WO2004040860A1

WO2004040860A1 - Ip multi-cast communication system

Info

Publication number: WO2004040860A1
Application number: PCT/JP2002/011375
Authority: WO
Inventors: Emiko Kobayashi
Original assignee: Fujitsu Limited
Priority date: 2002-10-31
Filing date: 2002-10-31
Publication date: 2004-05-13
Also published as: JP3911513B2; JPWO2004040860A1

Abstract

An IP multi-cast communication system includes a layer 2 switch for containing a plurality of receivers dynamically participating or not participating in a multi-cast group, a layer 3 switch adapted to a subnet for receiving IP multi-cast data transmitted from a transmitter via an IP network and delivering the received IP multi-cast data to authorized receivers participating in the multi-cast group via the layer 2 switch under control, and a control device for batch-mode managing receiver management information for authentication of the receivers obtained according to the Internet group management protocol IGMP. The layer 3 switch authenticates the receivers according to the receiver management information adapted to its subnet among the receiver management information batch-mode managed by the control device. The layer 2 switch stops transmission of the IP multi-cast data or thins the IP multi-cast data transmitted to receivers who are determined to have made unauthorized accesses by the layer 3 switch.

Description

Specification

IP multicast communication system

The present invention relates to an Internet Protocol (IP) multicast communication system, and in particular, prevents the reception of multicast data due to unauthorized access by using information conforming to the Internet Group Management Protocol (IGMP). Or an IP multicast communication system capable of interfering. Background art

In a conventional IP multicast communication system, as shown in FIG. 1, a multicast router R-RT on the receiving side sends a message to a sender (strictly speaking, a sending terminal such as a host Z server computer and its sender). ) —Receives the IP multicast data transmitted from the multicast router τ-RT on the transmitting side and the IP network NW.

The switching hub R—SW_HUB corresponding to the subnetwork (subnet) on the receiving side transmits the IP multicast data received from the multicast router R—RT on the receiving side to multiple recipients (strictly speaking) (Including user terminals and their users). Here, when there is one sender, it is possible to omit the arrangement of the switching hub T-SW-HUB on the transmitting side.

In this IP multicast communication system, when a data request is received from a receiver or a data transmission request is sent from a sender, IP multicast data (hereinafter, unless otherwise limited, simply referred to as multicast data or data) May be transmitted to the recipient.

In other words, when a sender sends multicast data to an IP network, an IP multicast address is specified by the receiver, and a multicast routing protocol (for example, PIM- When SM (Protocol Independent Multicast-Sparse Mode) or PIM (Protocol Independent Multicast-Dense Mode) is specified, receivers must obtain multicast data. Becomes possible.

The multicast address is a class D IP address and includes the multicast group ID. Since this multicast group ID has a certain range of address values (for example, 224.0.0.0 to 239.255.25.5.255), the address can be easily compared with the multicast address. I understand. For this reason, it is difficult to control the access to the multicast data by the receiver, and the receiver of the unauthorized access may obtain the multicast data.

In video distribution, data compressed by MPEG2 (Moving Picture Experts Group-2) is distributed. However, when video multicast data (including moving image data and audio data) is encrypted, high-speed Broadband transmission (6 Mbps, etc.) causes delays in data encryption and decryption. Therefore, it is difficult to use encryption technology in streaming.

In contrast, in the conventional method of acquiring a video by inputting a password notified from the video sender, the communication between the video sender and the receiver is one-to-many communication, and the traffic is proportional to the number of receivers. If the password delivery is delayed, the video may not be viewable. In addition, it is necessary to manage recipients and passwords for each distribution program, which complicates processing on the management side.

In the method of Simple Multicast Receiver Access Control (All Provisions of Section 10 of RFC 2026), a public key and a private key are used between the receiver and the nearest multicast router, and the multicast router is connected to the Internet. · The validity of the recipient is checked according to the Group Management Protocol I GMP, and acceptance or rejection is implemented.

However, it is extremely vulnerable if there is a normal recipient in the same subnet, that is, there are many spoofing as a normal recipient. When the above-mentioned Si Multicast Receiver Accel ss Control method is combined with the existing “peep” technology called IGMP Snooping, the I GMP snooping pin in the switching hub can be used. The port directly reads the MAC (Media Access Control) address from the header of the data flowing through each port and exchanges data between the ports to which the source and destination are connected. Delay occurs. Disclosure of the invention

An object of the present invention is to provide a method capable of preventing or hindering reception of multicast data due to unauthorized access by using information conforming to the Internet Group Management Protocol IGMP.

In order to solve the above problems, an IP multicast communication system of the present invention includes: a layer 2 switch accommodating a plurality of receivers that can dynamically join or leave a multicast group;

A sub-system for receiving IP multicast data transmitted from a sender through an IP network and distributing the received IP multicast data to a plurality of valid recipients participating in the multicast group via the subordinate Layer 2 switch Network-capable Layer 3 switch;

A control device that collectively manages recipient management information for authenticating the validity of the recipient obtained in accordance with the group management protocol IGMP; and the layer 3 switch comprises: Authenticates the validity of the recipient based on the recipient management information corresponding to its own sub-network among the recipient management information to be collectively managed,

The layer 2 switch stops the transmission of the IP multicast data to a receiver of the unauthorized access identified by the layer 3 switch, and performs the thinning on the IP multicast data before transmission.

In this IP multicast communication system, the layer 2 switch may be a switching device, and the layer 3 switch may be a multicast router.

The control device as an authentication server has a table storing the recipient management information. The receiver management information collectively managed by the control device includes a multicast group address, an IP address, a MAC address, It includes the multicast group participation level, the subnetwork address, and the identification flag of the unauthorized access recipient.

Further, when the layer 3 switch receives, via the layer 2 switch, a join message to the IP multicast group according to the IGMP transmitted from the receiver, the subnetwork address corresponding to the receiver If it does not exist in the receiver management information owned by itself, the direction is changed and a notification message conforming to the IGMP is delivered to the layer 2 switch, and the identification flag of the unauthorized access recipient is set. Let it.

Here, the Internet group management protocol IGMP is a protocol for distributing IP multicast data to a specific group identified by an IP multicast group address (a single IP destination address). BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 shows a configuration example of a conventional IP multicast communication system.

FIG. 2 shows a first configuration example of the IP multicast communication system of the present invention. FIG. 3 shows a second configuration example of the IP multicast communication system of the present invention. FIG. 4 shows a flowchart of the processing of the authentication server.

FIG. 5 shows a flowchart of the processing of the authentication server.

FIG. 6 shows a flowchart of the multicast router process.

FIG. 7 shows a flowchart of the multicast route processing.

FIG. 8 shows a flowchart of the multicast processing.

-Figure 9 shows a flow chart of the processing of the switcher hub.

FIG. 10 shows a flowchart of the process of the switch hub.

FIG. 11 shows a flowchart of the processing of the switch hub.

Figure 12 shows a flowchart of the process of the receiver (the person who wants to receive multicast data).

Figure 13 shows a flowchart of the process of the receiver (the person who wants to receive multicast data overnight). BEST MODE FOR CARRYING OUT THE INVENTION

Next, embodiments of the present invention will be described with reference to the drawings.

[Configuration of IP multicast communication system]

Referring to FIGS. 2 and 3 showing a system configuration according to an embodiment of the present invention, an IP multicast communication system 1 has a multicast router 3 (31, 31) connected to an IP network 2 such as the Internet. 32, 33).

These multicast routers 3 are arranged for each subnetwork (subnet), and are connected to subordinate switching hubs (SW-HUB) 4 (41, 42, 43), respectively. Multicast router 3 can be replaced by another Layer 3 (L3) switch that supports IP multicast.

The switcher hub 41 accommodates a sender 5 (strictly including a transmitting terminal such as a host / server computer and its handler) 5 for transmitting IP multicast data. The switching hub 42 houses the authentication server 6. Here, the arrangement of the switching hubs 41 and 42 can be omitted. The switching hubs 41 and 42 can be replaced with another layer 2 (L 2) switch.

The switcher hub 43 has a plurality of recipients that can dynamically join or leave (non-participate) a multicast group (strictly, including user terminals such as personal combination and their users) 7 (7 1, 72, 73) The switching hub 43 can be replaced with another L2 switch.

In the IP multicast communication system 1, the authentication server 6 manages valid recipients 7 using information in accordance with the Internet / Group Management Protocol IGMP. For this purpose, the authentication server 6 has a user management information table 61 storing user management information which is authentication information of the receiver 7 of the multicast data.

Strictly speaking, all multicast routers 31, 32, and 33 related to the edge of the IP network 2 and the switcher hub 43 on the receiving side that accommodates the receiver 7 are the users who have stored the user management information. It has management information tables 34 and 44, respectively. The receiving-side multicast router 33 corresponding to the receiver 7 authenticates an unauthorized access user (recipient) based on the user management information in the user management information table 34.

In the IP multicast communication system 1 adopting the first configuration example shown in FIG. 2, the switching hub 43 on the receiving side refers to the user management information table 44 to read the multicast group among the data receiving applicants. The distribution of the multicast data (including moving image data and audio data) is stopped for the recipient 7 who has not registered for participation in one session. This can prevent the unauthorized receiver 7 from receiving the multicast data.

In the IP multicast communication system 1 adopting the second configuration example shown in FIG. 3 fc, the switching hub 43 on the receiving side refers to the user management information table 44 to read the multicast group among the subscribers who wish to receive the data. The receiver 7 that has not registered to participate in the broadcast is thinned out from the moving image data of the multicast data and transmitted. By thinning out this data, it is possible to prevent the unauthorized receiver 7 from receiving the multicast data.

Further detailed configurations of the multicast routers 31, 32, 33, the switching hub 43, and the authentication server 6 will be described later.

[Authentication server function]

4 and 5 show flowcharts of the processing of the authentication server 6 in FIGS. 2 and 3. Referring to FIGS. 2 to 5 together, the authentication server 6 that manages the recipients 7 who want to receive the multicast data has the following functions.

(1) Based on the IGMP message, the user registration management unit 62 in the authentication server 6 checks whether the data is for user registration, and if the data is for user registration, performs the following processing (FIG. 4). Inside S401).

(2) The user registration management unit 62, based on the user management information table 61, sets the attributes (I 受信 multicast group address, IP address, MAC address, (Participation level, illegal flag, etc.) are checked, and if the reception of multicast data is permitted, it is registered in the user management information table 61, and the user management information table 61 is updated (S402, S403).

(3) After updating the user management information table 61, the user registration management unit 62 starts the distribution process of the user management information (S404).

(4) The user management information delivery processing unit 63 started by the user registration management unit 62 cooperates with the user registration management unit 62 to transfer the user management information corresponding to the contents of the user management information table 61 to the switching hub. It is distributed to all the multicast routers 33 in the receiving side subnet through 42 (S501 in FIG. 5). In this case, only one Multicastle Night 33 is shown.

In addition, the user management information distribution processing unit 63, in cooperation with the user registration management unit 62, switches a part of the user management information (information necessary for routing) of the contents of the user management information table 61. To the multicast routers 31 and 32 related to the edge of the IP network 2 through the network hub 42.

(5) In the above-described process S401, if the user registration management unit 62 does not execute the user registration data overnight, the user registration management unit 62 sends a message to join the multicast group (IGMP Join message) or a leave message (IGMP Leave message). Based on this, the user management information table 61 is updated (S405).

(6) If the reception of the multicast data is not permitted in the process S402, the user registration management unit 62 notifies the receiver 7 who desires to receive the multicast data of “not permitted” (S406).

[Multicaster function]

FIGS. 6, 7 and 8 show flowcharts of the processing of the multicast server 33 in FIGS. 2 and 3. With reference to FIGS. 2, 3, 6 to 8, the function of the multicast router 33 will be described.

(1) The user management unit 35 of the multicast router 33 that has received all the user management information corresponding to the content of the user management information table 61 distributed from the authentication server 6 cuts out only the user management information belonging to its own subnet ( Then, the user management information table 34 is updated based on the specified user management information (S601, S602 in FIG. 6).

Here, the user management section 35 cuts the user management information belonging to its own subnet. The information used for this is the IP multicast group address (multicast address), each IP address corresponding to the recipients 71, 72, and 73, or the subnet address of the sender (recipient).

Note that a multicast router associated with the edge of the IP network 2 that has received a part of the user management information (information necessary for routing) of the contents of the user management information table 61 distributed from the authentication server 6 31 The user management units 35 of 32 update their own user management information tables 34 based on the user management information.

(2) The user management unit 35 of the multicast router 33 transmits the user management information to be stored (held) in the user management information table 44 by the switching hub 43 to the subordinate switching hub 43. Yes (S603).

Note that the user management information corresponding to the contents of the user management information table 61 of the authentication server 6 is distributed only at the time of initial introduction, and when the user management information is changed thereafter, the I GMP Join S message or the I GMP Leave Since the S message is not used and the switching hub 43 does not snoop the information of the third layer (network layer) at the port level, the IP network 2 is not loaded.

Here, the I GMP Join S message is sent to the multicast router 33 that has received the I GM PJ oin (G rou) message for joining the multicast group sent from the receiver 7. This is a message to notify that the IMPMP Join message has been sent.

In addition, the multicast router 33 receiving the IGMP Leave (G roup) message for leaving the multicast group transmitted from the receiver 7 is transmitted to the switcher hub 43 by the I GMP Leave S message. This message notifies that the I GMP Leave message has been sent.

(3) Upon receiving the I GMP Join message from the subordinate switching hub 43 by the overnight receiver 36, the user manager 35 of the multicast server 33 receives the message to check the unauthorized receiver 7. Source (recipient) subnet The IP address of the packet (sometimes simply described as the source address) is checked against the contents of the user management information table 34, and if it does not exist in the user management information table 34, nothing is performed. If not, the direction is changed and the IGMP Join S message is transmitted to the switching hub 43 (S 604, S 605, S 606).

(4) Upon receiving the multicast data, the user management unit 35 of the multicast router 33, if there is at least one receiver 7 participating in the multicast group in the subnet, the multicast data addressed to the group. To the switcher hub 43 to relay the data to the full range of the subnet

(S701 and S702 in Fig. 7).

(5) The user management section 35 issues an IGMP HMQ (IGMP Host Membership Query) message to periodically inquire the receiver 7 as to whether or not to continue joining the multicast group (see FIG. 8). S 8 0 1).

(6) The user management unit 35 of the multicast router 33 that has received the I GMP HMR (JGMP Host Membership Report) message within a predetermined period of time sets the source address of the message and the user management information table 34 Check the contents and do nothing if the source address exists in the user management information table 34.If not, change the direction and send an I GM PJoin S message to the subordinate switcher hub 43. Is transmitted (S802, S803, S804). Here, the IGMP HMR message is a message for the receiver 7 to notify the multicast router 33 of the desired multicast address in response to the IGMP HMQ message.

(7) The user management unit 35 of the multicast router 33, which has received the IGMP Leave message from the subordinate switching network 43 by the data reception unit 36, transmits the message source address and the contents of the user management information table 34. Is checked, and if participation in the multicast group is defined in the user management information table 34, participation in the multicast group is canceled and the user management information table 34 is updated (S607, 608, S60). 9).

(8) In addition, the user management unit 35 stores the multi-key in the user management information table 34. If participation in the group is not defined, the direction is changed after updating the user management information table 34, and an IGMP Leave S message is transmitted to the switching unit 43 (S610).

(9) When there are a plurality of multicast routers 33 in the subnet on the receiving side, among these multicast routers 33, the router having the largest IP address is mutually selected so as to function as the designated router. The designated router issues an IGMP HMQ message and sends a message to the authentication server 6 to join or leave the receiver 7 to join the multicast group (S805, S806).

[Function of switch hub]

FIGS. 9, 10, and 11 show flowcharts of the processing of the switching hub 43 in FIGS. 2 and 3. The function of the switch chin hub 43 will be described with reference to FIGS.

(1) The user management unit 45 of the switching hap 43 registers the user management information distributed from the multicast router 33 and received by the data receiving unit 46 in the user management information table 44.

(2) The user management unit 45 compares the source address with the user management information in the user management information table 44 by using the IGMP JoinS message received from the multicast router 33. If the source address does not exist in the user management information table 44, the user management unit 45 regards the recipient as the unauthorized recipient 7 and sets an unauthorized recipient identification flag (illegal recipient) indicating that the recipient is an unauthorized recipient. Then, the user management information table 44 is updated (S901, S902, S903 in FIG. 9).

(3) The user management unit 45 refers to the user management information table 44 and distributes the multicast data as it is to the receiver 7 where no illegal flag is set, and sends the multicast data to the receiver 7 where the invalid flag is set. Stops the distribution of data to be multicast (MPEG data overnight) (see S1001, S1002, S1003 in FIG. 10 and the configuration in FIG. 2). The user management unit 45 provides the receiver 7 who has not issued a request for receiving multicast data, that is, a receiver 7 who has not previously participated in the multicast group. No data is delivered to believer 7.

(4) In addition, the user management unit 45 determines that the receiver 7 with an invalid flag is set to decimate data such as moving image data if the outline of the data is omissible. The data may be transmitted by deleting the data portion of the frame. Unauthorized receiver 7 will receive quality-degraded data whose data has been destroyed by the data thinning process (see 31101 to 31104 in Fig. 11 and the configuration in Fig. 3). .

(5) The user management unit 45 relays the IGMP HMQ message received by the data reception unit 46 from the multicast router 33 to all ports, that is, to all receivers 7 (71, 72, 73) (S 904, S 90 5).

(6) The user management unit 45 of the switcher hub 43, which has received the IGMP HMR message transmitted from the receiver 7 by the data receiving unit 46, relays the IGMP HMR message to the multicast router 33 (S906). , S907).

(7) When the user management unit 45 determines that the source address corresponding to the receiver 7 is defined in the user management information table 44 as participation in the multicast group using the IGMP Leave S message, Cancel participation in the group (S908, S909, S910).

(8) If the user management unit 45 determines that it is not defined, it checks the port information in the user management information table 44, and if an invalid flag is set, clears the flag (" The user management information table 44 is updated (set to "0") (S908, S909, S911, S912).

(9) If the user management unit 45 determines that the message is not an IGMP Leave S message in the above processing S908, determines that the source address is compatible with the authentication server 6, and determines the user management information corresponding to its own subnet. And the user management information table 44 is updated (S913, S914).

[Receiver (multicast data reception applicant) function]

FIGS. 12 and 13 show flowcharts of the processing of the receiver (the applicant of multicast data reception) 7 in FIGS. The function of the receiver 7 as a multicast data reception applicant will be described with reference to FIGS. 2, 3, 12, and 13. (1) The applicant 7 of the multicast data (video including moving image data and audio data) receives the data (video) to be received and the attribute of the receiver 7's participation in the multicast ( (Participation level) etc. are transmitted by multicast (S1201 in Fig. 12).

(2) Recipient 7 issues an IGMP Join message to participate in the multicast group. The issued IGMP Join message is transmitted to all multicast routers 33 in the receiving side subnet through the switcher hub 43 (S1301, S1302 in FIG. 13).

(3) The recipient 7 who continues to join the multicast group issues an IGMP HMR message when receiving the IGMP HMQ message. The issued IGMP HMR message is transmitted to all the multicast routers 33 through the switcher hub 43 (S1301, S1303).

(4) Unauthorized recipient 7 cannot receive data normally until it issues the IGMP Lea Ve message. In other words, the unauthorized receiver 7 can issue an IGMP Lea Ve message to all multicast routers 33 to leave the multicast group. After leaving the group, the unauthorized receiver 7 will no longer receive a message of quality deterioration.

[First operation example of IP multicast communication system]

Next, a first operation example of the IP multicast communication system 1 will be described with reference to FIG. 2 and a related diagram showing a flowchart of processing.

In the IP network system 1, the authentication server 6 manages (registers, deletes, and updates) a sender 5 that transmits multicast data and a receiver 7 that can properly receive the data. The authentication server 6 uses the user management information table 61 to manage the receiver 7 that can properly receive the multicast data.

The receiver 7 as a multicast data receiving applicant applies to the authentication server 6 the data to be received and information such as the level of participation in the multicast group by multicast. Here, the level of participation in the multicast group is as follows: Level 0: no transmission, no reception, level 1: transmission, no reception, level 2: transmission Yes, there are three types of reception.

The user registration management unit 62 of the authentication server 6 refers to the user management information registered in advance in the user management information table 61 and examines the application of the receiver 7. The user registration management unit 62 registers the user management information in the user management information table 61 and updates the user management information table 61 if the reception is permitted after the examination.

As shown in FIG. 2, the user management information table 61 includes, for each receiver 7, a user ID, an IP multicast group address (multicast address), an IP address, a MAC address, and a multicast group participation level. , The sender's (recipient's) subnet address, the TTL (time to live: the time before the entry is removed from the table), the sending router's (last hop's router) address, and the receiving port (In Port) ), Outgoing ports (〇ut Ports), port hub use status of the switcher hub 43, and user management information such as an invalid flag are stored.

The user management information distribution processor 63 of the authentication server 6 distributes the user management information of the user management information table 61 to the multicast routers 31, 32, and 33. All the multicast routers in the subnet on the receiving side (only one is shown here) 33 Each user management unit 35 is included in the user management information distributed from the authentication server 6 Based on specific information (for example, a multicast address), only information belonging to its own subnet is cut out, registered in the corresponding user management information table 34, and the user management information is transmitted to the subordinate switcher hub 43. The user management unit 45 of the switcher hub 43 cuts out the user management information belonging to its own subnet based on the MAC address included in the user management information received from the multicast router 33, and Register in the user management information table 44 in the hub 43.

The valid receiver 7 declares that it wants the multicast group data to all multicast channels 33 existing in the receiving side subnet in order to receive the multicast data. To this end, the valid recipient 7 sends an IGMPHMR message requesting multicast group membership. The user management unit 35 of the multicast router 33 of the receiving subnet that received the IGMPHMR message checks the source address of the message against the contents of the user management information table 34, and determines that the source address is the user management information. If it exists in the table 34, nothing is done. If it does not exist, the direction is changed and the IGMP Join S message is sent to the switcher hub 43.

The user management unit 45 of the switching hub 43 checks the source address and the contents of the user management information table 44 using the IGMPJoinS message. If this source address does not exist in the user management information table 44, the user management unit 45 regards it as an invalid recipient 7, sets an invalid flag, and updates the user management information table 44. .

When the multicast receiver 34 receives the multicast data by the data receiver 36, the user manager 35 of the multicast server 34 determines that if at least one receiver 7 participating in the multicast group exists in the subnet, the address is addressed to the group. The data is transmitted to the switcher hub 43 to relay the multicast data over the entire range of the subnet.

The user management unit 45 of the switching hub 43 refers to the user management information table 44 and distributes the data to the receivers 7 where the invalid flag is not set, and distributes the data to the receiver 7 where the invalid flag is set. Stop sending data overnight.

Second operation example of CIP multicast communication system)

Next, a second operation example of the IP multicast communication system 1 will be described with reference to FIG. 3 and a related diagram showing a flowchart of processing.

The receiver 7 as a multicast data receiving applicant applies to the authentication server 6 the data to be received and information such as the level of participation in the multicast group by multicast. The user registration management unit 62 of the authentication server 6 refers to the user management information registered in advance in the user management information table 61 and examines the application of the receiver 7. The user registration management unit 62 registers the user management information in the user management information table 61 and updates the user management information table 61 if the reception is permitted after the examination.

The user management information distribution processor 63 of the authentication server 6 distributes the user management information of the user management information table 61 to the multicast servers 31, 32, 33. All the multicast routers in the receiving subnet (here, only one is shown) 33 Each user management unit 35 is a specific information contained in the user management information distributed from the authentication server 6 Only the information belonging to its own subnet is cut out based on (for example, a multicast address), registered in the corresponding user management information table 34, and the user management information is transmitted to the subordinate switcher hub 43. The user management unit 45 of the switching hub 43 extracts the user management information belonging to its own subnet based on the MAC address included in the user management information received from the multicast router 33, and 4 Register in the user management information table 4 4 in 3.

The valid receiver 7 declares that it wants multicast group data to all the multicast routers 33 existing in the receiving side subnet in order to receive the multicast data. To this end, the valid recipient 7 sends out an IGMPHMR message of a multicast group membership request.

The user management unit 35 of the multicast router 33 on the receiving side receiving the IGMPHMR message checks the source address of the message against the contents of the user management information table 34, and the source address is managed by the user. If it exists in the information table 34, it does nothing, and if it does not exist, it changes direction and sends an IGMP Join S message to the switcher hub 43.

The user management unit 45 of the switching hub 43 uses the IGMP Join S message to check the source address and the contents of the user management information table 44. If this source address does not exist in the user management information table 44, the user management unit 45 regards it as an invalid recipient 7, sets an invalid flag, and sets The user management information table 44 is updated.

Upon receiving the multicast data by the data receiving unit 36, the user management unit 35 of the multicast group 34, if at least one receiver 7 participating in the multicast group exists in the subnet, the multicast data addressed to the group. Data is transmitted to the switcher hub 43 to relay the evening to the whole area of the subnet.

The user management unit 45 of the switcher hub 43 refers to the user management information table 44 and distributes the data to the recipients 7 with no flag set, and sends the data to the recipients 7 with the flag set up. Data is decimated by referring to data decimating information 47 that prescribes, for example, that every second data frame is transmitted, through the data receiving unit 46, and then transmits the data.

If about 5% of the data to be multicast is destroyed, the quality will deteriorate. Unauthorized receiver 7 will receive a message of quality degradation in which data has been destroyed due to data thinning. Unauthorized recipient 7 will receive the corrupted data until it issues the IGMP Lea Ve message. An unauthorized recipient 7 can issue an IGMP L eave message to all multicast routers 33 to refuse to receive quality-degraded data, and can leave the multicast group.

Upon receiving the I GMP Lea V e message, the multicast router 33 checks the source address of the message with the contents of the user management information table 34 and joins the user management information table 34 to the multicast group. If is defined, cancel the participation in the multicast group and update the user management information. The multicast server 33 updates the user management information in the user management information table 34 and then changes direction to transmit an IGMP LeavS message to the switcher hub 43.

The switching hub 43 uses the IGMP Leave S message to release the participation in the multicast group if the participation in the multicast group is defined in the user management information table 44 and to display the information in the user management information table 44. The port information of the registered switcher hub 43 is collated and an invalid flag is set. If is set, the user management information is updated with the flag set.

The router with the largest IP address within the multicast router 33 sends a message to the authentication server 6 to join and leave the receiver 7 in the multicast group. The authentication server 6 updates the user management information based on the message. Unauthorized receiver 7 will not receive quality-degraded data after leaving the group. Industrial applicability

ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to prevent or prevent receiving multicast data by the receiver of an unauthorized access, and it can provide the IP multicast communication system with high security.

Claims

The scope of the claims

1. a layer 2 switch accommodating a plurality of recipients that can dynamically join or leave the multicast group;

An IP multicast data transmitted from a sender is received through an IP network, and the received IP multicast data is transmitted to a plurality of valid recipients participating in the multicast group via the subordinate Layer 2 switch. Layer 3 switch corresponding to the sub-network to be distributed;

A control device for collectively managing recipient management information for authenticating the validity of the recipient obtained according to the group management protocol IGMP; said layer 3 switch comprises: Authenticating the validity of the receiver based on the receiver management information corresponding to the own sub-network among the receiver management information to be managed,

The layer 2 switch stops transmission of the IP multicast data to a recipient of an unauthorized access authorized by the layer 3 switch.

IP multicast communication system.

2. a layer 2 switch accommodating a plurality of recipients that can dynamically join or leave the multicast group;

IP multicast data transmitted from a sender is received through an IP network, and the received IP multicast data is transmitted to a plurality of valid recipients participating in the multicast group via the layer 2 switch under the control. Layer 3 switch corresponding to the sub-network to be distributed;

A control device that collectively manages recipient management information for authenticating the validity of the recipients obtained in accordance with the Internet group management protocol IGMP; and the layer 3 switch is collectively managed by the control device. Authenticating the validity of the recipient based on the recipient management information corresponding to the own sub-network among the recipient management information

The layer 2 switch thins out the IP multicast data and transmits the data to a recipient of an unauthorized access authorized by the layer 3 switch. To

IP multicast communication system.

3. The IP multicast communication system according to claim 1, wherein the layer 2 switch is a switching hub.

4. The IP multicast communication system according to claim 1, wherein the layer 3 switch is a multicast router.

5. The IP multicast communication system according to claim 1, wherein the control device has a table storing the recipient management information.

6. The receiver management information collectively managed by the controller includes a multicast group address, an IP address, a MAC address, a multicast group participation level, a subnetwork address, and an unauthorized access receiver for each receiver. Contains the identification flag of

The IP multicast communication system according to claim 1 or 2.

7. When the Layer 3 switch receives, through the Layer 2 switch, a message transmitted from the receiver to join the IP multicast group in accordance with the IGMP, the subnet address corresponding to the receiver is If it does not exist in the self-owned receiver management information, the direction is changed and a notification message in accordance with the IGMP is delivered to the layer 2 switch, and an identification flag of an unauthorized access receiver is set.

The IP multicast communication system according to claim 1 or 2.