WO2003065677A1 - Systeme et procede de mise en application de multidiffusion commandee - Google Patents

Systeme et procede de mise en application de multidiffusion commandee Download PDF

Info

Publication number
WO2003065677A1
WO2003065677A1 PCT/CN2002/000596 CN0200596W WO03065677A1 WO 2003065677 A1 WO2003065677 A1 WO 2003065677A1 CN 0200596 W CN0200596 W CN 0200596W WO 03065677 A1 WO03065677 A1 WO 03065677A1
Authority
WO
WIPO (PCT)
Prior art keywords
multicast
router
host
message
user
Prior art date
Application number
PCT/CN2002/000596
Other languages
English (en)
French (fr)
Inventor
Peng Zhou
Yue Liu
Kai Zhong
Guangxian Yang
Kebin Liu
Kuncheng Peng
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to DE60231556T priority Critical patent/DE60231556D1/de
Priority to AU2002330421A priority patent/AU2002330421B2/en
Priority to JP2003565135A priority patent/JP3845086B2/ja
Priority to EP02764488A priority patent/EP1480405B1/en
Priority to US10/502,543 priority patent/US7680884B2/en
Publication of WO2003065677A1 publication Critical patent/WO2003065677A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H04L12/185—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast with management of multicast group membership
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • the present invention relates to an IP multicast technology, specifically, to an IP controlled multicast system and an implementation method thereof, and belongs to the field of communication technology. Background of the invention
  • a multicast group is composed of a sender and a receiver, and the sender and receiver are connected by a multicast distribution tree.
  • the sender needs to send data to a group
  • the host directly sends the data to the router connected to it.
  • the router forwards the data to the multicast receiver through the multicast distribution tree.
  • the router does not place any restrictions on the host sending the message.
  • IGMP protocol Internet Group Management Protocol
  • the received multicast group data is forwarded to the host; similarly, the router does not place any restrictions on the host that wants to receive the multicast packet.
  • the above-mentioned IGMP extension protocol is an extension on the basis of IGMP V2. It adds authentication functions for multicast senders and receivers, and prevents unauthorized users from sending / receiving multicast packets.
  • the IGMP extension protocol uses a Challenge-Response mechanism similar to the PPP authentication protocol CHAP (Challenge Handshake Authentication Protocol) that requires three-way handshake and password encryption to authenticate users.
  • CHAP hallenge Handshake Authentication Protocol
  • the ingress router can authenticate it using the challenge-response mechanism.
  • the ingress router can use RADIUS as the authentication server during authentication.
  • the multicast packet sent by the sender can be forwarded by the ingress router to the IP multicast network to the egress router.
  • the ingress router drops the multicast packet (silently) sent by the sender.
  • the egress router starts sending IP multicast packets to the receiver after passing the egress route authentication.
  • authentication is unsuccessful, the egress router does not forward IP packets to the receiver.
  • the above RADIUS extension protocol is extended on the basis of RAMUS. It can authenticate multicast senders and receivers at the ingress router and egress router, track the user's multicast data, and provide data for service management.
  • the authentication server must be able to provide the authentication service requested by the router.
  • the router provides the user ID (User1D) and password. For security, challenge-based authentication is required for authentication.
  • Each service must also be authenticated, such as each multicast group address. This is because multicast packets are sent by group address, and user permissions should be associated with the group. Except for adding some attributes, other requirements are the same as RADIUS. Whether the router uses RADIUS authentication is optional.
  • the multicast router When the multicast router is configured to support RADIUS accounting, it will generate an accounting start packet at the beginning of the multicast service and send it to the RADIUS multicast accounting server.
  • the accounting start message describes the type of service.
  • the RADIUS multicast accounting server After receiving the message, the RADIUS multicast accounting server sends an acknowledgement message back.
  • the multicast router also generates an accounting end message and sends it to the RADIUS multicast accounting server.
  • the accounting end message describes the type of service. After receiving the message, the RADIUS multicast accounting server will send an acknowledgement message.
  • the multicast router When the multicast router receives an IGMP Join request, it sends an Access-Request packet to the RADIUS multicast authentication server to request authentication. After receiving the authentication pass response from the RADIUS multicast authentication server, the multicast router sends an Account-Request / Start message to the RADIUS multicast accounting server to start accounting. When the multicast router receives an IGMP Leave request, it sends an Account-Request / Stop message to the multicast accounting server to end the accounting. If the multicast router does not receive a response within a certain period of time, the RADIUS extended protocol recommends that the multicast router resend the Access-Request packet several times in a row. The multicast accounting server can request other servers to complete the accounting function (proxy). When the accounting server cannot successfully record the accounting packets, it cannot send Accounting-Response acknowledgement packets to the multicast router.
  • CISCO has developed the CISCO Group Management Protocol (CGMP) to solve the multicast forwarding flooding problem in the Ethernet switch environment.
  • CGMP CISCO Group Management Protocol
  • layer 3 devices can control layer 2 devices.
  • the forwarding table thus provides a means to control the authorized reception of users to a certain extent.
  • the CGMP message format is shown in Figure 1. It consists of a version number (Ver) of 4 bits, a type of 4 bits, a reserved portion of 2 bytes, and the number of GDA / USA pairs in the message (Count). L byte and several GDA / USA pairs.
  • GDA Group Destination Address
  • GDA Group Destination Address
  • USA Unicast Source Address
  • the working process of the CGMP method is as follows: Host 1 sends an IGMP Membership Report message to join the multicast group 224.1.2.3, and the switch uses the MAC address 0100.5e01.0203 corresponding to the group address resolved from the message to find CAM (CAM: Content-Addressable Memory) table, because there is no match in the CAM table, the message is forwarded to all ports including the CPU and the multicast router.
  • the multicast router receives the IGMP Membership Report message, in addition to routinely processing the message, it also generates a CGMP Join message to multicast to the switch. This message contains the MAC address of the host applying to join the multicast group.
  • the switch After the switch receives the CGMP Join message, it adds an entry to the CAM table, including the GDA (pictured: 0100.5e01.0203), and the port number of the host applying to join the multicast group (pictured: 2) And the port number of the router connected to the switch (shown as: 1). Among them, the host port number is obtained through the USA lookup table.
  • the fourth host 4 when the fourth host 4 joins the multicast group 224.1.2.3, it also sends an IGMP Membership Report (IGMP Membership Report) message to the switch, and the switch parses out that the joined group is 224.1.2.3, and uses the The corresponding MAC address 0100.5e01.0203 looks up the CAM table. The result is to find the entry and send the packet to ports 1 and 2 listed in the entry.
  • IGMP Membership Report IGMP Membership Report
  • router (I.e. router and host 1). After the router receives the IGMP Membership Report message, in addition to routinely processing the message, it also generates a CGMP Join message to multicast to the switch. The message contains the host applying to join the multicast group. MAC address
  • the switch receives the CGMP Join report
  • the GDA is used to look up the CAM table to obtain an entry, and the port number 5 of the machine 4 is obtained through the USA lookup table, and then the port number 5 is added to the entry.
  • CISCO's CGMP method does not link the router's forwarding control of the Layer 2 switch with the authorized reception of the host / user, but only provides control to control the flooding of multicast packets of the Layer 2 switch on its ports. The method also does not provide a method for authenticating and authorizing users to join a multicast group. (2) The router cannot detect the "Silent Leave" of the host / user. Summary of the Invention
  • An object of the present invention is to provide a controlled multicast system, which provides an implementation environment for the method for implementing controlled multicast of the present invention.
  • Another object of the present invention is to provide a method for implementing controlled multicast.
  • a controlled multicast system includes an Ethernet switch and a multicast router, wherein the Ethernet switch is connected to each user host in the downlink, and is connected to the multicast router in the uplink, and the multicast router A multicast router that is uplink connected to another system, The Ethernet switch completes the Layer 2 multicast exchange.
  • the Ethernet switch and the user host use
  • the IGMP V2 (version 2) protocol is used as a group management protocol; it is characterized in that the controlled multicast system further includes: a portal server and an AAA server connected to the multicast router, where the portal server is used for user access authentication Interface, the AAA server is used to save the user's permission to join the multicast group.
  • the AAA server is configured with the address of each multicast group to which each user has the right to join.
  • the multicast router works with the AAA server. Authenticate the user to join the multicast group, and issue control commands according to the authentication result to control the Ethernet switch to perform multicast forwarding.
  • the multicast router and the AAA server use the RADIUS + protocol, which is an extension of the standard RADIUS protocol, as the communication protocol, and the Ethernet switch and the multicast router use the Group Management Protocol (HGMP: Huawei Group Management Protocol) as the control protocol. .
  • RADIUS + protocol which is an extension of the standard RADIUS protocol
  • HGMP Huawei Group Management Protocol
  • the method of controlled multicast according to the present invention is implemented as follows: The method includes the following steps: first perform access authentication processing, then the Ethernet switch divides VLANs by port and processes host IGMP messages, and performs user's Identification, authentication for joining the multicast, and processing of IGMP messages by the router, and then the multicast router controls the Ethernet switch for multicast forwarding, and the HGMP protocol is used as the control protocol for controlled multicast between the two; after that, the switch Process the HGMP control message and forward the multicast stream; after the host finishes forwarding, it exits the multicast group and processes it accordingly.
  • the method includes the following steps:
  • (1) First perform access authentication processing When a host accesses the network, it first needs to input authentication information including a user name and password through an interface provided by the portal server, and the AAA server verifies the identity of the host through the information; After passing the authentication, the router records the user ID of the host and its corresponding vlan number in a user multicast access permission table; (2) The Ethernet switch divides the VLAN according to the port and processes the host IGMP message: The Ethernet switch divides the VLAN according to the port, each port is divided into a VLAN, and each port is connected to a host user. When the switch receives the host, When sending an IGMP message, it uses the destination MAC address of the message to look up the CAM table and forward it.
  • the forwarding process is the same as that of a unicast message: that is, if the port corresponding to the destination MAC address is found, the port is clicked.
  • Forwarding multicast ⁇ if the port corresponding to the destination MAC address is not found, forwarding the multicast packet to all ports;
  • the AAA server decides whether to let the user join according to the service applied by the user: If the user has permission, it sends an accept message in response Otherwise, it sends a reject message to respond; the router does not perform any processing after receiving the reject message. After receiving the accept message, it writes the multicast address of the group that the user can join to the user's multicast access permission table, and joins the host.
  • the packet is processed routinely by the multicast router, and then an HGMP join is generated (HGMP J oin) message is sent to the switch, the message contains the vlan number corresponding to the port connected to the host applying to join the multicast group and the multicast address requested to join, and contains the Join command domain;
  • the multicast router must also The general processing of establishing a multicast forwarding tree for IGMP Membership Report messages is performed like an ordinary multicast router;
  • the multicast router controls the Ethernet switch to perform multicast forwarding, and the HGMP protocol is used as the control protocol of controlled multicast between the two:
  • the multicast router controls the generation and Delete, when the multicast router allows a host to join a For each group, it sends to the switch an HGMP Join message containing the VLAN number of the host applying to join the multicast group and the multicast address applying for joining.
  • the multicast router wants to terminate a host to join a group, it sends The switch sends an HGMP Leave message including the VLAN number of the host that terminated the joining of the multicast group and the address of the terminated multicast group. In this way, the multicast router controls the multicast forwarding of the Ethernet switch;
  • the switch processes the HGMP control message:
  • the switch receives the HGMP Join message, it checks the CAM table with the MAC address corresponding to the multicast address. If it can find an entry corresponding to it, it passes the message in the message.
  • vlanID looks up the table to obtain the host port number, and then adds the port number to the entry; if it cannot be found, an entry is added to the CAM table, the entry contains the MAC address corresponding to the multicast address, The port number of the host applying to join the multicast group and the port number of the router connected to the switch;
  • the switch receives the HGMP Leave message, it checks the CAM table with the MAC address corresponding to the multicast address to obtain an entry, and then passes the vlanID Look up the table to obtain the host port number, and then delete the port number from the entry. If the port number is the only port of the entry, delete the entire entry;
  • the host leaves the multicast group: When the host needs to leave the multicast group after completing the multicast, the host sends an IGMP Leave message to request to leave the multicast group. After receiving the leave message, the router extracts the message from the message. VlanID, and use it to find the user multicast access permission table established in step (1) to get the corresponding entry, delete the multicast address indicated by the member leave message in the entry, and complete the usual router leave for member Routine processing of messages to generate another HGMP The Leave message is sent to the switch. The message contains the VLAN number of the host that wants to leave the multicast group and the multicast address that it wants to leave, and it also contains the Leave command field.
  • the multicast forwarding table and the unicast forwarding table of the Ethernet switch are shared.
  • the Ethernet switch forwards the packet, if the packet is forwarded to the multicast router port, the vlan protocol is used; otherwise, the vlan protocol is not used when sending the packet to other ports.
  • the multicast data packet sent by the multicast router to the switch in the step (6) above does not add a VLAN number, so as to avoid the defect of wasting bandwidth by sending one copy of data for each VLAN of different hosts on the same switch.
  • the operation of the host exiting the multicast group in the above step (7) can also be implemented by the following methods: When the router learns that the user is offline, it actively sends an HGMP Leave message and stops sending multicast streams to the user.
  • the specific implementation method is as follows: The procedure is the same as the IGMP Leave message.
  • the controlled multicast implementation method also controls the multicast sender: When a host sends data to a multicast group, the first multicast router that receives the data uses a multicast access control list (Access Control List, Said: ACL) to filter data packets, and only the packets that meet their requirements can be forwarded to the multicast tree.
  • a multicast access control list Access Control List, Said: ACL
  • the multicast access control list is composed of a command word, a source address, and a group address (that is, a destination address).
  • the multicast access control list is delivered to each multicast router by a centralized multicast service control server, so that the router can complete the function of controlling the sender through the multicast access control list.
  • the multicast service control server It also doubles as an AAA server.
  • the multicast access control list can also be delivered through a centralized policy server or network management to eliminate the inconvenience caused by the scattered configuration.
  • the main advantages of the present invention are: when a user joins a multicast group, technical means of authentication and authorization are provided to ensure that only authorized users can enter the multicast group; and the one- "" correspondence relationship between the port, the user, and vlanlD, and then Coupled with user access authentication, it can be easily identified Users joining or leaving a multicast group.
  • the multicast router can perform decision-making active control on the multicast forwarding function of the layer 2 switch, and can also send its control strategy to the Ethernet switch, which better solves the problem of controlling the IP multicast service.
  • the host leaves the multicast group without sending an IGMP Leave for example, when the multicast application terminates abnormally, the user can also actively stop the user's group membership by going offline.
  • the introduction of the control method of the present invention does not affect its forwarding efficiency. Therefore, the present invention has a good application prospect.
  • Figure 1 is a schematic diagram of the CGMP message format currently used.
  • Figure 2 is a schematic diagram of the signal flow of host 1 when it joins the multicast group 224.1.2.3 for the first time in the working process of CGMP.
  • Figure 3 is a schematic diagram of the signal flow of the second host joining the multicast group 224.1.2.3 during the CGMP operation.
  • FIG. 4 is a schematic diagram of a system composition structure of a controlled multicast system according to the present invention.
  • FIG. 5 is a schematic diagram of a signal flow when the host 1 performs access authentication in the controlled multicast of the present invention.
  • Figure 6 is a schematic diagram of the signal flow of the first host in the controlled multicast of the present invention to join the multicast group 224.1.2.3
  • FIG. 7 is a schematic diagram of the signal flow direction of the second host in the controlled multicast of the present invention to join the multicast group 224.1.2.3.
  • FIG. 8 is a schematic diagram of a signal flow of a multicast stream forwarded by a router in a controlled multicast according to the present invention.
  • FIG. 9 is a schematic diagram of the signal flow of the host 1 leaving the multicast group 224.1.2.3 in the controlled multicast of the present invention.
  • FIG. 10 is a schematic diagram of a centralized control scheme in a controlled multicast system of the present invention. Mode of Carrying Out the Invention
  • the present invention is a controlled multicast system, which includes an Ethernet switch 1 and a multicast router 2, wherein the Ethernet switch 1 is connected to each user host in the downlink, and is connected to the multicast router 2 in the uplink.
  • the multicast router 2 is uplink connected to the multicast router 5 of other systems.
  • the Ethernet switch 1 completes Layer 2 multicast exchange.
  • the Ethernet switch and the user host use the IGMP V2 (version 2) protocol as the group management protocol.
  • the multicast system further includes: a portal server 3 and an AAA server 4 connected to the multicast router 2, where the portal server 3 is used as an interface for user access authentication, and the AAA server 4 is used to save a user's permission to join a multicast group It is configured that the multicast router 1 and the AAA server 4 have a client-server structure.
  • the multicast router 2 cooperates with the AAA server 4 to complete the authorization authentication of the user to join the multicast group, and sends a control command according to the authentication result. Control Ethernet switch 1 for multicast forwarding.
  • the multicast router 2 and the AAA server 4 of the present invention use the RADIUS + protocol extended to the standard RADIUS protocol as the communication protocol, and the group management protocol HGMP is used as the control protocol between the Ethernet switch 1 and the multicast router 2.
  • the AAA server is the authentication server.
  • the right side of the AAA server in the figure The user ID in the box indicates the user name entered during user authentication, and the group (group) indicates the address of the multicast group to which the user joins.
  • An Ethernet switch (LAN Switch) divides VLANs according to ports, and each port is connected to a user. Among them, port 1 is connected to the multicast router, and ports 2-5 are connected to host users 1 to 4 respectively.
  • the multicast router After passing the authentication, the multicast router records the user ID of host 1 (that is, host 1) and the corresponding VLAN. Number 6: vlan l (here it is assumed that the user name in the user host 1 account is host 1).
  • host 1 when host 1 wants to join a multicast group (assuming it is a 224 ⁇ 2.3 group), it sends an IGMP Membership Report message to join the multicast group 224.1.2.3, and the Switching Engine uses the information from the message.
  • the destination MAC address 0100.5e01.0203 looks up the CAM table. Because there is no match in the CAM table, the packet is forwarded to all ports, including the CPU and the router. The packet forwarded to the router is added with the VLAN number according to the receiving port. (For host 1, this is vlanl).
  • the router After receiving the IGMP Membership Report message, the router extracts the vlanID: vlan 1 in the message, and uses it to look up the table to obtain the UserlD of the corresponding user: host 1, and then uses the found UserlD as the user name and the group to which the host is to join
  • the broadcast address (224.1.2.3) is an attribute, and an extended RADIUS authentication packet is sent to the AAA server for authentication, and the AAA server decides whether to let the user join according to the service applied by the user. If the user has permission, send an accept message in response, otherwise send a reject message in response. After receiving the reject message, the router does not perform any processing.
  • the router After receiving the accept message, the router writes the multicast address of the group that the user can join into the user's multicast access permission table, and sends the join message to the host as a normal router's routine forwarding. Processing, and then generating an HGMP Join message and sending it to the switch, the message contains the vlan number of the host applying to join the multicast group: vlan 1 and the multicast address applying to join: 224.1.2.3, and contains the Join command domain.
  • the switch When the switch receives the HGMP Join message, it adds an entry in the CAM table, which contains the MAC address corresponding to the multicast address (224.1.2.3): 0100.5e01.0203. Port number: 2, and the port number of the router connected to the switch: 1. The host port number is obtained by looking up the vlanID table.
  • the router After receiving the IGMP Membership Report message, the router extracts the vlanID: vlan 4 in the message, and uses it to look up the table to obtain the UserlD of the corresponding user: host 4, and then uses the found UserlD as the user name and the
  • the multicast address (224.1.2.3) is an attribute, and sends an extended RADIUS authentication packet to the AAA server for authentication.
  • the AAA server decides whether to let the user join according to the service applied by the user. If the user has permission, send an accept message in response, otherwise send a reject message in response. After receiving the reject message, the router does not perform any processing.
  • the router After receiving the accept message, the router writes the multicast address of the group that the user can join into the user's multicast access permission table, and uses the normal router routine for the message that the host joins. Then, a HGMP Join message is generated and sent to the switch.
  • the message contains the VLAN number of the host applying to join the multicast group: vlan 4 and the multicast address applying to join: 224.1.2.3, and contains the Join command domain.
  • the switch When the switch receives the HGMP Join message, it uses the MAC address (0100.5e01.0203) corresponding to its multicast address (224.1.2.3) to search the CAM table. Because the first host 1 in the step described in FIG. 6 After joining the 224.1.2.3 group, there is already an entry in the CAM table. This query will get the same entry that matches the last time. The host port number is obtained by looking up the table with vlanID: 5, and then the port Number 5 is added to the entry.
  • the router When the router receives the multicast stream from the multicast source, it forwards the multicast stream to the port according to the forwarding table. Because the router establishes a multicast forwarding exit based on the actual port of the switch instead of the vlan number when processing the IGMP Membership Report message from the host, a switch connected to the router has only one exit in the multicast forwarding table, and the multicast stream Only one copy (COPY) is sent to the switch, and no multicast ID is added to the multicast data packet.
  • COPY multicast stream Only one copy
  • N02 / 00596 is an upward arrow from host 1.
  • the switching engine uses its destination MAC address 0100.5e01.0203 to look up the CAM table, finds the entry, and sends the message to the port listed in this entry: 1 and 5 (ie: router and host 4).
  • the router After receiving the leave message from its members, the router extracts vlanID: vlan l in the message, and looks up the table to obtain the corresponding entry, and deletes the multicast address 224.1 indicated by the member leave message in the entry. 2.3, as shown in FIG.
  • the switch When the switch receives the HGMP Leave message, it uses the MAC address 0100.5e01.0203 corresponding to the multicast address 224.1.2.3 to look up the CAM table to obtain an entry, and then uses the vlanID lookup table to obtain the port number of the host that sent the IGMP Leave message. : 2, then delete the port number 2 from the entry.
  • the above steps are specific operation steps for controlling multicast members in the method for implementing controlled multicast according to the present invention.
  • the method for implementing the present invention also performs related control on the multicast sender, see FIG. 10.
  • the host the source (IDC) in FIG. 10
  • the first multicast router that receives the data will first download the multicast access control list (Access) through the multicast service control server.
  • Control List ACL for short
  • a multicast access control list consists of a command word, a source address, and a group address (also a destination address).
  • a centralized multicast service control server is usually used to complete the delivery of the multicast access control list to each multicast router, and these multicast routers control the function of the sender.
  • the service control server also doubles as an AAA server, and of course, it can also issue a multicast access control list through a centralized policy server or network management.
  • the multicast system and its implementation method of the present invention have been experimentally implemented on several devices developed by the applicant, and the results of these tests are successful, achieving the inventive purpose of controlling the multicast.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

受控组播的系统及其实现方法
技术领域
本发明涉及一种 IP組播技术， 确切地说， 涉及一种 IP受控组播的 系统及其实现方法， 属于通信技术领域。 发明背景
随着 IP组播技术的成熟， IP组播应用越来越多，但是在 IP模型中， 任何一台主机都能够不受限制地加入到任何一个组播组， 到目前为止， 还没有一种方法能够有效解决 IP组播网中的主机受控加入问题。
众所周知， 在 IP组播模型中， 一个组播组是由发送者和接收者组成 的， 发送者到接收者之间由组播分布树连接。 当发送者需要向某个组发 送数据时， 主机直接把数据发送到与其相连的路由器， 该路由器将该数 据通过组播分发树转发给组播接收者， 路由器不对发送报文的主机作任 何限制。 当一台主机想接收某个组播组的数据时， 它才艮据因特网组管理 协议（ Internet Group Management Protocol, 筒称： IGMP协议) 向与其 相连的路由器发送 Member report报文， 该路由器处理此报文之后会将收 到的该组播组数据转发给该主机； 同样， 路由器不会对想接收组播报文 的主机作任何限制。 随着 IP组播应用的商业化， 组播安全已经成为必须 尽快获得解决的一个问题， 而阻止未授权的接收者接收组播报文是组播 安全的关键一环。
Norihiro Ishikawa等人曽提出 IGMP扩展协议《IP组播授权的 IGMP扩 展》 （ IGMP Extension for Authentication of IP Multicast , 刊于 drafl-ietf-idmr-igmp-auth-01.txt )和 RADIUS扩展协议《组播路由器认证 其中远程拨号用户认证服务 RADIUS为 Remote Authentication Dial In User Service的缩写， 刊于 draft-yamanouchi-RADIUS-ext-OO.txt ) , 可以 对发送者和接收者进行认证。
上述的 IGMP扩展协议是在 IGMP V2的基础上进行扩展， 它增加了 对组播发送者和接收者的认证功能， 阻止未授权的用户发送 /接受组播 包。 IGMP扩展协议使用一种需要经过三次握手、 口令加密的类似 PPP验 证协议 CHAP ( Challenge Handshake Authentication Protocol ) 的 Challenge-Response机制来认证用户。 当一个组播发送者开始发送 IP组播 报文时， 入口路由器就可以用 challenge-response机制认证它。 入口路由 器在认证的时候可以使用 RADIUS作为认证服务器。 当认证通过后， 该 发送者发送的组播包就可以被入口路由器转发到 IP组播网中到达出口路 由器。 当认证不成功时， 入口路由器丟弃该发送者发送的组播包 ( silently ) 。 当一个组播接收者想要接收 IP组播报文时， 通过出口路由 认证通过后， 出口路由器开始将 IP组播包发送到该接收者。 当认证不成 功时， 出口路由器不转发 IP包到该接收者。
上述 RADIUS扩展协议是在 RAMUS的基础上进行扩展，它可以在入 口路由器和出口路由器处对组播发送者和接收者进行认证， 并跟踪用户 的组播数据， 为业务管理提供数据。 认谇服务器必须能够提供路由器请 求的认证业务， 认证时路由器提供用户的标识（UserlD )和口令。 为了 安全， 认证时要求使用基于 challenge的认证。 还必须对每个业务进行认 证，如对每个组播组地址进行认证。这是因为組播包是按组地址发送的， 用户的权限应该与组相关联。 除了再增加一些属性， 其他方面的要求与 RADIUS—样。 路由器是否使用 RADIUS认证是可以选择的。 当组播路由器被配置成支持使用 RADIUS计费时， 在组播业务的开 始， 它会生成一个计费开始报文， 并发送到 RADIUS组播计费服务器。 该计费开始报文描述了业务的类型， RADIUS组播计费服务器在收到该 报文后会回送一个确认报文。 在组播业务结束时， 组播路由器也会生成 一个计费结束报文， 并发送到 RADIUS组播计费服务器。 该计费结束报 文描述了业务的类型， RADIUS组播计费服务器在收到该报文后会回送 一个确认艮文。
当组播路由器收到一个 IGMP加入（IGMP Join )请求后， 它发送一 个 Access-Request报文给 RADIUS组播认证服务器请求认证。 在收到从 RADIUS组播认证服务器发来的认证通过响应后， 组播路由器发送一个 Account-Request/Start报文给 RADIUS组播计费服务器开始计费。 当组播 路由器收到一个 IGMP离开 （IGMP Leave ) 请求后， 它发送一个 Account-Request/Stop报文给组播计费服务器结束计费。 如果在一定时间 内组播路由器没有收到响应， RADIUS扩展协议建议组播路由器再连续 重发几次 Access-Request报文。组播计费服务器可以请求别的服务器来完 成计费功能（proxy )。 当计费服务器不能成功记录计费报文时， 它不能 发送 Accounting-Response确认报文给组播路由器。
此外， CISCO 公司开发了 CISCO 组管理协议 （CISCO Group Management Protocol, 简称： CGMP )用于解决以太网交换机环境下的 组播转发泛滥（flooding ) 的问题， 通过 CGMP， 三层设备可以控制二 层设备的转发表， 从而提供了一种手段， 可以在一定程度上控制用户的 授权接收。 CGMP的报文格式如图 1所示， 是由版本号 （Ver ) 4比特、 类型 （Type ) 4比特、 保留部分（Reserved ) 2字节、 报文中 GDA/USA 对的个数（Count ) l字节和若干个 GDA/USA对组成。其中 GDA( Group Destination Address )是一个 MAC组播地址， 是主机所要加入的组播組 的 IP地址对应的 MAC地址， USA ( Unicast Source Address )是要加入 组播组的主机的 MAC地址， 它是一个单播地址。
参见图 2所示， CGMP方法的工作过程如下： 主机 1发送 IGMP Membership Report报文加入組播组 224.1.2.3, 交换机用从该报文中解析 出 来 的 组 地 址 对 应 的 MAC 地 址 0100.5e01.0203 查 找 CAM(CAM:Content-Addressable Memory)表，因为 CAM表中没有匹配项， 该报文被转发（flooding )到包括 CPU和组播路由器的所有端口。 其中组 播路由器收到 IGMP Membership Report报文后， 除了对该艮文进行例行 处理外， 还生成一个 CGMP Join报文组播到交换机， 该报文包含了申请 加入组播组的主机的 MAC地址 （USA: 0080.c7a2.1093 )和申请加入的 组对应的 MAC地址（GDA: 0100.5e01.0203 ) , 并且包含 Join命令域。 当交换机收到该 CGMP Join报文后， 在 CAM表中加入一个表项， 包含 GDA (图示为： 0100.5e01.0203 )、 申请加入組播组的主机的端口号（图 示为： 2 ) 以及与交换机相连的路由器的端口号（图示为： 1 ) 。 其中， 主机端口号是通过 USA查表获得的。
参见图 3 , 当第四个主机 4加入组播组 224.1.2.3时， 同样发送 IGMP 成员资格上 4艮 ( IGMP Membership Report ) 艮文到交换机， 交换机解析 出加入的组为 224.1.2.3 , 使用其对应的 MAC地址 0100.5e01.0203查找 CAM表， 结果是找到该表项， 并将报文发送到该表项列出的端口 1和 2
(即路由器和主机 1 )。 而路由器收到 IGMP Membership Report报文后， 除了对该报文进行例行处理外， 还生成一个 CGMP加入 ( CGMP Join ) 报文组播到交换机， 该报文包含了申请加入组播組的主机的 MAC地址
( USA: 0080.c7b3.2174 ) 和申请加入的组对应的 MAC地址 （ GDA: 0100.5e01.0203 ) , 并且包含 Join命令域。 当交换机收到该 CGMP Join报 文后， 用 GDA查找 CAM表得到一个表项， 通过 USA查表获得 机4的端 口号 5， 然后将该端口号 5加入到该表项中。
上述的 IGMP扩展协同 RADIUS扩展的方法虽然解决了发送者与 接收者的授权问题， 但是仍然存在以下缺点： （1 )在共享网络上只要有 一个主机加入成功， 则其他所有主机都能接收到该组播数据， 因此无法 对未授权主机接收組播数据的状况进行控制。 如果采用密钥方法来解决 此问题， 则必须在认证前对各个主机分发密钥， 这又会带来许多限制和 麻烦。 （2 )如果采用该两个协议， 不但要更新路由器设备， 还需要修改 主机侧的 IGMP软件。 而且， 这两个协议都还没有标准化， 目前的主机 都不支持 IGMP扩展。 而 CISCO公司的 CGMP方法的缺点是： （1 )没 有将路由器对二层交换机的转发控制与主机 /用户的授权接收联系起来， 只是提供了控制二层交换机组播报文在其端口泛滥的控制方法， 也没有 提供认证授权用户加入组播组的方法。 （ 2 )路由器不能探测出主机 /用户 的 "无声撤离" （Silent Leave )。 发明内容
本发明的目的是提供一种受控组播的系统， 该系统为本发明实现受 控组播的方法提供了实施环境。
本发明的另一目的是提供一种受控组播的实现方法， 该方法能够克
CGMP
这两种现有的组播方法的各种缺陷， 可以较好地解决对参与组播的发送 者与接收者的授权认证和受控加入的问题。
本发明的目的是这样实现的： 一种受控组播的系统， 包括有以太网 交换机和组播路由器， 其中以太网交换机下行连接各用户主机， 上行与 组播路由器相连接， 该组播路由器上行连接其他系统的组播路由器， 该 以太网交换机完成二层组播交换， 该以太网交换机与用户主机之间使用
IGMP V2 (版本 2 )协议作为组管理协议； 其特征在于： 该受控组播系 统还包括有： 与该组播路由器相连接的 portal服务器和 AAA服务器， 其中 portal服务器用作用户接入认证的接口， AAA服务器用于保存用户 加入组播组的权限配置， 例如在 AAA服务器上配置有每个用户有权加 入的每个组播组的地址等； 该组播路由器则配合 AAA服务器一起共同 完成对用户加入组播組的权限认证， 并按照认证的结果下发控制命令.， 控制以太网交换机进行组播转发。
所述的组播路由器与 AAA服务器之间采用对标准 RADIUS协议扩 展了的 RADIUS+协议作为通信协议， 而以太网交换机和组播路由器之 间采用组管理协议 ( HGMP: Huawei Group Management Protocol )作为 控制协议。
本发明的受控组播的方法是这样实现的： 该方法包括有下列步骤： 首先进行接入认证处理， 再由以太网交换机按端口划分 vlan及对主机 IGMP报文进行处理， 以及进行用户的识别、 加入组播的认证及由路由 器对 IGMP报文进行处理， 接着由组播路由器控制以太网交换机进行组 播转发， 两者之间采用 HGMP协议作为受控组播的控制协议； 之后， 交 换机对 HGMP控制报文进行处理和进行组播流的转发；主机完成转发后， 就退出組播组并作相应的处理。
该方法包括有下列步驟：
( 1 )首先进行接入认证处理： 当一主机访问网络时， 首先要通过 portal服务器提供的接口， 输入包括有用户名和密码的认证信息， 并由 AAA服务器通过这些信息来认证该主机的身份； 通过认证后， 路由器将 该主机的用户标识及其对应的 vlan号记录在一个用户组播访问权限表 中； ( 2 ) 以太网交换机按端口划分 vlan及对主机 IGMP报文进行处理： 以太网交换机根据端口划分 vlan,每个端口划分为一个 vlan,且其每个端 口连接一个主机用户， 当交换机收到主机发来的 IGMP报文时， 用该报 文的目的 MAC地址查找 CAM表进行转发， 其转发流程与单播报文相同： 即若查到该目的 MAC地址所对应的端口时， 按查到的端口转发组播^ :艮 文， 若没有查到该目的 MAC地址所对应的端口时， 将组播报文转发到所 有端口；
( 3 )进行用户的识别、 加入组播的认证及路由器对 IGMP报文进行 处理： 路由器收到 IGMP Membership Report报文后， 因为组播路由器收 到的从以太网交换机发来的数据包都有 vlan号， 通过查找第（1 )步驟中 记录的用户组播访问权限表，可以知道对应 UserlD,也就是知道该 IGMP Membership Report报文是哪个用户发送的 , 然后以查到的 UserlD为用户 名， 以主机所要加入的组播地址为属性， 发送扩展的 ADIUS认证报文 到 AAA服务器进行认证，由 AAA服务器根据用户申请的业务决定是否让 用户加入：如果用户拥有权限，则发送 accept报文作回应，否则发送 reject 报文回应； 路由器收到 reject报文后不作任何处理， 收到 accept报文后将 用户能够加入的组的组播地址写到用户组播访问权限表中， 并对该主机 加入的报文作通常组播路由器的例行处理， 然后生成一个 HGMP加入 ( HGMP Join )报文发送到交换机， 该 4艮文包含了申请加入组播组的主 机所连接的端口对应的 vlan号和申请加入的组播地址，并且包含 Join命令 域； 此外， 组播路由器还要如同普通组播路由器一样地对 IGMP Membership Report报文进行建立组播转发树的常规处理；
( 4 ) 由组播路由器控制以太网交换机进行組播转发， 两者之间采 用 HGMP协议作为受控组播的控制协议： 在以太网交换机上由组播路由 器控制其组播转发表的生成与删除， 当组播路由器允许某个主机加入某 个组时， 它给交换机发送包含有申请加入組播组的主机的 vlan号和申请 加入的组播地址的 HGMP Join报文； 当组播路由器要终止某个主机加入 某个组时， 它给交换机发送包含有终止加入组播组的主机的 vlan号和终 止加入的组播组地址的 HGMP离开（HGMP Leave )报文， 通过这种方 法， 組播路由器控制以太网交换机的组播转发；
( 5 )交换机对 HGMP控制报文进行处理： 当交换机收到 HGMP Join 报文后， 用组播地址对应的 MAC地址查 CAM表， 如果能够找到与其对 应的一个表项， 则通过报文中的 vlanID查表来获得该主机端口号， 然后 将该端口号加入到该表项中； 如果不能找到， 则在 CAM表中增加一个表 项， 该表项包含该组播地址所对应的 MAC地址、 申请加入组播组的主机 的端口号以及与交换机相连的路由器的端口号； 当交换机收到 HGMP Leave报文后， 用组播地址对应的 MAC地址查 CAM表而得到一个表项， 再通过 vlanID查表来获得该主机端口号 , 然后将该端口号从该表项中删 除， 如果该端口号是该表项的唯——个端口， 则删除整个表项；
( 6 )組播流的转发： 当路由器收到组播源发来的組播流时， 将该 组播流按照转发表转发给出端口， 路由器在处理主机的 IGMP Membership Report报文时， 不是按 vlan号而是按交换机的实际端口建立 组播转发出口， 所以一个连接路由器的交换机在組播转发表中只有一个 出口， 组播流只发一份拷贝到交换机；
( 7 ) 主机退出组播组： 当主机完成组播后， 需要退出组播组时， 由主机发送 IGMP Leave报文要求退出组播组，路由器在收到该离开报文 后， 提取报文中的 vlanID, 并通过它查找第（1 )步骤中建立的用户组播 访问权限表得到对应的表项， 删除该表项中成员离开报文所指示的组播 地址，并完成通常路由器对成员离开报文的例行处理，再生成一个 HGMP Leave报文发给交换机，该报文包含了想要离开组播组的主机的 vlan号和 要离开的组播地址， 并且包含 Leave命令域。
所述的以太网交换机的组播转发表与单播转发表是共用的。
以太网交换机在转发报文时， 若报文转发到组播路由器端口， 使用 vlan协议； 否则， 向别的端口发送报文时不用 vlan协议。
上述第 （6 ) 步骤中的组播路由器发送给交换机的组播数据包不加 vlan号， 以避免为同一个交换机上的不同主机的每个 vlan分别发送一份 数据而浪费带宽的缺陷。
上述第 （7 ) 步骤中的主机退出组播组的操作还可以通过下述方法 实现之： 路由器在获知用户下线时主动发送 HGMP Leave报文而停止向 用户发送组播流，其具体实现方法与 IGMP Leave报文的操作步骤相同。
该受控组播的实现方法还对组播发送者进行控制： 当主机向某个组 播组发送数据时， 第一个接收该数据的组播路由器利用组播访问控制列 表（Access Control List, 筒称： ACL )对数据报文进行过滤， 只有满足 其要求的报文才能被转发到组播树。
所述的组播访问控制列表是由命令字、 源地址和组地址（即： 目的 地址）构成。
所述的组播访问控制列表是由一个集中的组播业务控制服务器来 下发给各组播路由器， 以便路由器藉由该组播访问控制列表完成控制发 送者的功能， 该组播业务控制服务器同时兼作 AAA服务器。
所述的组播访问控制列表也可通过一个集中的策略服务器或网管 下发， 以消除分散配置引起的不便。
本发明的主要优点是： 在用户加入组播组时， 提供了认证授权的技 术手段， 确保只有授权用户才能进入该组播組； 并且通过端口、 用户和 vlanlD的一-" "对应关系， 再加上对用户的接入认证， 可以很方便地识别 加入或离开组播组的用户。 组播路由器能够对二层交换机的组播转发功 能执行带有决策性的主动控制， 还可以将其控制策略下发到以太网交换 机，较好地解决了对 IP组播业务的受控问题。再者，在主机不发送 IGMP Leave 的情况下离开组播组， 例如组播应用程序异常终止时， 还可以通 过用户下线主动停止用户的組成员身份。 而且， 在引入本发明的控制手 段后， 并没有影响其转发效率。 所以， 本发明具有很好的推广应用前景。 附图简要说明
图 1是现在使用的 CGMP报文格式示意图。
图 2是现在使用的 CGMP 工作过程中主机 1 第一个加入组播组 224.1.2.3的信号流向示意图。
图 3 是现在使用的 CGMP 工作过程中主机 4 第二个加入组播组 224.1.2.3的信号流向示意图。
图 4是本发明的受控组播系统的系统组成结构示意图。
图 5是本发明的受控组播中主机 1进行接入认证时的信号流向示意 图。
图 6是本发明的受控组播中主机 1第一个加入组播组 224.1.2.3的信 号流向示意图
图 7是本发明的受控组播中主机 4第二个加入组播组 224.1.2.3的信 号流向示意图。
图 8是本发明的受控组播中路由器转发组播流的信号流向示意图。 图 9是本发明的受控组播中主机 1离开组播组 224.1.2.3的信号流向 示意图。
图 10是本发明的受控组播系统中的集中控制方案的示意图。 实施本发明的方式
下面结合附图对本发明进行详细描述。
参见图 4, 本发明是一种受控组播的系统， 包括有以太网交换机 1 和组播路由器 2, 其中以太网交换机 1下行连接各用户主机， 上行与组 播路由器 2相连接，该组播路由器 2上行连接其他系统的组播路由器 5, 该以太网交换机 1完成二层组播交换， 该以太网交换机与用户主机之间 使用 IGMP V2 (版本 2 )协议作为組管理协议； 该受控组播系统还包括 有： 与该组播路由器 2相连接的 portal服务器 3和 AAA服务器 4, 其中 portal服务器 3用作用户接入认证的接口， AAA服务器 4用于保存用户 加入组播组的权限配置， 组播路由器 1 与 AAA 服务器 4 之间为 Client-server结构，该组播路由器 2配合 AAA服务器 4一起共同完成对 用户加入组播组的权限认证， 并按照认证的结果下发控制命令， 控制以 太网交换机 1进行组播转发。 本发明的组播路由器 2与 AAA服务器 4 之间釆用对标准 RADIUS协议扩展了的 RADIUS+协议作为通信协议， 而以太网交换机 1和组播路由器 2之间采用组管理协议 HGMP作为控制 协议。
下面结合图 5 -图 10的各个附图和一个具体的实施例，详细描述本 发明中主机加入组播组的全部过程的实现方法和操作步骤：
参见图 5, 当某一主机（假设是主机 1 )要访问网络时， 它首先要 通过 portal服务器提供的接口来进行接入的身份认证， AAA服务器是认 证服务器， 图中 AAA服务器中右侧方框中的用户标识表示用户认证时 输入的用户名， 组（ group )表示用户加入的组播组地址。 以太网交换机 ( LAN Switch )根据端口划分 vlan, 每个端口接一个用户。 其中端口 1 接组播路由器， 端口 2 - 5分别连接各主机用户 1 -主机用户 4。 通过认 证后，组播路由器记录了主机 1的用户标识（即： 主机 1 )及对应的 vlan 6 号： vlan l (这里假设用户主机 1帐户中的用户名为主机 1 )。
参见图 6, 当主机 1想加入组播組（假设是 224丄 2.3组） 时， 它发 送 IGMP Membership Report 报文加入组播组 224.1.2.3 , 交换引擎 ( Switching Engine )用从该报文中的目的 MAC地址 0100.5e01.0203查 找 CAM表， 因为 CAM表中没有匹配项， 该报文被转发（flooding )到 所有端口， 包括 CPU和路由器，其中转发到路由器的报文根据接收端口 加上 vlan号 （对主机 1就是 vlanl )。
路由器收到 IGMP Membership Report报文后， 提取报文中的 vlanID: vlan 1 , 并通过它查表得到对应用户的 UserlD: 主机 1 , 然后以查到的 UserlD为用户名， 以主机要加入的组播地址（ 224.1.2.3 ) 为属性， 发送 扩展的 RADIUS认证报文到 AAA^务器进行认证， AAA服务器根据用户 申请的业务决定是否让用户加入。 如果用户有权限， 则发送 accept报文 作回应 ,否则发送 reject报文回应。路由器收到 reject报文后不作任何处理， 收到 accept报文后将用户能够加入的组的组播地址写到用户组播访问权 限表中， 对该主机加入报文作通常路由器的例行转发处理， 然后生成一 个 HGMP Join报文发送到交换机， 该报文包含了申请加入组播组的主机 的 vlan号： vlan 1和申请加入的组播地址： 224.1.2.3, 并且包含 Join命令 域。
当交换机收到该 HGMP Join报文后， 在 CAM表中加入一个表项， 包 含与该组播地址（224.1.2.3 ) 对应的 MAC地址： 0100.5e01.0203 , 申请 加入该组播組的主机的端口号： 2, 以及与交换机相连的路由器的端口 号： 1。 其中， 主机端口号是通过 vlanID查表获得的。
参见图 7 , 当又有新的主机（假设是第四个主机 4 ) 加入组播组 224丄 2.3时 （假设其已通过接入认证， 认证方法同上述第一步骤中的主 机 1一样）， 同样发送 IGMP Membership Report报文到交换机， 交换引擎 6 使用其目的 MAC地址 0100.5e01.0203查寻 CAM表， 结果找到该表项， 并 将报文发送到该表项列出的端口 1和 2 (即路由器和主机 1 ) 。
路由器收到 IGMP Membership Report报文后， 提取该报文中的 vlanID: vlan 4, 并通过它查表得到对应用户的 UserlD: 主机 4, 然后以 查到的 UserlD为用户名， 以主机要加入的组播地址（224.1.2.3 )为属性， 发送扩展的 RADIUS认证报文到 AAA服务器进行认证， AAA服务器根据 用户申请的业务决定是否让用户加入。 如果用户有权限， 则发送 accept 报文作回应，否则发送 reject报文回应。路由器收到 reject报文后不作任何 处理， 收到 accept报文后将用户能加入的组的组播地址写到用户組播访 问权限表中， 对该主机加入的报文作通常路由器的例行处理， 然后生成 一个 HGMP Join报文发送到交换机， 该报文包含了申请加入组播組的该 主机的 vlan号： vlan 4和申请加入的组播地址： 224.1.2.3, 并且包含 Join 命令域。
当交换机收到该 HGMP Join报文后， 用其组播地址（224.1.2.3 )对 应的 MAC地址（0100.5e01.0203 )去查寻 CAM表， 由于在图 6所述的步 骤中第一个主机 1加入到 224.1.2.3组之后 , CAM表中已经存在一个表项， 此次查询就能得到与上次相匹配的同一表项， 通过 vlanID查表获得该主 机端口号： 5， 然后再将该端口号 5加入到该表项中。
参见图 8, 当路由器收到组播源发来的组播流时， 将组播流按转发 表转发给出端口。 因为路由器在处理主机的 IGMP Membership Report报 文时， 并不是按 vlan号而是按交换机的实际端口建立组播转发出口， 所 以一个连接路由器的交换机在组播转发表中只有一个出口， 組播流只发 一份拷贝 （COPY )到交换机， 组播数据包不加 vlanID。
参见图 9， 当主机 1想要离开组播组 224.1.2.3时， 它发送 IGMP Leave 报文到交换机，在图 9中与此时该主机 1发送的 IGMP Leave报文相对应的 N02/00596 是由主机 1引出的向上的箭头， 交换引擎则使用其目的 MAC地址 0100.5e01.0203查找 CAM表， 结果找到该表项， 并将该报文发送到此表 项列出的端口： 1和 5 (即： 路由器和主机 4 ) 。
路由器收到其成员的离开报文后， 提取该报文中的 vlanID: vlan l , 并通过它查表得到对应的表项， 删除该表项中成员离开报文所指示的组 播地址 224.1.2.3 , 即如图 9所示， 将其中路由器右侧方框中用户 vlan 1所 对应的用户有权加入的组播组地址（group )栏目的组播地址 224.1.2.3删 除，再完成通常路由器对成员离开报文的例行处理；然后生成一个 HGMP Leave报文发给交换机（图 9中与该 HGMP Leave报文所对应的是由路由 器引出的向下箭头） ， 该报文包含了想要离开组播組的主机的 vlan号： vlan 1和要离开的组播地址： 224.1.2.3, 并且包含 Leave命令域。
当交换机收到该 HGMP Leave报文后， 用组播地址 224.1.2.3对应的 MAC地址 0100.5e01.0203查找 CAM表得到一个表项， 再通过 vlanID查表 获得发出 IGMP Leave报文的主机的端口号： 2, 然后将该端口号 2从该表 项中删除。
以上各步骤是本发明受控组播的实现方法中对组播成员进行控制 的具体操作步骤， 此外， 本发明的实现方法还对组播发送者执行相关控 制， 参见图 10。 当主机（在图 10中为信源 （IDC ) ) 向某个组播组发送 数据时， 第一个接收该数据的组播路由器将首先通过组播业务控制服务 器下载組播访问控制列表（Access Control List, 简称： ACL ) , 并利用 该组播访问控制列表 ACL对该数据报文进行过滤， 只有满足通过要求的 报文才能被转发到组播树。 组播访问控制列表是由命令字、 源地址和组 地址（也是目的地址）构成的。 为了消除分散配置引起的不便， 通常使 用一个集中的组播业务控制服务器来完成向各组播路由器下发组播访 问控制列表， 而由这些组播路由器控制发送者的功能， 同时， 该组播业 务控制服务器还兼作 AAA服务器， 当然也可以通过一个集中的策略服务 器或网管下发组播访问控制列表。
本发明的组播系统及其实现方法已经在申请人研制的若干设备上进 行了试验性实施， 这些试验的结果是成功的， 实现了要对组播实行控制 的发明目的。

Claims

权利要求书
1、 一种受控组播的系统， 包括有以太网交换机和组播路由器， 其中以太网交换机下行连接各用户主机， 上行与组播路由器相连接， 该 組播路由器上行连接其他系统的组播路由器， 该以太网交换机完成二层 组播交换， 该以太网交换机与用户主机之间使用 IGMP V2协议作为组 管理协议； 其特征在于： 该受控组播系统还包括有： 与该组播路由器相 连接的 portal服务器和 AAA服务器，其中 portal服务器用作用户接入认 证的接口， AAA服务器用于保存用户加入组播组的权限配置；该组播路 由器则配合 AAA服务器一起共同完成对用'户加入组播组的权限认证， 并按照认证的结果下发控制命令， 控制以太网交换机进行组播转发。
2、 根据权利要求 1 所述的受控组播的系统， 其特征在于： 所述 的组播路由器与 AAA服务器之间采用对标准 AAA 协议扩展了的 RADIUS+协议作为通信协议，而以太网交换机和组播路由器之间采用組 管理协议 HGMP ( Huawei Group Management Protocol )作为控制协议。
3、 一种受控组播的实现方法， 其特征在于： 该方法包括有下列 步骤： 首先进行接入认证处理， 再由以太网交换机按端口划分 vlan及对 主机 IGMP报文进行处理， 以及进行用户的识别、 加入组播的认证及由 路由器对 IGMP报文进行处理， 接着由组播路由器控制以太网交换机进 行组播转发，两者之间采用 HGMP协议作为受控组播的控制协议;之后， 交换机对 HGMP控制报文进行处理和进行組播流的转发；主机完成转发 后， 就退出组播组并作相应的处理。
4、 才艮据权利要求 3所述的受控组播的实现方法， 其特征在于， 该方法的具体操作步骤是：
( 1 )首先进行接入认证处理： 主机访问网络时， 首先要通过 portal 服务器提供的接口输入包括有用户名和密码的认证信息， 并由 AAA服 务器通过这些信息来认证该主机的身份； 通过认证后， 路由器将该主机 的用户标识及其对应的 vlan号记录在一个用户组播访问权限表中；
( 2 )以太网交换机按端口划分 vlan及对主机 IGMP报文进行处理： 以太网交换机 ^据端口划分 vlan, 每个端口划分为一个 vlan, 且其每个 端口连接一个主机用户， 交换机收到主机发来的 IGMP报文时， 用该报 文的目的 MAC地址查找 CAM表进行转发， 其转发流程与单播报文相 同： 即若查到该目的 MAC地址所对应的端口时， 按查到的端口转发组 播报文， 若没有查到该目的 MAC地址所对应的端口时， 将组播报文转 发到所有端口；
( 3 )进行用户的识别、加入组播的认证及路由器对 IGMP 艮文进行 处理： 路由器收到 IGMP Membership Report报文后，根据组播路由器收 到的从以太网交换机发来的数据包的 vlan号， 通过查找第 （1 ) 步骤中 记录的用户组播访问权限表, 获知对应用户的用户标识， 以及该 IGMP Membership Report报文所属用户， 然后以查到的用户标识为用户名， 以 主机所要加入的组播地址为属性，发送扩展的 RADIUS认证报文到 AAA 服务器进行认证， 由 AAA服务器根据用户申请的业务决定是否让用户 加入： 如果用户拥有权限， 则发送 accept报文作回应， 否则发送 reject 报文回应； 路由器收到 reject报文后不作任何处理， 收到 accept报文后 将用户能够加入的组的组播地址写到用户组播访问权限表中， 并对该主 机加入的报文作通常组播路由器的例行处理， 然后生成一个 HGMP Join 报文发送到交换机， 该报文包含了申倚加入组播组的主机所连接的端口 对应的 vlan号和申请加入的组播地址， 并且包含 Join命令域； 并且， 组 播路由器还要如同普通組播路由器一样地对 IGMP Membership Report 报文进行建立组播转发树的常规处理； ( 4 )由组播路由器控制以太网交换机进行組播转发， 两者之间采用 HGMP协议作为受控组播的控制协议： 在以太网交换机上由组播路由器 控制其组播转发表的生成与删除， 当组播路由器允许某个主机加入某个 组时，它给交换机发送包含有申请加入组播组的主机的 vlan号和申请加 入的组播地址的 HGMP Join报文； 当组播路由器要终止某个主机加入某 个组时，它给交换机发送包含有终止加入组播组的主机的 vlan号和终止 加入的组播组地址的 HGMP Leave报文， 通过这种方法， 组播路由器控 制以太网交换机的的组播转发；
( 5 ) 交换机对 HGMP控制报文进行处理： 交换机收到 HGMP Join 报文后， 用组播地址对应的 MAC地址查 CAM表， 如果能够找到与其 对应的一个表项， 则通过报文中的 vlanID查表来获得该主机端口号， 然 后将该端口号加入到该表项中； 如果不能找到， 则在 CAM表中增加一 个表项, 该表项包含该组播地址所对应的 MAC地址、 申请加入组播组 的主机的端口号以及与交换机相连的路由器的端口号； 当交换机收到 HGMP Leave报文后 ,用组播地址对应的 MAC地址查 CAM表而得到一 个表项， 再通过 vlanID查表来获得该主机端口号， 然后将该端口号从该 表项中删除，如果该端口号是该表项的唯——个端口，则删除整个表项；
( 6 )组播流的转发： 当路由器收到组播源发来的组播流时， 将该组 播流按照转发表转发给出端口， 路由器在处理主机的 IGMP Membership Report报文时， 按交换机的实际端口建立组播转发出口， 组播流只发一 份拷贝到交换机；
( 7 )主机退出组播组： 当主机完成组播后， 需要退出组播组时， 由 主机发送 IGMP Leave报文要求退出组播组， 路由器在收到该离开报文 后， 提取报文中的 vlanID, 并通过它查找第 （1 ) 步骤中建立的用户组 播访问权限表得到对应的表项， 删除该表项中成员离开报文所指示的组 播地址， 并完成通常路由器对成员离开报文的例行处理， 再生成一个
HGMP Leave报文发给交换机， 该报文包含了想要离开组播组的主机的 vlan号和要离开的组播地址， 并且包含 Leave命令域。
5、 根据权利要求 3所述的受控组播的实现方法， 其特征在于： 所述的以太网交换机的组播转发表与单播转发表是共用的。
6、 才艮据权利要求 3 所述的受控组播的实现方法， 其特征在于： 以太网交换机在转发报文时， 若报文转发到组播路由器端口， 使用 vlan 协议； 否则， 向别的端口发送报文时不用 vlan协议。
7、 根据杈利要求 3 所述的受控组播的实现方法， 其特征在于： 上述第 （6 ) 步骤中的组播路由器发送给交换机的组播数据包不加 vlan 号。
8、 根据权利要求 3所述的受控组播的实现方法， 其特征在于， 上述第 （7 ) 步骤中的主机退出組播組的操作还可以通过下述方法实现 之： 路由器在获知用户下线时主动发送 HGMP Leave 4艮文而停止向用户 发送组播流， 其具体实现方法与 IGMP Leave报文的操作步驟相同。
9、 根据权利要求 3所述的受控组播的实现方法， 其特征在于， 该受控组播的实现方法还对组播发送者进行控制： 主机向某个组播组发 送数据时， 第一个接收该数据的组播路由器利用组播访问控制列表对数 据报文进行过滤， 将满足其要求的报文转发到组播树。
10、 根据权利要求 9所述的受控组播的实现方法， 其特征在于： 所述的组播访问控制列表是由命令字、 源地址和组地址构成。
11、 根据权利要求 9所述的受控组播的实现方法， 其特征在于： 所述的组播访问控制列表是由一个集中的组播业务控制服务器下发给 各组播路由器， 路由器藉由该组播访问控制列表完成控制发送者的功 能， 该组播业务控制服务器同时兼作 AAA服务器。
12、 根据权利要求 9或 11所述的受控组播的实现方法， 其特征在 于： 所述的组播访问控制列表也可通过一个集中的策略服务器或网管下 发。
PCT/CN2002/000596 2002-01-30 2002-08-28 Systeme et procede de mise en application de multidiffusion commandee WO2003065677A1 (fr)

Priority Applications (5)

Application Number Priority Date Filing Date Title
DE60231556T DE60231556D1 (de) 2002-01-30 2002-08-28 System und implementierungsverfahren für gesteuertes multicast
AU2002330421A AU2002330421B2 (en) 2002-01-30 2002-08-28 System and implementation method of controlled multicast
JP2003565135A JP3845086B2 (ja) 2002-01-30 2002-08-28 制御されたマルチキャストのシステム及び実行方法
EP02764488A EP1480405B1 (en) 2002-01-30 2002-08-28 System and implementation method of controlled multicast
US10/502,543 US7680884B2 (en) 2002-01-30 2002-08-28 System and implementation method of controlled multicast

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CNB021004455A CN1192574C (zh) 2002-01-30 2002-01-30 受控组播的系统及其实现方法
CN02100445.5 2002-01-30

Publications (1)

Publication Number Publication Date
WO2003065677A1 true WO2003065677A1 (fr) 2003-08-07

Family

ID=4739369

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2002/000596 WO2003065677A1 (fr) 2002-01-30 2002-08-28 Systeme et procede de mise en application de multidiffusion commandee

Country Status (9)

Country Link
US (1) US7680884B2 (zh)
EP (2) EP1480405B1 (zh)
JP (1) JP3845086B2 (zh)
CN (1) CN1192574C (zh)
AT (1) ATE425621T1 (zh)
AU (1) AU2002330421B2 (zh)
DE (1) DE60231556D1 (zh)
RU (1) RU2282945C2 (zh)
WO (1) WO2003065677A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1715628A4 (en) * 2004-03-24 2007-03-21 Huawei Tech Co Ltd METHOD FOR IMPLEMENTING A SELECTIVE BROADCAST SERVICE
US8155137B2 (en) * 2005-04-18 2012-04-10 France Telecom Method and system for transmitting a multicast stream over a data exchange network

Families Citing this family (85)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7281263B1 (en) * 2001-02-23 2007-10-09 Sprint Communications Company L.P. System and method for managing security access for users to network systems
EP1376926B1 (en) * 2002-06-25 2007-03-21 Alcatel Method and device for data broadcasting in third generation networks
WO2004043019A1 (ja) * 2002-11-05 2004-05-21 Fujitsu Limited ネットワーク中継方法及び装置
US7233987B2 (en) * 2002-12-20 2007-06-19 Alcatel Canada Inc. System and method for converting requests between different multicast protocols in a communication network
US7516487B1 (en) 2003-05-21 2009-04-07 Foundry Networks, Inc. System and method for source IP anti-spoofing security
US7523485B1 (en) * 2003-05-21 2009-04-21 Foundry Networks, Inc. System and method for source IP anti-spoofing security
US20040255154A1 (en) * 2003-06-11 2004-12-16 Foundry Networks, Inc. Multiple tiered network security system, method and apparatus
US8555352B2 (en) 2003-06-20 2013-10-08 Juniper Networks, Inc. Controlling access nodes with network transport devices within wireless mobile networks
US7746799B2 (en) 2003-06-20 2010-06-29 Juniper Networks, Inc. Controlling data link layer elements with network layer elements
CN100346605C (zh) * 2003-06-26 2007-10-31 华为技术有限公司 一种组播源控制的方法和系统
US7876772B2 (en) 2003-08-01 2011-01-25 Foundry Networks, Llc System, method and apparatus for providing multiple access modes in a data communications network
US7735114B2 (en) * 2003-09-04 2010-06-08 Foundry Networks, Inc. Multiple tiered network security system, method and apparatus using dynamic user policy assignment
US7774833B1 (en) * 2003-09-23 2010-08-10 Foundry Networks, Inc. System and method for protecting CPU against remote access attacks
GB2406462A (en) * 2003-09-25 2005-03-30 Nokia Corp Multicasting apparatus
CN1286297C (zh) * 2003-09-25 2006-11-22 华为技术有限公司 一种实现用户位置标识传递的方法
US20050080901A1 (en) * 2003-10-14 2005-04-14 Reader Scot A. Method and apparatus for controlling access to multicast data streams
US8528071B1 (en) 2003-12-05 2013-09-03 Foundry Networks, Llc System and method for flexible authentication in a data communications network
KR100523490B1 (ko) * 2003-12-17 2005-10-24 한국전자통신연구원 이더넷 기반 수동형 광가입자망에서의 멀티캐스트 서비스지원 방법
CN100454888C (zh) * 2004-03-06 2009-01-21 鸿富锦精密工业（深圳）有限公司 组播流量控制管理方法
KR100594737B1 (ko) * 2004-05-04 2006-06-30 삼성전자주식회사 공인 아이피 주소가 필요 없는 네트워크 시스템 및 시스템설정 방법
JP4533247B2 (ja) * 2004-06-08 2010-09-01 キヤノン株式会社 サービス提供システム、サービス提供方法及びサービス提供装置
JP4516397B2 (ja) * 2004-10-05 2010-08-04 株式会社日立製作所 レイヤ２スイッチ
CN100426787C (zh) * 2004-12-17 2008-10-15 中兴通讯股份有限公司 以太网交换机动态发现组播路由器的方法
WO2006087472A1 (fr) * 2005-02-18 2006-08-24 France Telecom Procede et equipements de controle d'acces a des flux ip multicast
DE602006016251D1 (de) * 2005-03-29 2010-09-30 Lg Electronics Inc Verfahren zum senden und empfangen von steuerinformationen für einen punkt-zu-mehrpunkt-multimedia-multicast-dienst
CN1848728B (zh) * 2005-04-14 2010-09-01 中国科学院声学研究所 一种基于ip网络的组播数据受控方法
CN100384124C (zh) * 2005-04-30 2008-04-23 杭州华三通信技术有限公司 为局域网接入用户提供网络电视服务的方法及系统
CN100442723C (zh) * 2005-06-30 2008-12-10 华为技术有限公司 监控组播用户的装置及实现方法
FR2889390A1 (fr) * 2005-07-29 2007-02-02 France Telecom Mesure d'audience de flux ip multicast
US8503446B2 (en) 2005-08-29 2013-08-06 Alcatel Lucent Multicast host authorization tracking, and accounting
CN100463447C (zh) * 2005-08-31 2009-02-18 杭州华三通信技术有限公司 控制组播数据转发的交换设备及方法
CN1863153B (zh) * 2005-10-09 2010-09-29 华为技术有限公司 以太网支持源特定组播转发的方法及其设备
CN100463449C (zh) * 2005-10-21 2009-02-18 中兴通讯股份有限公司 一种用于宽带接入设备的组播快速加入方法
US7843845B2 (en) * 2005-11-28 2010-11-30 Alcatel Lucent Diagnostic tool and method for troubleshooting multicast connectivity flow problem(s) in a layer 2 aggregation network
CN1801711B (zh) * 2006-01-18 2011-03-23 杭州华三通信技术有限公司 一种组播组成员认证方法和装置
KR100808188B1 (ko) * 2006-03-23 2008-03-03 엘지전자 주식회사 멀티캐스팅 기능을 가진 이동통신 단말기 및 이를 이용한멀티캐스팅 방법
CN100420240C (zh) * 2006-03-30 2008-09-17 华为技术有限公司 一种组播权限控制方法
US7953089B1 (en) * 2006-05-16 2011-05-31 Cisco Technology, Inc. Systems and methods for multicast switching in a private VLAN
CN101087246B (zh) * 2006-06-08 2011-04-20 中国电信股份有限公司 一种实现网络层组播业务及业务管理的系统与方法
CN101119290B (zh) * 2006-08-01 2011-06-01 华为技术有限公司 以太网支持源特定组播转发的方法及系统
CN102694666B (zh) * 2006-08-15 2015-01-28 华为技术有限公司 一种组播业务处理方法以及设备
US8681779B2 (en) * 2006-09-01 2014-03-25 Alcatel Lucent Triple play subscriber and policy management system and method of providing same
CN101155046B (zh) * 2006-09-25 2011-06-22 华为技术有限公司 实现组播控制的网络控制系统和方法
US20080175239A1 (en) * 2007-01-23 2008-07-24 Yipes Enterprise Services, Inc Multicast wide-area network for distributing data to selected destinations with limited or no replication
US8392593B1 (en) 2007-01-26 2013-03-05 Juniper Networks, Inc. Multiple control channels for multicast replication in a network
CN101247549B (zh) * 2007-02-16 2012-06-27 华为技术有限公司 组播方法和组播系统以及组播设备
JP4773387B2 (ja) * 2007-03-19 2011-09-14 株式会社日立製作所 ネットワークシステム
US8238337B1 (en) * 2007-04-03 2012-08-07 Marvell Isreal Ltd. (M.I.S.L.) Hybrid multicast switch employing network-layer routing
CN101312400B (zh) * 2007-05-25 2011-03-30 上海大亚科技有限公司 四以太网口调制解调器设备上实现igmp侦听功能的方法
CN101321073B (zh) * 2007-06-04 2010-09-08 华为技术有限公司 一种组播业务授权控制的方法及装置
US8203943B2 (en) * 2007-08-27 2012-06-19 Cisco Technology, Inc. Colored access control lists for multicast forwarding using layer 2 control protocol
CN101394277A (zh) * 2007-09-17 2009-03-25 华为技术有限公司 实现组播认证的方法和装置
EP2213042A1 (en) 2007-10-15 2010-08-04 Media Patents, S. L. Method for managing multicast traffic in a data network and network equipment using said method
US8295300B1 (en) * 2007-10-31 2012-10-23 World Wide Packets, Inc. Preventing forwarding of multicast packets
CN101202715B (zh) * 2007-11-27 2012-02-22 杭州华三通信技术有限公司 组播权限自动部署方法和装置
CN101459595B (zh) * 2007-12-14 2012-05-23 华为技术有限公司 识别最后一跳交换机的方法、交换机及组播设备
US9031068B2 (en) 2008-02-01 2015-05-12 Media Patents, S.L. Methods and apparatus for managing multicast traffic through a switch
WO2009095041A1 (en) * 2008-02-01 2009-08-06 Soporte Multivendor S.L. Method for managing multicast traffic through a switch operating in the layer 2 of the osi model, and router and switch involved in said method
WO2009109684A1 (es) 2008-03-05 2009-09-11 Media Patents, S. L. Procedimiento para monitorizar o gestionar equipos conectados a una red de datos
WO2009151750A1 (en) * 2008-04-03 2009-12-17 Telcordia Technologies, Inc. A formal language for multicast communication
CN101291240B (zh) * 2008-06-19 2010-08-25 杭州华三通信技术有限公司 一种组播流传输方法和系统
US8612559B2 (en) * 2008-12-10 2013-12-17 Cisco Technology, Inc. Central controller for coordinating multicast message transmissions in distributed virtual network switch environment
CN101442793B (zh) * 2008-12-30 2010-09-29 杭州华三通信技术有限公司 无线网络接入方法、装置和系统
CN101873658A (zh) * 2009-04-21 2010-10-27 华为技术有限公司 移动组播切换的方法和设备
CN101635724A (zh) * 2009-06-30 2010-01-27 中兴通讯股份有限公司 一种实现组播成员认证的方法及系统
US8275891B2 (en) * 2009-07-20 2012-09-25 At&T Intellectual Property I, L.P. Method and apparatus for social networking in a dynamic environment
CN101651553B (zh) * 2009-09-03 2013-02-27 华为技术有限公司 用户侧组播业务主备保护系统、方法及路由设备
JP5569057B2 (ja) * 2010-03-15 2014-08-13 ヤマハ株式会社 通信システム、スイッチングハブ、およびルータ
CN101841485B (zh) * 2010-05-28 2013-04-24 华为技术有限公司 组播流量分担的方法及相关装置
US8849989B2 (en) * 2010-10-22 2014-09-30 Telefonaktiebolaget L M Ericsson (Publ) Mechanism for tracking host participation in multicast groups
CN102202001A (zh) * 2011-06-15 2011-09-28 中国电信股份有限公司 用户带宽动态调整的方法、系统和宽带网络网关
WO2013000165A1 (en) * 2011-06-30 2013-01-03 France Telecom Research & Development Beijing Company Limited Data routing
US8887222B2 (en) * 2011-09-14 2014-11-11 Qualcomm Incorporated Multicasting in a wireless display system
CN102333099B (zh) * 2011-10-27 2014-09-10 杭州华三通信技术有限公司 一种安全控制方法和设备
CN102368707B (zh) * 2011-10-31 2013-06-12 华为技术有限公司 一种组播控制的方法、设备及系统
CN102594818A (zh) * 2012-02-15 2012-07-18 北京星网锐捷网络技术有限公司 网络访问权限控制方法、装置及相关设备
US20160192403A1 (en) * 2014-12-30 2016-06-30 Qualcomm Incorporated Mechanism to provide lte voice, internet and embms services over ethernet for connected home architecture
CN107885573B (zh) * 2016-09-29 2021-09-14 华为技术有限公司 一种数据流量的控制方法、控制器及数据中心系统
RU175729U1 (ru) * 2017-05-25 2017-12-15 Общество с ограниченной ответственностью "БУЛАТ" Мультисервисный маршрутизатор
US11153145B2 (en) * 2017-06-07 2021-10-19 Arista Networks, Inc. System and method of a centralized gateway that coordinates between multiple external controllers without explicit awareness
US11018886B1 (en) * 2018-09-20 2021-05-25 Cisco Technology, Inc. Methods and apparatus for selectively filtering an IP multicast data stream for selected group members of a multicast group
RU186859U1 (ru) * 2018-11-21 2019-02-06 Общество с ограниченной ответственностью "БУЛАТ" Мультисервисный маршрутизатор
US11277276B2 (en) 2019-05-31 2022-03-15 Nxp Usa, Inc. Multicast processing for neighbor discovery proxy devices using hardware filtering
US11683262B2 (en) * 2019-11-26 2023-06-20 Cisco Technology, Inc. Group-based policies for inter-domain traffic
CN112202814B (zh) * 2020-11-04 2022-02-08 中国电子科技集团公司第三十研究所 一种路由交换设备内生安全动态防护功能的处理方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0887982A2 (en) * 1997-06-23 1998-12-30 Sun Microsystems, Inc. Method and system for secure distribution of cryptographic keys on multicast networks
WO2000062480A2 (en) * 1999-04-13 2000-10-19 Nortel Networks, Inc. Apparatus and method for transmitting messages across different multicast domains
US6275859B1 (en) * 1999-10-28 2001-08-14 Sun Microsystems, Inc. Tree-based reliable multicast system where sessions are established by repair nodes that authenticate receiver nodes presenting participation certificates granted by a central authority

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6041166A (en) * 1995-07-14 2000-03-21 3Com Corp. Virtual network architecture for connectionless LAN backbone
US5684800A (en) * 1995-11-15 1997-11-04 Cabletron Systems, Inc. Method for establishing restricted broadcast groups in a switched network
US5968126A (en) * 1997-04-02 1999-10-19 Switchsoft Systems, Inc. User-based binding of network stations to broadcast domains
US6331983B1 (en) * 1997-05-06 2001-12-18 Enterasys Networks, Inc. Multicast switching
US6307837B1 (en) * 1997-08-12 2001-10-23 Nippon Telegraph And Telephone Corporation Method and base station for packet transfer
US6035405A (en) 1997-12-22 2000-03-07 Nortel Networks Corporation Secure virtual LANs
US6839348B2 (en) * 1999-04-30 2005-01-04 Cisco Technology, Inc. System and method for distributing multicasts in virtual local area networks
US6870842B1 (en) * 1999-12-10 2005-03-22 Sun Microsystems, Inc. Using multicasting to provide ethernet-like communication behavior to selected peers on a network
US20020091926A1 (en) * 2001-01-10 2002-07-11 The Furukawa Electric Co., Ltd. Multicast authentication method, multicast authentication server, network interconnection apparatus and multicast authentication system
JP2002290458A (ja) * 2001-03-26 2002-10-04 Fujitsu Ltd マルチキャストシステム
US7194622B1 (en) * 2001-12-13 2007-03-20 Cisco Technology, Inc. Network partitioning using encryption
US7263610B2 (en) * 2002-07-30 2007-08-28 Imagictv, Inc. Secure multicast flow

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0887982A2 (en) * 1997-06-23 1998-12-30 Sun Microsystems, Inc. Method and system for secure distribution of cryptographic keys on multicast networks
WO2000062480A2 (en) * 1999-04-13 2000-10-19 Nortel Networks, Inc. Apparatus and method for transmitting messages across different multicast domains
US6275859B1 (en) * 1999-10-28 2001-08-14 Sun Microsystems, Inc. Tree-based reliable multicast system where sessions are established by repair nodes that authenticate receiver nodes presenting participation certificates granted by a central authority

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1715628A4 (en) * 2004-03-24 2007-03-21 Huawei Tech Co Ltd METHOD FOR IMPLEMENTING A SELECTIVE BROADCAST SERVICE
US7830825B2 (en) 2004-03-24 2010-11-09 Huawei Technologies Co., Ltd. Method for realizing the multicast service
US8155137B2 (en) * 2005-04-18 2012-04-10 France Telecom Method and system for transmitting a multicast stream over a data exchange network

Also Published As

Publication number Publication date
RU2282945C2 (ru) 2006-08-27
JP2005516544A (ja) 2005-06-02
EP1986396A2 (en) 2008-10-29
RU2004126668A (ru) 2006-02-10
EP1480405A4 (en) 2006-08-16
EP1986396B1 (en) 2013-04-03
ATE425621T1 (de) 2009-03-15
EP1986396A3 (en) 2008-11-05
EP1480405B1 (en) 2009-03-11
CN1192574C (zh) 2005-03-09
US20050091313A1 (en) 2005-04-28
JP3845086B2 (ja) 2006-11-15
US7680884B2 (en) 2010-03-16
EP1480405A1 (en) 2004-11-24
AU2002330421B2 (en) 2006-05-25
DE60231556D1 (de) 2009-04-23
CN1414759A (zh) 2003-04-30

Similar Documents

Publication Publication Date Title
WO2003065677A1 (fr) Systeme et procede de mise en application de multidiffusion commandee
JP3864312B2 (ja) ８０２．１ｘプロトコルベースマルチキャスト制御方法
US8203943B2 (en) Colored access control lists for multicast forwarding using layer 2 control protocol
US8028324B2 (en) Method for transmitting policy information between network equipment
JP4002380B2 (ja) マルチキャストシステム、認証サーバ端末、マルチキャスト受信者端末管理方法、並びに記録媒体
US20050080901A1 (en) Method and apparatus for controlling access to multicast data streams
US20080232368A1 (en) Network system
US20110167482A1 (en) Secure authentication advertisement protocol
JP2004135281A (ja) 安定したマルチキャストフロー
WO2004114619A1 (fr) Procede et systeme pour commander une source de diffusion selective
JP2005516544A5 (zh)
WO2009036685A1 (fr) Procédé et appareil pour implémenter une authentification de multidiffusion
WO2008098506A1 (fr) Procédé, système et dispositif de multidiffusion
WO2008052475A1 (fr) Procédé, système et dispositif pour une authentification de multidiffusion
US9065669B2 (en) Method and apparatus for authorizing multicast forwarding states
CN100414933C (zh) 基于ppp协议的组播业务的实现方法及装置
Ishikawa et al. An architecture for user authentication of IP multicast and its implementation
CN1848728B (zh) 一种基于ip网络的组播数据受控方法
CN110138796A (zh) 组播控制方法和装置
CN100563157C (zh) 组播服务节点的受控认证方法
Sun et al. A stateful multicast access control mechanism for future metro‐area‐networks
JP2004086532A (ja) Ｉｐマルチキャスト通信システムにおけるセッション制御方法、セッション制御プログラムおよびセッション制御プログラムを記録した記録媒体
US8966100B1 (en) System, device, and method for distributing access control information in a communication system
JP2004180023A (ja) データ中継方法、データ中継装置およびその装置を用いたデータ中継システム

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ OM PH PL PT RO RU SD SE SG SI SK SL TJ TM TN TR TT TZ UA UG US UZ VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR IE IT LU MC NL PT SE SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 10502543

Country of ref document: US

Ref document number: 2002330421

Country of ref document: AU

WWE Wipo information: entry into national phase

Ref document number: 2003565135

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 2002764488

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2004126668

Country of ref document: RU

WWP Wipo information: published in national office

Ref document number: 2002764488

Country of ref document: EP