary at each branch device. Even in such a multicast system, it is possible to check the validity of a data packet in the same manner as when the validity of a reception request packet is checked.

Next, the configuration of the branch device 2 will be described with reference to FIG. FIG. 9 is a block diagram showing the configuration of the branching device 2, and only the functional blocks related to the present invention are extracted and shown.
The branching device 2 includes a packet reception unit 200, a packet transmission unit 201, a packet type determination unit 202, a hash calculation unit 203, a recording unit that stores a secret number 204, a comparison unit 205, a transfer processing unit 206, and a delivery table 207. It comprises recording means for storing.
When receiving the packet from the packet receiving unit 200, the branching device 2 passes the packet to the packet type determining unit 202. When the packet type determination unit 202 determines that the packet is a packet related to multicast distribution, the packet type determination unit 202 delivers the packet to the hash calculation unit 203 and the comparison unit 205. The hash calculation unit 203 calculates the hash value 300 as shown in (Formula 5) using the server address 301 and the secret number 204 written in the packet, and passes them to the comparison unit 205.

  Hash value 300 = f (server address 301, secret number 204)% 2 ^ 24 (Formula 5)

If the lower 24 bits of the multicast address written in the packet matches the hash value 300 passed from the hash calculation unit 203, the comparison unit 205 determines that the received packet is valid and continues processing. To do.
For example, if the received packet is a reception request, the transmission source of this packet is registered in the delivery table 207 in association with the destination server and the multicast address written in the packet. Then, the transfer processing unit 206 performs transfer processing of the reception request, and transfers the packet from the packet transmission unit 201 to the destination server. If the packet is data that is multicast-distributed from the server, the delivery table 207 is referred to, and the transfer processing unit 206 registers each of the servers and the delivery destination corresponding to the multicast address used by the packet. Data for the client is generated, and the packet transmission unit 201 transfers this data.

  According to the embodiment described above, when the branching device 2 receives a packet related to multicast delivery exchanged between the server and the client, the branching device 2 calculates from the secret number held by itself and the server address included in the packet. The validity of the packet can be confirmed by comparing the value obtained with the lower bits of the multicast address included in the packet. As a result, it is not necessary to prepare in the branching device 2 an enormous storage capacity for storing the individual information for each device and each user involved in multicast distribution, and the validity of the packet in the branching device 2 is confirmed. Therefore, the processing load can be reduced.

  Note that the packet receiving unit 200, the packet transmitting unit 201, the packet type determining unit 202, the hash calculating unit 203, the storage device that stores the secret number 204, the comparing unit 205, the transfer processing unit 206, and the delivery of the branching device 2 described above. The procedure executed by each of the storage device storing the table 207, the servers 11 and 21, and the clients 12, 13, 22 and 23 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded. The branching device 2, the servers 11 and 21, and the clients 12, 13, 22 and 23 of the present embodiment can be realized by being read and executed by a computer system. The computer system here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

The block diagram which shows the structural example of one embodiment of this invention. The figure quoted in order to demonstrate operation | movement when the valid multicast address of the embodiment is utilized. The figure quoted in order to demonstrate operation | movement when the valid multicast address of the embodiment is utilized. The figure quoted in order to demonstrate operation | movement when the valid multicast address of the embodiment is utilized. The figure quoted in order to demonstrate operation | movement when the valid multicast address of the embodiment is utilized. The figure quoted in order to demonstrate operation | movement when the valid multicast address of the embodiment is utilized. The figure quoted in order to demonstrate operation | movement when using the illegal multicast address of the embodiment. The figure quoted in order to demonstrate operation | movement when using the illegal multicast address of the embodiment. The block diagram which expanded and showed the function of the internal structure of the branching device of the embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 2 ... Branch apparatus 11, 21 ... Server 12, 13, 22, 23 ... Client 200 ... Packet receiving part 201 ... Packet transmission part 202 ... Packet type discrimination | determination part 203 ... Hash calculation part 204 ... Secret number 205 ... Comparison part 206 ... Transfer Processing unit 207 ... delivery table

Claims (8)

In a multicast communication system in which one or more servers and two or more clients are connected via one or more branching devices that control relay of packets exchanged between the server and the clients.
The branching device is:
A packet receiving unit that receives a packet that is exchanged between the client and the server and includes a server address for identifying a multicast route and an identifier that is unique within the server;
If the result of a predetermined operation using the server address included in the packet and the secret number held inside matches the identifier included in the packet, the packet is valid. A comparison unit that determines that
A multicast communication system. The comparison unit includes any one of calculation results obtained by performing a predetermined calculation using a server address included in the packet and each of a plurality of secret numbers held therein. The packet is valid if it matches the identifier
The multicast communication system according to claim 1. The branching device internally holds a plurality of numbered identifiers,
The packet includes a number corresponding to an identifier instead of the identifier;
The comparison unit performs a predetermined operation using a server address included in the packet and a secret number corresponding to a number included in the packet among secret numbers held in the packet. If any of the results of the operation performed matches the identifier included in the packet, the packet is determined to be valid.
The multicast communication system according to claim 1. The packet includes a multicast address composed of a predetermined upper bit and a lower bit having the identifier.
The multicast communication system according to any one of claims 1 to 3, wherein the multicast communication system is characterized. A packet authentication method used in a multicast communication system in which one or more servers and two or more clients are connected via one or more branching devices that control relay of packets exchanged between the server and the clients. And
The branching device is
Receiving a packet exchanged between the client and the server and including a server address for identifying a multicast route and an identifier unique within the server;
If the result of a predetermined operation using the server address included in the packet and the secret number held inside matches the identifier included in the packet, the packet is valid. Judge that
A packet authentication method. The branching device includes any one of calculation results obtained by performing a predetermined calculation using a server address included in the packet and each of a plurality of secret numbers held therein. The packet is valid if it matches the identifier
The packet authentication method according to claim 5. The branching device is:
Keeps several numbered identifiers inside,
Receiving the packet including a number corresponding to an identifier instead of the identifier;
An operation result obtained by performing a predetermined operation using a server address included in the packet and each secret number corresponding to a number included in the packet among secret numbers held in the packet. If any matches the identifier contained in the packet, determine that the packet is valid;
The packet authentication method according to claim 5. The packet includes a multicast address composed of a predetermined upper bit and a lower bit having the identifier.
The packet authentication method according to any one of claims 5 to 7, wherein the packet authentication method is performed.

Images