WO2009036685A1

WO2009036685A1 - A method and apparatus for implementing multicast authentication

Info

Publication number: WO2009036685A1
Application number: PCT/CN2008/072309
Authority: WO
Inventors: Peilin Yang; Guomin Wu; Yuping Zhao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-17
Filing date: 2008-09-09
Publication date: 2009-03-26
Also published as: CN101394277A

Abstract

The embodiments of the present invention provide a method and apparatus for implementing multicast authentication. The method mainly includes: a switch device receives the authentication result of the multicast authentication, and acquires the user's right information included in the authentication result; The switch device saves the right information, and controls the multicast stream needed to be sent to the user depending on the right information. The apparatus mainly includes a switch device, and the switch device includes: a right information acquirement module, for receiving the authentication result of the multicast authentication sent by other network devices and acquiring the user's right information included in the authentication result; A right information saving module, for saving the corresponding relationship between each user and the user' right information depending on the right information acquired by the user right information acquirement module. Using the invention, multicast authenticating users in access networks and controlling the multicast service received by users can be implemented.

Description

Method and device for realizing multicast authentication

The present invention relates to the field of multicast technologies, and in particular, to a method and apparatus for implementing multicast authentication.

BACKGROUND OF THE INVENTION With the maturity of IP multicast technology, IP multicast applications are becoming more and more widely used, but in the IP model, any host can be added to any multicast group without restriction, so far, There is no way to effectively solve the problem of host access control in IP multicast. In the IP multicast model, a multicast group consists of a sender and a receiver, and a sender-to-receiver is connected by a multicast distribution tree. When the sender needs to send data to the receiver, the sender sends the data through the host to the router connected to it, and the router forwards the data to the receiver through the multicast distribution tree. The router does not impose any restrictions on the host that sends the data. When a host wants to receive data of a multicast group, the host sends a Member Report message to the router connected to it according to the Internet Group Management Protocol (IGMP). The router processes the report. After the text, the corresponding multicast group data is forwarded to the host. Similarly, the router does not impose any restrictions on hosts that want to receive multicast messages. With the commercialization of IP multicast applications, multicast security has become a problem that must be solved as soon as possible. Preventing unauthorized recipients from receiving multicast packets is a key factor in achieving multicast security. There are three main problems in implementing multicast security. The first is the authentication problem. Because the multicast protocol, such as IGMP, does not provide the user authentication function, the user can join or leave at will, which prevents the user from performing access control on the multicast service. The user can perform the denial of service for the network bandwidth. (Deny of Service, DoS) attacks, thereby wasting network bandwidth. The second is the charging problem. Because the multicast protocol, such as IGMP, does not involve accounting, the multicast source cannot know when the user joins or leaves the multicast group. The third is the authorization problem; because the multicast protocol, such as IGMP, does not have the authentication function, the operator cannot authorize each user with different rights according to the needs of each user. A method for implementing multicast security in the prior art is: authenticating a user at the application layer (such as the Web mode), authenticating the user at the application layer, and not setting permissions on the user at the access network layer. In a practical application, when a user joins a multicast group, the user rights of the network device between the router and the host can be set up; or the user can download the corresponding user rights through the network management mode. User management can also be achieved by encrypting multicast data and managing it by key. In the process of implementing the present invention, the inventors have found that the above prior art method has at least the following problems: The method is difficult to implement and high in cost. At the same time, this method cannot solve the problem that the user performs DoS attacks against network bandwidth and wastes network bandwidth.

SUMMARY OF THE INVENTION Embodiments of the present invention provide a method and apparatus for implementing multicast authentication. Therefore, multicast authentication can be performed on the access network, and the multicast service received by the user can be controlled. An embodiment of the present invention is implemented by the following technical solutions: A method for implementing multicast authentication, including: a switching device receiving an authentication result of a multicast authentication, and acquiring rights information of a user included in the authentication result; The switching device saves the permission information, and controls the multicast stream that needs to be sent to the user according to the permission information. A method for implementing multicast authentication, including: after the network device determines that the user terminal needs to perform multicast authentication, the network device sends a message requesting multicast authentication to the user; the user receives the request After the multicast authentication message is sent, the multicast authentication request is sent to the network device. A method for implementing multicast authentication, comprising: an authentication server receiving a multicast authentication request that is sent by a user and carrying user authentication information and multicast group identification information; the authentication server is configured according to the user authentication information and the multicast group identifier The information is authenticated by the user, and the authentication result carrying the authentication success or failure information is returned to the network device corresponding to the user. A switching device, comprising: a rights information obtaining module, configured to receive an authentication result of the multicast authentication sent by another network device, and obtain the user right information from the authentication result; and the rights information saving module is configured to obtain the The user's permission information stores the correspondence between each user and user authority information. A network side device, comprising: a multicast authentication judging module, configured to: after receiving a multicast authentication request sent by a user, determine, according to the multicast address and the user address included in the multicast authentication request, whether the device needs to be The multicast authentication triggering module is configured to: after the multicast authentication determination module determines that the user needs to perform multicast authentication, send a message requesting multicast authentication to the user. It can be seen from the technical solutions provided by the foregoing embodiments of the present invention that the embodiment of the present invention saves the rights information of each user in the switching device, so that the receiving device can perform the receiving control of the multicast service by using the switching device. The embodiment of the present invention can also pass through the network side. After the judgment, the multicast authentication to the user is initiated first. The embodiments of the present invention can also implement other authentication protocols and multicast protocols to cooperate with each other to perform multicast authentication for users.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram of a process flow of Embodiment 1 according to an embodiment of the present invention; FIG. 2 is an IGMP/MLD join message using an extended manner of IGMP/MLD Report messages according to an embodiment of the present invention; An IGMP/MLD jo in message in a new message type manner defined in the IGMP/MLD protocol is provided in the embodiment of the present invention; FIG. 4 is a schematic diagram of a switching device that forwards a multicast stream to a user according to a multicast forwarding table according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a process flow of Embodiment 2 according to an embodiment of the present invention; FIG. 6 is a schematic flowchart of a process of Embodiment 3 according to an embodiment of the present invention; FIG. 8 is a schematic diagram of another processing procedure of Embodiment 4 according to an embodiment of the present invention; FIG. 9 is a schematic structural diagram of a switching device according to an embodiment of the present invention; FIG. Schematic diagram of the device.

DETAILED DESCRIPTION OF THE EMBODIMENTS Embodiments of the present invention provide a method and apparatus for authenticating a multicast service. In the solution provided by the embodiment of the present invention, the switching device receives the authentication result sent by the multicast router, where the authentication result includes the user receiving the corresponding multicast service right information, and the switching device forms a multicast forwarding table according to the received authentication result. After receiving the multicast service that the user needs to receive, the switching device searches the multicast forwarding table to determine whether the user has the right to receive the multicast service, and if yes, forwards the multicast service to the user; otherwise, does not The user forwards the above multicast service. The above process of authenticating a multicast service may be performed by extending an existing Group Management Protocol (GMP) protocol, such as IGMP, a multicast listening (MLD) protocol, or an Extensible Authentication Protocol (EAP). to realise. In practical applications, the above authentication process can also be implemented by designing a special GMP protocol. The authentication process can also be implemented by using other authentication protocols and multicast protocols to cooperate with each other. The above process of authenticating a multicast service may first be triggered by a multicast router. That is, the multicast router generates a trigger mechanism to require the multicast user to perform authentication. In order to better describe the embodiments of the present invention, the IGMP and EAP protocols are first introduced.

The function implemented by IGMP is bidirectional: On the one hand, the user informs the local multicast router through IGMP that it wants to join and receive information of a specific multicast group. On the other hand, the multicast router periodically queries the local area network through IGMP. Whether the members of the group are active (that is, whether there are still members of a multicast group in the network segment), and collecting and maintaining the membership of the group in the network segment. Currently, there are three major versions of IGMP: IGMPvl, IGMPv2, and IGMPv3.

The packet format of IGMPv2 is shown in Table 1 below. Table 1 :

1 8 16 24 32

The Type field in Table 1 above indicates the IGMPv2 packet type, which mainly includes four types:

(1) 0x11, this type of message is mainly used to implement membership query.

There are two subtypes of the IGMPv2 membership query packet: The general query packet is used to learn which multicast group members exist on the adjacent network. A specific group query message is used to know whether a member specified in a neighboring network exists. The general query message and the specific group query message are distinguished by the group address field: The group address field of the general query message is 0, and the group address field of the specific group query message is the address of the multicast group to be queried.

( 2 ) 0x12, this type of packet is mainly used to implement IGMPvl member report. This is a message class that is added to IGMPv2 and is added to IGMPv2.

(3) 0x16, this type of packet is mainly used to implement IGMPv2 member report.

(4) 0x17, this type of message is mainly used to implement the leave group report. The format of the IGMPv3 and IGMPv1 packets is similar to the IGMPv2 packet format.

The EAP protocol packet format is described in detail in RFC3748. The encapsulation format of EAP packets is shown in Table 2 below: Table 2 :

Oct Number

Code 1

Identifier 2 length 3-4

Data 5-N

The Code field in Table 2 above: 1 byte, this field specifies the type of EAP message. The code value of EAP is specified as follows: 1 indicates the type of Request message; 2 indicates the type of Response message; 3 indicates the type of Success; 4 indicates the type of Failure message.

The EAP Request and Response packet formats are shown in Table 3 below. table 3:

Oct Number

Code

Identifier 2 length 3-4 Type 5

Type-Data 6-N

The meanings of the Code field, the Identifier field, and the Length field in Table 3 above are as described in Table 2 above. The Type field in Table 3 above: occupies 1 byte, and the field value specifies the type of Request or Response. It must appear in the EAP Request message or Response message and only one Type appears. Generally, the value of the Type field in the Response packet is the same as the value of the Type field in the Request packet. However, the Response packet can have a Nak type. When the Supplicant sends a Nak-type packet to respond to the Request, it indicates that the Type in the Request cannot be accepted by the Supplicant. It can indicate that it wants to use and support it. Type of certification.

The corresponding types of Type field values defined in RFC2284 are: 1 for Identity type; 2 for Notification type; 3 for Nak (Response only) type; 4 for MD5-Challenge type; 5 for OTP (One-Time Password) (RFC 1938) type ; 6 indicates the Generic Token Card type.

The EAP Success and Failure message formats are shown in Table 4 below. Table 4:

Oct Number

Code 1

Identifier 2 length 3-4

The meanings of the Code field, the Identifier field, and the Length field in Table 4 above are as described in Table 2 above. The Success message is sent to the Supplicant by the Authenticator. After the user information is successfully authenticated, the Authenticator sends an EAP packet with a value of 3 (Success) to indicate that the authentication succeeds. When the user information fails to be authenticated, the Authenticator sends a Code field value. 4 EAP packet (ie Failure) to indicate that the authentication failed.

The EAP Success and Failure messages are fixed-length messages with no data fields and are 4 bytes long. A schematic diagram of the processing flow of Embodiment 1 of the embodiment of the present invention is shown in FIG. 1. Embodiment 1 implements multicast message exchange between a host (user) and a multicast router by extending the IGMP/MLD protocol. The specific processing process includes:

When the user needs to join a multicast group, the device sends an IGMP/MLD join message to the multicast router, where the message carries the group address of the multicast group to be joined and the user who needs to authenticate the user. Authentication information, such as user name, user authentication code, etc., the user authentication information may also include an IP address, a MAC address, a VLAN, and the like of the client. The manner of the foregoing IGMP/MLD join message may be an extension manner of the IGMP/MLD Report message as shown in FIG. 2, or a new message type defined in the IGMP/MLD protocol as shown in FIG. The message type is Type = 0x36. In the extended manner of the IGMP Report message shown in FIG. 2, a bit in Reserved is used, for example, the last bit is used to identify whether it is the first Report message, and "1" is indicated as the first Join message. "0" is expressed as a normal Report message. The above user authentication information can be placed in the new type: Information, and the new type Protocol Type indicates the authentication type, PAP, CHAP. Etc., the new type Length indicates the length of the user information.

After receiving the IGMP/MLD join message, the multicast router obtains the user authentication information and the group address information of the multicast group carried in the message. The multicast router also determines whether the IGMP/MLD join message is the first report message sent by the user to the multicast router according to the configuration method of the IGMP/MLD join message. After the multicast router determines that the received IGMP/MLD join message is the first report message of the user, that is, the IGMP join message, the multicast authentication information and the group address information of the multicast group are sent to the authentication server. . After receiving the user authentication information and the group address information of the multicast group, the authentication server authenticates the user.

After the authentication server successfully authenticates the user, the authentication server returns an authentication result carrying the authentication success information to the multicast router.

After receiving the above authentication result, the multicast router gives the user the corresponding permission, and allows the user to join the multicast group to be joined, and allows the user to receive the corresponding multicast service. The multicast router transmits the authentication result of the user's authority information to the switching device, and the user's rights information includes the multicast service information that the user can receive.

15. After receiving the above authentication result, the switching device adds the permission information of the user to the multicast forwarding table. The multicast forwarding table contains multicast service information that each user has permission to receive. After receiving the multicast stream that the user needs to receive, the switching device searches the multicast forwarding table to determine whether the user has the right to receive the multicast stream, and if yes, forwards the multicast stream to the user; otherwise, The above multicast stream is not forwarded to the user.

16. The switching device notifies the user that the authentication is successful.

13'. After the authentication server fails to authenticate the user, the authentication result of the authentication failure information is returned to the multicast router.

After receiving the above authentication result carrying the authentication failure information, the multicast router sends the authentication result to the switching device.

15: After receiving the above authentication result carrying the authentication failure information, the switching device does not add the user to the multicast forwarding table. Notify the user that the authentication failed. After receiving the multicast stream that the user needs to receive, the switching device searches the multicast forwarding table and finds that the user does not have permission to receive the multicast stream, and does not forward the multicast stream to the user. In a practical application, a multicast forwarding table may be set up in the foregoing switching device. The multicast forwarding table may include: a multicast group MAC address, a user MAC address, and a port/VC where the user is located, and may also include a VLAN. User IP address and other information. When the exchange After receiving the multicast stream, the device searches for the corresponding multicast forwarding table and replaces the destination multicast MAC address of the multicast stream with the unicast MAC address for each user. A schematic diagram of the switching device forwarding the multicast stream to the user according to the multicast forwarding table is shown in FIG. 4 . According to the processing procedure of the foregoing Embodiment 1, after the user implements the multicast authentication, a user multicast forwarding table is formed, so that the network can control the forwarding of the multicast stream to the authorized multicast user, but for the user without the authority. , illegal users cannot receive multicast streams. The above switching devices include but are not limited to: network switches such as Layer 2 switches, Layer 3 switches, or digital subscriber line access multiplexers. Embodiment 2 of the embodiment of the present invention provides a scheme for extending the EAP protocol to support multicast authentication. Embodiment 2 implements the EAP protocol to authenticate a certain multicast group of a certain user by extending the EAP protocol. A schematic diagram of the processing flow of Embodiment 2 is shown in FIG. 5, and the specific processing procedure includes the following steps:

51. The user sends a multicast authentication request packet to the multicast router.

After receiving the multicast authentication request packet, the multicast router sends the extended EAP request packet to the user, and the extended EAP request packet carries the multicast information. According to the above description, when the EAP code type is request or response, the Type 1 indicates the user ID. In this embodiment, the type is extended. The user identifier is not limited to the user name, and the user identifier also carries the group information (group address) that the user wants to join.

After receiving the extended EAP request packet, the user sends the extended EAP response packet to the multicast router. The user identifier in the extended EAP response packet carries user authentication information, such as a user name, a user authentication code, and the like, and the group information that the user wants to join.

54. The following describes the authentication process by taking the EAP method of MD5 as an example. After receiving the EAP response packet, the multicast router sends a normal EAP challenge word request packet to the user. The challenge word is carried in the user identifier in the EAP challenge word request message. The so-called challenge word is a random number. In the MD5 encryption algorithm, the multicast router and the user have a shared key, which is a key that both the multicast router and the user know. After receiving the challenge word sent by the multicast router, the user encrypts the challenge word with the shared key, and then sends the ciphertext to the multicast router. The multicast router decrypts the ciphertext with the shared key to obtain the ciphertext. The challenge word compares the challenge word with the challenge word previously sent to the user, and determines the correctness of the shared key based on the comparison result.

After receiving the EAP challenge word request message, the user encrypts the challenge word with the shared key, and then responds to the EAP challenge word response message carrying the ciphertext to the multicast router. The multicast router decrypts the ciphertext by using the shared key, obtains the challenge word carried in the ciphertext, compares the challenge word with the challenge word previously sent to the user, and after the comparison result is consistent, the user authentication is performed. The information is transmitted to the authentication server along with the group information that the user wants to join.

After receiving the foregoing information, the authentication server determines whether the user has the right to join the multicast group, and if yes, sends an authentication success message that allows the user to join the multicast group to the multicast router; otherwise, the sending rejection The user joins the authentication failure message of the multicast group to the multicast router.

After receiving the authentication success packet, the multicast router adds the user to the corresponding multicast group, and re-establishes the multicast tree and the multicast outgoing interface of the multicast group. At the same time, the related information of the user is saved to the local database, and the related information includes: a group address of the multicast group, a user's IP address and a MAC address, and a specific port number information of the user. After receiving the above authentication failure packet, the multicast router rejects the user from joining the multicast group. The multicast router also forwards the above authentication success packet or authentication failure packet to the above user. Embodiment 3 of the embodiment of the present invention provides a trigger mechanism to require a multicast user to perform authentication. The process flow of Embodiment 3 is shown in FIG. 6. The specific processing process includes the following steps:

61. After the user obtains the universal access right of the network, after obtaining the IP address through the protocol such as DynamicHostConfigurationProtocol (DHCP), normal network access can be performed. When the user needs to join a multicast group, the user sends an IGMP join message to the multicast router. The IGMP join message contains the group address of the multicast group to be joined and the related information of the user. : IP address and MAC address, etc.

62. The multicast router extracts the related information of the user and the group address information of the multicast group from the received IGMP join message. In addition, the multicast router can obtain the port number information of the user through the port that receives the IGMP join message. The multicast router also determines whether the IGMP join message is the first report message sent by the user to the multicast router according to the configuration method of the IGMP join message. After the multicast router determines that the received report packet is the first report packet of the user, that is, the IGMP join packet, the multicast router sends the related information of the obtained user and the group address information of the multicast group to the authentication. server.

63. The authentication server authenticates the received information about the client, and determines whether the multicast group that the user needs to join is a specific group, or whether the user is a privileged user. The principle that the authentication server performs the above judgment may be set according to specific requirements. For example, to determine whether the source address of the user is a privileged address, the so-called privileged address can be understood as an address with special rights, and a special address of all group contents can be viewed. If yes, it is determined that the above user is a privileged user. Determine whether the group address that the user applies for is A specific group, a specific group can be understood as some open group, such as a television advertisement channel, etc. If yes, it is determined that the multicast group that the user needs to join is a specific group. If the authentication server determines that the multicast group to be joined by the user is a specific group, or the user is a privileged user, then the multicast router sends an authentication success message to the multicast router to allow the user to join the multicast group; otherwise, the group is sent to the group. The broadcast router returns an authentication failure packet that triggers multicast authentication.

After receiving the authentication success packet, the multicast router gives the user the corresponding permission, and allows the user to join the multicast group to be joined, allowing the user to receive data of the multicast group and view the multicast group. Content. After receiving the above authentication failure packet, the multicast router sends a multicast authentication trigger packet to the user. The multicast authentication trigger packet can be implemented in multiple forms. For example, the multicast authentication trigger packet may be an IGMP query packet carrying an authentication request. The message is sent in unicast form. The following takes IGMPv3 as an example to describe how to extend IGMP query packets to carry authentication requests, that is, implement multicast authentication trigger packets. The normal IGMPv3 query message is shown in Table 5 below. table 5:

8 16 24 32

Type = 0x11 Max Resp Code Checksum

Group Record [M]

Source Address [1]

Source Address [2]

Source Address [N] can use one bit in the Resv field in Table 5 above, for example, the last bit to identify whether the query message carries the authentication request, and set "1" to carry the authentication request, set "0" Indicated as not carrying an authentication request. The IGMPv3 query message after the last bit position of the Resv field is "1" is as shown in Table 6 below. Table 6:

After receiving the multicast authentication trigger packet, the user sends an IGMP join message carrying the user authentication information to the multicast router. After that, the multicast router, the authentication server, and the user exchange information to implement multicast authentication for the user. Embodiment 4 of the embodiment of the present invention provides a process of authenticating a user by using other out-of-band authentication protocols (such as DHCP, PPP0E, etc.) and a multicast protocol. The process flow of the embodiment 4 is as shown in FIG. 7. The specific process is as follows: The user sends a multicast authentication request carrying the user authentication information and the group address of the multicast group that the user needs to join to the authentication server through other out-of-band authentication protocols. . After the authentication server authenticates the user, the authentication result is returned to the multicast router through a multicast protocol (such as IGMP). The multicast router then returns the authentication result to the user through a multicast protocol (such as IGMP). A schematic diagram of another processing flow of Embodiment 4 is shown in FIG. 8. The difference between the processing flow and the processing flow shown in FIG. 7 is that the multicast router returns the authentication result to the switching device through a multicast protocol (such as IGMP). The switching device forms a multicast forwarding table according to the received authentication result, and controls the user according to the multicast forwarding table. The multicast router in each of the above embodiments may also be a NAS device.

The structure of the switching device provided by the embodiment of the present invention is as shown in FIG. 9 , and includes the following modules: The privilege information obtaining module 91 is configured to receive an authentication result that is sent by another network device to authenticate the request of the user to join the multicast group, and obtain the authentication result. The user included in the authentication result obtains the rights information of the corresponding multicast service; the rights information saving module 92 is configured to save the correspondence between the users and the rights information according to the rights information acquired by the user rights information obtaining module. relationship; The multicast service control module 93 is configured to: after receiving the multicast service that needs to be sent to the user, search for a corresponding relationship saved by the rights information storage module, and determine whether the user has the right to receive the multicast service, If yes, the multicast service is forwarded to the user; otherwise, the multicast service is not forwarded to the user. The foregoing multicast service control module is optional and can be embedded in the switching device or a module that is set independently of the switching device. The rights information storage module 92 may further store a multicast forwarding table, where the multicast forwarding table includes: a correspondence between a multicast address and a user address. The multicast service control module 93 may further include: a unicast stream forwarding submodule, configured to: after receiving the multicast stream that needs to be forwarded, query the multicast forwarding table, and obtain an address corresponding to the address of the multicast stream. The user address is copied to the corresponding unicast stream of each user and sent to the user. As shown in FIG. 10, the schematic diagram of the network side device for performing multicast authentication according to the embodiment of the present invention includes the following modules: The multicast authentication determining module 101 is configured to: after receiving the request for joining the multicast group sent by the user, And determining, according to the multicast address and the user address included in the request for joining the multicast group, whether the multicast authentication is required for the user, and the multicast authentication triggering module 102 is configured to: when the multicast authentication determination module determines that the After the user performs multicast authentication, the user sends a multicast authentication trigger message to the user. The network side device may be a NAS or a multicast router. In summary, the embodiment of the present invention implements multicast user authentication, which solves the problem that users in the previous multicast protocol can join a multicast group at will, and can leave an important problem arbitrarily, thereby avoiding the enjoyment of users without rights. Multicast service, implementing multicast-based access control. At the same time, the solution applies the result of the multicast authentication to the switching device, thereby further avoiding the problem that the multicast stream is not flooded in the switching device. The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request

A method for implementing multicast authentication, comprising: receiving, by a switching device, an authentication result of the multicast authentication, and obtaining the authority information of the user from the authentication result; the switching device performing the rights information And saving, controlling, according to the permission information, a multicast stream that needs to be sent to the user.

The method according to claim 1, wherein the process of receiving the authentication result of the multicast authentication by the switching device comprises: receiving, by the network device, a multicast authentication request that carries user authentication information and multicast group identification information Sending the user authentication information and the multicast group identification information to the authentication server; the authentication server authenticates the user according to the user authentication information and the multicast group identification information, and returns the carried to the network device. The authentication result of the successful or failed authentication; after receiving the authentication result that the authentication succeeds, the network device grants the user the right to receive the corresponding multicast service, and sends the rights information and the authentication result to the switching device; After receiving the authentication result that fails the authentication, the network device refuses to send the multicast stream to the user.

The method according to claim 2, wherein, before the network device receives the multicast authentication request that carries the user authentication information and the multicast group identification information, the method further includes: the network device receiving the user related information, where The network device sends the user-related information to the authentication server, where the user-related information includes: a multicast address and a user address; the authentication server determines, according to the user-related information, whether the user needs to be multicast. Authentication, if necessary, returning information to the network device that needs to perform multicast authentication; otherwise, returning information to the network device that does not need to perform multicast authentication; and the network device receiving the need for multicast authentication After the information is sent, a message requesting multicast authentication is sent to the user, and the request for multicast authentication is sent by the user that carries user authentication information and multicast group identification information.

The method according to claim 3, wherein the authentication server determines, according to the user-related information, whether a process of performing multicast authentication on the user is required, specifically: when the authentication server is configured according to When the received multicast address information determines that the multicast group is a specific multicast group that allows all users to join, or when the authentication server determines, according to the received user address information, the user is able to join all multicasts. Group of specific customers The authentication server does not need to perform multicast authentication on the user; otherwise, the user needs to perform multicast authentication.

The method according to claim 1, wherein the process of receiving the authentication result of the multicast authentication by the switching device comprises: the authentication server receiving the user authentication information and the multicast group identification information sent by the user Requesting a multicast authentication request; the authentication server authenticates the user according to the user authentication information and the multicast group identification information, and returns an authentication result that the authentication succeeds or fails to the network device; the network device receives After the authentication result of the authentication succeeds, the user is allowed to join the multicast group, and the user is given the right to receive the corresponding multicast service, and the rights information and the authentication result are sent to the switching device; After receiving the authentication result that fails the authentication, the network device rejects the user from joining the multicast group.

The method according to claim 2, wherein the multicast authentication request is a report packet of the first Internet Group Management Protocol (IGMP) sent by the user to the network device, and the IGMP is passed. The specific byte of the report packet identifies the first report packet.

The method according to claim 2, wherein the multicast authentication request uses the extensible authentication protocol EAP authentication mode to perform multicast authentication on the user.

The method according to any one of claims 1 to 7, wherein the switching device saves the rights information, and controls the multicast service that needs to be sent to the user according to the rights information. Specifically, the method includes: the switching device stores a correspondence between the user and the user right information; and after the switching device receives the multicast service that needs to be sent to the user, searches for the saved correspondence, and determines whether the user is Having the right to receive the multicast service, if yes, forwarding the multicast service to the user; otherwise, forwarding the multicast service to the user.

The method according to claim 8, wherein the process of forwarding the multicast service to the user by the switching device comprises: converting, by the switching device, the multicast stream into a unicast stream And sending the unicast stream to the user.

The method according to any one of claims 1 to 7, wherein the switching device comprises a Layer 2 switch, a Layer 3 switch or a Digital Subscriber Line Access Multiplexer DSLAM.

A method for implementing multicast authentication, comprising: After the network device determines that the user terminal needs to perform multicast authentication, the network device sends a message requesting multicast authentication to the user; after receiving the message requesting multicast authentication, the user sends the message to the The network device sends a multicast authentication request.

The method according to claim 11, wherein, after the network device determines that the user terminal needs to perform multicast authentication, the network device sends a message requesting multicast authentication to the user, Specifically, the network device receives the user-related information sent by the user, where the user-related information includes: a multicast address and a user address; the network device sends the user-related information to the authentication server; Determining whether the user needs to perform multicast authentication on the network device, and if yes, returning information to the network device that needs to perform multicast authentication; otherwise, returning information to the network device that does not need to perform multicast authentication. The user-related information includes: a multicast address and a user address. After receiving the information that needs to be authenticated by the network, the network device sends a message requesting multicast authentication to the user.

The method according to claim 12, wherein the determining, by the authentication server, the process of performing multicast authentication on the user according to the information about the user, specifically includes: when the authentication server is configured according to When the received multicast address information determines that the multicast group is a specific multicast group that allows all users to join, or when the authentication server determines, according to the received user address information, the user is able to join all multicasts. When the specific client of the group is used, the authentication server does not need to perform multicast authentication on the user; otherwise, the user needs to perform multicast authentication.

The method according to claim 11 or 12 or 13, wherein the message requiring multicast authentication is an IGMP Query message or an EAP START message carrying an authentication request.

A method for implementing multicast authentication, comprising: an authentication server receiving a multicast authentication request that is sent by a user and carrying user authentication information and multicast group identification information; and the authentication server is configured according to the user authentication The information and the multicast group identification information are used to authenticate the user, and the authentication result of the successful or failed authentication is returned to the network device corresponding to the user.

The method for implementing multicast authentication according to claim 15, wherein the method further comprises: after receiving the authentication result that the authentication succeeds, the network device is given the user to receive the corresponding multicast service. Permission, the rights information and the authentication result are sent to the switching device by using a second protocol, or the network device sends the rights information to the user; After receiving the authentication result that fails the authentication, the network device refuses to send the multicast stream to the user equipment.

A switching device, comprising: a rights information acquiring module, configured to receive an authentication result of the multicast authentication sent by another network device, and obtain the user right information from the authentication result; the rights information saving module And configured to save a correspondence between each user and user authority information according to the obtained user's permission information.

The switching device according to claim 17, wherein the switching device further includes: a multicast service control module, configured to: after receiving the multicast service that needs to be sent to the user, searching for the permission Corresponding relationship saved by the information saving module, determining whether the user has the right to receive the multicast service, and if yes, forwarding the multicast service to the user; otherwise, forwarding the multicast service to the user .

The switching device according to claim 18, wherein: the rights information saving module is further configured to save a multicast forwarding table, where the multicast forwarding table includes: a correspondence between a multicast address and a user address.

The switching device according to claim 19, wherein the multicast service control module comprises: a unicast stream forwarding submodule, configured to query the multicast after receiving the multicast stream to be forwarded The forwarding table is configured to obtain a user address corresponding to the address of the multicast stream, and the multicast stream is copied into a unicast stream corresponding to each user, and sent to the user.

A network-side device, comprising: a multicast authentication judgment module, configured to: after receiving a multicast authentication request sent by a user, according to a multicast address and a user address included in the multicast authentication request The multicast authentication triggering module is configured to send a multicast authentication request to the user after the multicast authentication determination module determines that the user needs to perform multicast authentication. Message.