WO2009127128A1 - 一种防止以太无源光网络中下行数据洪泛的方法 - Google Patents

一种防止以太无源光网络中下行数据洪泛的方法 Download PDF

Info

Publication number
WO2009127128A1
WO2009127128A1 PCT/CN2009/070282 CN2009070282W WO2009127128A1 WO 2009127128 A1 WO2009127128 A1 WO 2009127128A1 CN 2009070282 W CN2009070282 W CN 2009070282W WO 2009127128 A1 WO2009127128 A1 WO 2009127128A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
tag
data packet
access device
port
Prior art date
Application number
PCT/CN2009/070282
Other languages
English (en)
French (fr)
Inventor
秦遵明
陈爱民
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2009127128A1 publication Critical patent/WO2009127128A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/2878—Access multiplexer, e.g. DSLAM
    • H04L12/2879—Access multiplexer, e.g. DSLAM characterised by the network type on the uplink side, i.e. towards the service provider network
    • H04L12/2885—Arrangements interfacing with optical systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/32—Flooding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04Q—SELECTING
    • H04Q11/00—Selecting arrangements for multiplex systems
    • H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
    • H04Q11/0062—Network aspects
    • H04Q11/0067—Provisions for optical access or distribution networks, e.g. Gigabit Ethernet Passive Optical Network (GE-PON), ATM-based Passive Optical Network (A-PON), PON-Ring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04Q—SELECTING
    • H04Q11/00—Selecting arrangements for multiplex systems
    • H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
    • H04Q11/0062—Network aspects
    • H04Q2011/0079—Operation or maintenance aspects

Definitions

  • the present invention relates to the field of EPON (Ethernet Passive Optical Network) access, and particularly relates to a method for preventing flooding of downlink data.
  • EPON Ethernet Passive Optical Network
  • Ethernet technology has been widely used due to its advantages of good economy, interoperability and ease of use. With the maturity of technologies and standards such as ⁇ , 10 Gbit/s Ethernet, Ethernet is gradually developing to metropolitan area networks and wide area networks.
  • 802.1 Q VLAN Virtual Local Area Network
  • IEEE802.1Q Virtual Local Area Network
  • the vlan tag virtual LAN tag
  • IEEE802.1Q has only 12 bits and can only represent 4K vlans. This is a big deal for the large number of end users in the metro Ethernet network that need to be identified, so the QinQ service should be shipped.
  • Born (Qinq does not currently have a common Chinese technical terminology).
  • the QinQ service encapsulates the private network vlan tag of the user terminal (that is, the vlan tag of the terminal itself) in the public network vlan tag, so that the data packet traverses the carrier's backbone network (that is, the public network) with two layers of vlan tags.
  • the public network data packets are only transmitted according to the outer vlan tag (that is, the public network vlan tag), and the terminal's own vlan tag is blocked.
  • MPLS Multi Protocol Label Switch
  • Layer 2 VPN Virtual Private Networks
  • the QinQ service has the following features: Provides a simpler Layer 2 VPN tunnel for the terminal; Support for signaling protocols is required and can be implemented in a purely static configuration.
  • the QinQ service was originally developed to expand the number of vlans. It is based on the original 802.1Q data packet and adds a layer of 802.1Q tags. The number of vlans is increased to 4K*4K.
  • the development of the domain Ethernet and the requirements for the operator's refined operation, the dual-layer label of the QinQ service has further use scenarios.
  • the metropolitan area network switch has such a requirement.
  • the downlink EPON access device is based on the terminal's own vlan tag.
  • the range segment is directly transparently transmitted, or the vlan tag of the outer map is added according to the range segment of the terminal's own vlan tag. We call the outer vlan tag the svlan tag (outer virtual LAN tag).
  • the architecture of an EPON access device is generally composed of a main control board (including a main control switch chip) and a plurality of line cards. If the EPON line card has a relatively high processing capability (the cost is relatively high), it will be directly This function, that is, the line card transparently transmits according to the range of the vlan tag of the terminal itself, or increases the svlan tag of the outer layer mapping, and the main control switch chip normally completes the second layer vlan tag forwarding.
  • the basic principle of the svlan tag for transparently transmitting data packets or increasing the outer layer mapping of the EPON access device according to the range of the vlan tag of the terminal is to use the traffic classification function of the main control switch chip.
  • the data packet of a certain flow classification rule directly modifies the svlan tag.
  • the main control switch chip converts the insvlan tag set by the line card (the outer virtual local area network label set by the EPON access device, hereinafter referred to as the internal label).
  • the master switch chip strips the insvlan tag set by the line card and retains the vlan tag of the terminal itself.
  • the rule of the traffic classification is to convert (insvlan tag, the terminal's own vlan tag) to (svlan tag, the terminal's own vlan tag) according to the scope segment of the terminal's own vlan tag.
  • the master control exchange The chip directly removes the insvlan tag set by the line card, and realizes the transparent transmission of the terminal's own vlan tag.
  • the downlink transmission direction of the data packet, the downlink data packet with the svlan tag sent by the uplink switch, the EPON access device directly removes the svlan tag (the vlan attribute of the svlan on the downlink port is a non-tag untag), leaving the terminal itself
  • the vlan tag, the transparent downlink data packet is only the vlan tag of the terminal itself. Because it does not know which terminal to send to, the EPON access device floods the downlink data packet, so that it is connected to the EPON access device. All of the ONU (Optical Network Units) ports can receive such flooded downlink data packets, and the downlink services are impacted. At the same time, there is a security risk that information is eavesdropped. Summary of the invention
  • the technical problem to be solved by the present invention is to provide a method for preventing flooding of downlink data in an Ethernet passive optical network, so that the EPON access device does not broadcast flooding to all ONU ports when transmitting downlink data packets. Eliminate the security risks of information being eavesdropped.
  • the present invention provides a method for preventing flooding of downlink data in an Ethernet passive optical network, including:
  • the access device of the Ethernet passive optical network stores a virtual local area network label vlan tag of the terminal connected to the ONU port of the optical network unit;
  • the access device When the terminal sends the uplink data packet for the first time, the access device records at least the media access control MAC address of the terminal, the correspondence between the switching network port corresponding to the ONU of the optical network unit where the terminal is located, and the vlan tag;
  • the downlink data packet is sent to the destination according to the MAC address of the destination terminal of the downlink data packet and the vlan tag to find the switching network port corresponding to the ONU where the destination terminal is located. terminal.
  • the access device also records the outer virtual local area network label svlan tag of the terminal; when the access device sends the downlink data packet, if The destination terminal of the downlink data packet is a QinQ service terminal, and the access device sends the downlink data packet according to the MAC address of the destination terminal and the svlan tag to search for a switching network port corresponding to the ONU where the destination terminal is located. Give the destination terminal.
  • each ONU port corresponds to an internal outer VLAN tag insvlan tag
  • the access device stores a mapping between the insvlan tag and the vlan tag.
  • the access device further stores The insvlan tag, the mapping between the vlan tag and the svlan tag; the access device searches for the svlan tag according to the insvlan tag and the vlan tag when sending the downlink data packet, and if found, the destination terminal of the downlink data packet is the QinQ service terminal.
  • the master switching chip in the access device is configured to save various correspondences and to find a switching network port corresponding to the ONU where the destination terminal is located.
  • the present invention provides a method for preventing flooding of downlink data in an Ethernet passive optical network, including:
  • the EPON access device of the Ethernet passive optical network parses the uplink data packet, obtains the media access control MAC address of the terminal, and determines whether the MAC address is a new address.
  • the EPON access device cooperates with the internally configured outer virtual local area network label insvlan tag corresponding to the ONU port of the terminal and the MAC address of the terminal.
  • the outer virtual local area network label svlan tag of the uplink data packet or the vlan tag of the terminal itself is combined with the MAC address of the terminal as the identification item B, and the identification item A, the identification item B and the terminal are respectively established.
  • the EPON access device When transmitting the downlink data packet, the EPON access device obtains the information of the identifier B from the downlink data packet, determines the ONU port according to the correspondence between the identifier B and the ONU port where the terminal is located, and then determines the downlink. The data packet is sent to the destination terminal through the ONU port.
  • the corresponding identifier item B is: a combination of the vlan tag of the terminal itself and the MAC address of the terminal; when the terminal is a terminal that needs to add an outer label, the corresponding identifier Item B is: The combination of the svlan tag and the MAC address of the terminal.
  • the sending process of the uplink data packet includes the following steps:
  • the terminal sends an uplink data packet to the EPON access device, and the uplink data packet is sent to the main control switch chip of the EPON access device after adding the insvlan tag;
  • the master switching chip parses the uplink data packet with the insvlan tag, obtains the MAC address of the terminal, and further determines whether it is a new MAC address, and if so, establishes the identifier item A, the identifier item B, and the terminal respectively.
  • the mapping relationship between the identifier item A and the identifier item B is also established, and the next step is directly performed;
  • the master switching chip searches for the QinQ service mapping relationship table in the global mode. If the corresponding svlan tag is found, the insvlan tag is replaced by the svlan tag, and the uplink data packet is sent to the uplink port. If not, Send the uplink data packet with the insvlan tag directly to the uplink port.
  • the uplink port of the EPON access device sends the uplink data packet with the double label of the svlan tag and the vlan tag to the double-layer label according to the configured label attribute, and the double-layer label with the insvlan tag and the vlan tag
  • the uplink data packet is removed from the insvlan tag and then transmitted through a single layer label.
  • the content of the QinQ service mapping relationship table is a correspondence between an insvlan tag established according to a range segment in which the vlan tag of the terminal itself is located and a vlan tag of the terminal itself and a svlan tag. relationship.
  • the sending process of the downlink data packet includes the following steps:
  • the uplink switch of the EPON access device sends the downlink data packet to the EPON access device, and the EPON access device obtains the information of the identifier B from the downlink data packet, and according to the identifier item
  • the mapping between the B and the ONU port where the terminal is located determines the ONU port, and then sends the downlink data packet to the destination terminal through the ONU port.
  • the master switching chip of the EPON access device deletes the correspondence between the saved identifier A and the ONU port where the terminal is located, and then associates according to the identifier A and the identifier B.
  • the relationship between the identifier B and the ONU port where the terminal resides is deleted.
  • the EPON access device obtains the MAC address of the terminal and the switching network port corresponding to the ONU where the terminal is located when the terminal first sends the uplink data packet, and records the label of the terminal according to the range segment of the terminal. Establishing a correspondence between the MAC address and the switching network port and the terminal label; when the EPON access device sends the downlink data packet, the EPON access device searches for the switching network port corresponding to the ONU where the terminal is located according to the label of the terminal and the MAC address of the terminal. Send the downlink data packet to the terminal. Therefore, broadcast flooding of downlink data packets on all ONU ports of the EPON access device is avoided, and the security risk of information being intercepted is eliminated. BRIEF abstract
  • FIG. 1 is a schematic diagram of networking of an EPON access device
  • the EPON access device of the Ethernet passive optical network acquires the MAC (Media Access Control) address of the terminal, and the terminal
  • the switching network port (or the Ethernet port where the ONU is located) corresponding to the ONU records the label (svlan tag or vlan tag) of the terminal according to the range of the terminal, and at least establishes the MAC address, the switching network port, and the terminal label.
  • the EPON access device sends a downlink data packet to the terminal according to the label of the terminal and the MAC address of the terminal, and searches for the switching network port corresponding to the ONU where the terminal is located.
  • the method may be implemented as follows: When the terminal sends the uplink data file, the EPON access device of the Ethernet passive optical network parses the uplink data packet, obtains the MAC address of the terminal, and determines whether the MAC address is new. Address: If the MAC address is a new address, the EPON access device combines the internally set outer VLAN tag insvlan tag corresponding to the ONU port of the terminal with the MAC address of the terminal as the identifier A, and the uplink is The outer virtual local area network label svlan tag of the data packet or the vlan tag of the terminal itself is combined with the MAC address of the terminal as the identification item B (one of the svlan tag and the vlan tag is combined with the MAC address as the identification item B), and is transparently transmitted.
  • the terminal does not add the terminal of the outer vlan, and the vlan tag of the terminal itself is combined with the MAC address as the identification item B.
  • the QinQ outer tag that is, the Svlan tag and the MAC address are combined as the identification item B.
  • the association relationship between the identification item A, the identification item B, and the switching network port corresponding to the ONU of the terminal is established, and the association relationship between the identification item A and the identification item B is also established, that is, the identification item A, the identification item B, and the terminal are respectively established.
  • the EPON access device when the EPON access device sends the downlink data packet, the EPON access device obtains the information of the identifier B from the downlink data packet, and determines the ONU corresponding switching network where the terminal is located according to the identifier B.
  • the port sends the downlink data packet to the destination terminal through the switching network port corresponding to the ONU. This avoids the problem that the EPON access device broadcasts downlink data packets to all ONU ports.
  • identification item A and identification item B are used as retrieval items, and the descriptions of the identification item A and the identification item B are for convenience of description.
  • the terminal described herein may refer to a home terminal device such as a home gateway or a switch.
  • the uplink and downlink sending process of the data packet in the present invention includes the following steps: Step 1: The EPON access device performs QinQ service configuration, including: configuring an insvlan tag for the ONU port where the QinQ service terminal is located, and configuring QinQ service mapping table in global mode, And configuring the label attribute of the uplink port of the EPON access device;
  • Each 0NU port can correspond to a unique insvlan tag, or multiple 0NU ports can correspond to the same insvlan tag.
  • the content of the QinQ service mapping relationship table is based on the range segment of the vlan tag of the terminal itself (insvlan tag, the vlan tag of the terminal itself) and the svlan tag, that is, according to the vlan tag of the terminal itself and the identifier of the ONU.
  • the insvlan tag combination is used to establish a correspondence with the svlan tag.
  • the corresponding relationship only needs to be added to the terminal of the outer label.
  • the transparently transmitted terminal does not have the corresponding relationship.
  • the access device is based on the insvlan tag and the terminal itself.
  • the vlan tag will find the svlan tag.
  • the tag attributes of the uplink port of the EPON access device include a tag tag and a non-tag untag.
  • the attribute of the svlan tag and the vlan tag of the terminal itself is set as a tag tag
  • the attribute of the insvlan tag is set to a non-tag imtag.
  • the insvlan tag is set to the untag tag in order to implement the transparent service.
  • the terminal of the ONU port sends an uplink data packet to the EPON access device, and the line card of the EPON access device adds an insvlan tag to the uplink data packet (for a transparent transmission or a terminal that needs to add an outer label) After the same processing, it is sent to the main control switch chip of the EPON access device; here, the line card of the EPON access device adds the insvlan tag to the uplink data packet, and can also be used in other embodiments.
  • the method of adding an insvlan tag to the uplink data by the ONU port. After the insvlan tag is added, the uplink data ⁇ ⁇ has the insvlan tag and the vlan tag double-layer tag.
  • the master switching chip parses the uplink data packet, obtains the MAC address of the terminal, and determines whether it is a new MAC address. If yes, the EPON access device will The inner virtual local area network label insvlan tag corresponding to the ONU port of the terminal is combined with the MAC address of the terminal as the identifier item A, and the outer virtual local area network label svlan tag of the uplink data packet or the vlan tag of the terminal itself.
  • the association with the MAC address of the terminal is used as the identification item B, and the correspondence between the identification item A and the identification item B and the ONU port where the terminal is located is established, and the association relationship between the identification item A and the identification item B is also established.
  • the packet sent by the terminal carries the MAC address. If the MAC address is not found in the master switching chip, the MAC address is considered as the new MAC address. After the master switching chip learns the MAC address, the terminal re- The source MAC carried in the sent packet is no longer the new MAC address.
  • the master switch chip When the relationship is established, the master switch chip first searches for the QinQ service mapping relationship table in the global mode, that is, the svlan tag corresponding to the insvlan tag (vlan tag of the terminal itself), and the corresponding svlan tag according to the insvlan tag and the vlan tag.
  • the terminal is a transparently transmitted terminal, and the corresponding relationship between the insvlan tag, the MAC address, the vlan tag, and the switching network port corresponding to the ONU where the terminal is located is established respectively; if the corresponding svlan tag is found, If the terminal is a terminal that needs to add an outer label, the corresponding relationship between the insvlan tag, the MAC address, and the svlan tag and the switching network port corresponding to the ONU where the terminal is located is established.
  • the master switching chip searches for the QinQ service mapping relationship table in the global mode. If the corresponding svlan tag is found, the original insvlan tag is replaced by the svlan tag, and the uplink data is sent to the uplink port. If the corresponding svlan tag is not found, the original uplink data packet (that is, the uplink data packet with the insvlan tag and the vlan tag double-layer label) is sent to the uplink port.
  • the search and forwarding function in this step is performed by the master.
  • the fast stream classification module of the control switch chip is implemented.
  • the uplink port of the EPON access device removes the insvlan tag from the uplink data packet with the double label of the svlan tag insvlan tag and the vlan tag according to the configured label attribute, and performs the transparent transmission of the single layer label.
  • the uplink switch of the EPON access device sends the downlink data packet with the double-layer virtual local area network label svlan tag and vlan tag or only the single-layer virtual local area network tag vlan tag to the EPON access device, and the EPON access is performed.
  • the information of the identifier B that is, the vlan tag and the MAC, or the svlan tag and the MAC address, and determining, according to the identifier B, the switching network port corresponding to the ONU where the terminal is located, and then The downlink data is sent to the destination terminal through the switching network port corresponding to the ONU;
  • the terminal of the ONU port only receives data packets that need to be sent to itself, and avoids flooding of downlink data packets.
  • the master switching chip of the EPON access device aging the relationship between the saved identifier A, the identifier B, and the switching network port corresponding to the ONU where the terminal is located, and the identifier A and the identifier.
  • the association relationship of B is about to delete the relationship.
  • the aging of the MAC address means that the terminal does not forward the data packet temporarily. Therefore, the master switching chip does not need to save the association relationship. If the terminal transmits the data packet after a period of time, the EPON is connected. The ingress device establishes the relationship again and saves as described above.
  • the EPON access device When aging, the EPON access device first aging the corresponding relationship between the identification item A and the switching network port corresponding to the ONU of the terminal, and then the association between the identification item A and the identification item B automatically aging the identification item B and the ONU corresponding to the terminal. Correspondence between switch network ports.
  • the EPON access device is connected to the MAN through the uplink switch, and is connected to multiple ONU ports through the Optical Distribution Network (ODN).
  • the EPON access device is connected to the EPON line card and uplink board.
  • the main control board, the power board and the fan board are composed of the EPON line card, and the main control switch chip is on the main control board.
  • the vlan tag between 200 and 1000 indicates that the service of the end user is IPTV (Internet Protocol Television), which needs to be carried.
  • IPTV Internet Protocol Television
  • the uplink data packet of the vlan tag is directly transmitted to the upper layer switch.
  • the terminal is the network management vlan of the device under the ONU1, and the uplink data packet with the vlan tag is also transparently transmitted to the upper switch.
  • the vlan tag between 1024 and 2047 indicates that the end user is a PPOOE (Point-to-Point Protocol Over Ethernet) user.
  • the uplink data needs to be increased by svlan tag 1024.
  • the label is then sent to the upper switch;
  • the vlan tag indicates that the end user is a dedicated line user between 2048 and 3071.
  • the upstream data packet needs to be added with the outer virtual LAN label with the svlan tag of 2048 and then sent to the upper switch.
  • the administrator needs to perform the following configuration: First, configure the internal set insvlan tag of the internal setting carried by the ONU1 port to be 4001 on the port of the EPON access device line card.
  • the insvlan tag is 4001 and the svlan tag corresponding to the terminal with the vlan tag range (1024 ⁇ 2047) is 1024;
  • the insvlan tag is 4001 and the svlan tag corresponding to the terminal with the vlan tag range (2048 ⁇ 3071) is 2048;
  • the port configuration labels 1024, 2048 and 60, 200 ⁇ 1000 are tag types, and 4001 is untag type.
  • the following is a transparent transmission terminal vlan tag ( 60 ) and a terminal that needs to add an outer label vlan tag
  • (1024) is illustrated as an example, and their MAC addresses are assumed to be MAC 1 and MAC 2, respectively.
  • the line card 3 After the terminal vlan tag (60) on the ONU1 sends the uplink data packet to the line card 3 of the EPON access device, the line card 3 adds an insvlan tag (4001) to the uplink data packet, so that the terminal's uplink datagram The text becomes a double-layer label (4001, 60), and then the line card 3 sends it to the downlink port 1 of the main control switch chip; after receiving the uplink data message with the double-layer label (4001, 60), the main control switch chip receives the uplink data packet Determine the MAC address of the terminal and find that it is a new address, then establish the correspondence between (4001, MAC1), (60, MAC1) and port ONU1, and establish the association relationship between (4001, MAC1) and (60, MAC1). When the downlink port 1 of the master switching chip receives the uplink data packet of the terminal vlan tag (60) again, the relationship is not established;
  • the master switch chip searches the QinQ service mapping table in the global mode. If no (4001, 60) is found to the corresponding svlan tag, the uplink data packet with the (4001, 60) double-layer label is directly sent to the upper switch. Union port
  • the uplink port of the EPON access device learns that the 4001 is an untag attribute according to the port tag configuration attribute. Therefore, the uplink port is stripped of 4001, and only the uplink data packet of the single tag vlan tag (60) is sent to the uplink switch, so that Transmitting the uplink data packet of the terminal vlan tag (60); The direction of the downlink data packet of the transparent transmission terminal vlan tag ( 60 ):
  • the uplink switch sends the downlink data packet with the single-layer label vlan tag (60) to the uplink port of the EPON access device, and the master switching chip obtains the (60, MAC1) information from the downlink data packet, and
  • the ONU port where the destination terminal MAC1 is located is the ONU1 according to the relationship between the (60, MAC1) and the port ONU1. Therefore, the downlink data packet is sent to the terminal with the address MAC1 through the ONU1 port.
  • the master switch chip aging (4001, MAC1) and the port ONU1 correspond to each other, and then automatically aging according to the association relationship between (4001, MAC1) and (60, MAC1) (60, MAC1) ) Correspondence with port ONU1, that is, the relationship is deleted.
  • the direction of the upstream data packet of the terminal vlan tag ( 1024 ) of the outer label needs to be increased:
  • the line card 3 After the terminal vlan tag (1024) on the ONU1 sends the uplink data packet to the line card 3 of the EPON access device, the line card 3 adds an insvlan tag (4001) to the uplink data packet, so that the terminal sends an uplink datagram.
  • the text has a double-layer label (4001, 1024), and then the line card 3 sends it to the downlink port 1 corresponding to the main control switch chip;
  • the master switching chip After receiving the uplink data packet with the double-layer label (4001, 1024), the master switching chip determines the MAC address of the terminal and finds that it is a new address, and establishes (4001, MAC2), (1024, MAC2) and port respectively. The association relationship between ONU1 and the association between (4001, MAC2) and (1024, MAC2) is established. When the downlink port 1 of the master switching chip receives the uplink data packet of the terminal vlan tag (1024) again, the above-mentioned relationship is no longer established. Relationship
  • the master switch chip searches the QinQ service mapping table in the global mode, and finds (4001, 1024) to the corresponding svlan tag 1024, and replaces the insvlan tag (4001) with svlan tag (1024), which will carry (1024, 1024) the uplink data packet of the double-layer label is forwarded to the uplink port;
  • the uplink port knows that 1024 is the tag attribute. Therefore, the uplink port retains 1024, and the uplink data packet with the double-label (1024, 1024) label is sent to the uplink switch, thus implementing the terminal vlan. Double-layer label transmission of upstream data packets of tag (1024);
  • the uplink switch sends the downlink data packet with the double-layer label (1024, 1024) to the uplink port of the EPON access device, and the master switching chip obtains (1024, MAC2) information from the downlink data packet, and
  • the ONU port where the destination terminal MAC2 is located is the ONU1 according to the relationship between the saved (1024, MAC2) and the port ONU1. Therefore, the downlink data packet is sent to the terminal with the address MAC2 through the ONU1 port.
  • the method of the present invention can also be applied to the field of DSL (Digital Subscriber Loop) access.
  • DSL Digital Subscriber Loop
  • the broadcast data flooding of the downlink data packets on all ONU ports of the EPON access device is avoided, and the security risk of information being eavesdropped is eliminated.

Description

一种防止以太无源光网络中下行数据洪泛的方法
技术领域
本发明涉及 EPON ( Ethernet Passive Optical Network , 以太无源光网络） 接入领域， 尤其涉及一种 ΕΡΟΝ中防止下行数据洪泛的方法。 背景技术
以太网技术以其良好的经济性、互通性和易用性等优势得到了普遍应用。 随着 ΕΡΟΝ、 10 Gbit/s以太网等技术和标准的成熟， 以太网逐步向城域网和 广域网发展， 原来利用 802.1 Q VLAN ( Virtual Local Area Network , 虚拟局域 网）对终端用户进行隔离和标识受到很大限制， 因为 IEEE802.1Q 中定义的 vlan tag (虚拟局域网标签）域只有 12个比特， 仅能表示 4K个 vlan, 这对于 城域以太网中需要标识的大量终端用户捉襟见肘， 于是 QinQ 业务应运而生 ( QinQ 目前没有通用的中文技术术语） 。 QinQ业务是指将用户终端的私网 vlan tag (即终端自身的 vlan tag )封装在公网 vlan tag中， 使数据报文带着两 层 vlan tag穿越运营商的骨干网络 (即公网）。 在公网中数据报文只根据外层 vlan tag (即公网 vlan tag )传播， 终端自身的 vlan tag被屏蔽。相对基于 MPLS ( Multi Protocol Label Switch, 多协议标签交换 )的二层 VPN ( Virtual Private Networks, 虚拟专用网络） ， QinQ业务具有如下特点： 为终端提供了一种更 为简单的二层 VPN隧道；不需要信令协议的支持，可以通过纯静态配置实现。
QinQ业务最初主要是为拓展 vlan的数量空间而产生的， 它是在原有的 802.1Q数据报文的基础上又增加一层 802.1Q标签实现的， 使 vlan数量增加 到 4K*4K, 随着城域以太网的发展以及运营商精细化运作的要求， QinQ业务 的双层标签又有了进一步的使用场景， 城域网交换机有这样的需求， 下联的 EPON接入设备根据终端自身的 vlan tag所处范围段直接透传，或者根据终端 自身的 vlan tag所处范围段增加外层映射的 vlan tag,我们称这个外层 vlan tag 为 svlan tag (外层虚拟局域网标签） 。
EPON接入设备的构架一般由主控板（包含有主控交换芯片）与多块线 卡组成， 如果 EPON线卡处理能力比较强 （带来成本也比较高） ， 将直接实 现这一功能， 即线卡根据终端自身的 vlan tag所处范围段进行透传，或者增加 外层映射的 svlan tag, 主控交换芯片正常完成二层 vlan tag转发。
现有技术中， EPON接入设备根据终端自身的 vlan tag所处范围段对数据 报文进行透传或者增加外层映射的 svlan tag的基本原理是利用主控交换芯片 的流分类功能， 对符合一定流分类规则的数据报文直接修改 svlan tag, 简单 描述如下：
数据报文的上行传送方向， 对需要增加 svlan tag的终端， 主控交换芯片 将线卡设定的 insvlan tag ( EPON接入设备内部设定的外层虚拟局域网标签， 以下简称为内部标签）转换为上联交换机所需要的 svlan tag, 对需要透传的 终端，主控交换芯片将线卡设定的 insvlan tag剥离，保留终端自身的 vlan tag。 流分类的规则是根据终端自身的 vlan tag所处范围段， 将（ insvlan tag, 终端 自身的 vlan tag )转换为 （ svlan tag, 终端自身的 vlan tag ) , 对于需要透传的 终端， 主控交换芯片则直接去掉线卡设定的 insvlan tag, 实现终端自身的 vlan tag的透传。
数据报文的下行传送方向， 对上联交换机发送的带 svlan tag的下行数据 报文， EPON接入设备直接去掉 svlan tag ( svlan在下联端口的 vlan属性为非 标签 untag ) , 剩下终端自身的 vlan tag, 透传的下行数据报文仅有终端自身 的 vlan tag, 由于不知道要发送给哪个终端， 则 EPON接入设备将对下行数据 报文进行数据洪泛， 这样与 EPON接入设备相连的所有的 ONU ( Optical Network Unit,光网络单元）端口都可以接收到这种广播洪泛的下行数据报文， 下行业务受到冲击， 同时存在信息被窃听的安全隐患。 发明内容
本发明要解决的技术问题是提供一种防止以太无源光网络中下行数据洪 泛的方法， 使得 EPON接入设备在发送下行数据报文时不再向所有的 ONU 端口进行广播洪泛， 同时消除了信息被窃听的安全隐患。
为了解决上述问题， 本发明提供了一种防止以太无源光网络中下行数据 洪泛的方法， 包括： 以太无源光网络的接入设备上保存有光网络单元 ONU端口下连接的终 端的虚拟局域网标签 vlan tag;
终端在首次发送上行数据报文时， 所述接入设备至少记录所述终端的介 质访问控制 MAC地址、所述终端所在光网络单元 ONU对应的交换网端口与 所述 vlan tag的对应关系；
所述接入设备发送下行数据报文时， 根据下行数据报文的目的终端的 MAC地址和 vlan tag查找目的终端所在的 ONU对应的交换网端口， 将所述 下行数据报文发送给所述目的终端。
进一步地，如果发送上行数据报文的终端是 QinQ业务终端，则所述接入 设备还记录该终端的外层虚拟局域网标签 svlan tag; 当所述接入设备发送下 行数据报文时，如果所述下行数据报文的目的终端为 QinQ业务终端，则所述 接入设备根据所述目的终端的 MAC地址和 svlan tag查找目的终端所在的 ONU对应的交换网端口， 将所述下行数据报文发送给所述目的终端。
进一步地， 每个 ONU端口对应一个内部的外层虚拟局域网标签 insvlan tag, 所述接入设备上保存有 insvlan tag与 vlan tag的对应关系， 对于 QinQ业 务终端， 所述接入设备上还保存有 insvlan tag, vlan tag与 svlan tag的对应关 系；所述接入设备在发送下行数据报文时根据 insvlan tag和 vlan tag查找 svlan tag, 如果找到则认为该下行数据报文的目的终端为 QinQ业务终端。
进一步地， 所述接入设备中的主控交换芯片用于保存各种对应关系， 以 及查找目的终端所在的 ONU对应的交换网端口。
为了解决上述技术问题本发明提供了一种防止以太无源光网络中下行数 据洪泛的方法， 包括：
在终端发送上行数据报文时， 以太无源光网络 EPON接入设备对所述上 行数据报文进行解析， 获取所述终端的介质访问控制 MAC地址， 判断所述 MAC地址是否为新地址；
若所述 MAC地址为新地址，则 EPON接入设备将终端所在 ONU端口对 应的内部设定的外层虚拟局域网标签 insvlan tag与终端的 MAC地址相结合作 为标识项 A, 将所述上行数据报文的外层虚拟局域网标签 svlan tag或者终端 自身的 vlan tag与终端的 MAC地址相结合作为标识项 B,分别建立标识项 A、 标识项 B与终端所在 ONU端口的对应关系， 同时还建立所述标识项 A和标 识项 B的关联关系；
EPON接入设备在发送下行数据报文时， 从所述下行数据报文中获取标 识项 B的信息 ,根据所述标识项 B与终端所在 ONU端口的对应关系确定 ONU 端口， 然后将所述下行数据报文通过该 ONU端口发送给目的终端。
进一步地， 当终端为需要透传的终端时， 其对应的标识项 B为： 终端自 身的 vlan tag与终端的 MAC地址的结合；当终端为需要增加外层标签的终端 时， 其对应的标识项 B为： svlan tag与终端的 MAC地址的结合。
进一步地， 上行数据报文的发送过程包括如下步骤：
( a ) EPON接入设备进行 QinQ业务配置， 包括： 为 QinQ业务终端所在 ONU端口配置 EPON接入设备内部设定的外层虚拟局域网标签 insvlan tag, 配置全局模式下的 QinQ业务映射关系表， 以及配置 EPON接入设备上联端 口的标签属性；
( b )终端发送上行数据报文到 EPON接入设备， 所述上行数据报文增加 insvlan tag后被送到 EPON接入设备的主控交换芯片；
( c )主控交换芯片对带有 insvlan tag的上行数据报文进行解析， 获取终 端的 MAC地址， 并进一步判断是否为新 MAC地址， 若是则分别建立所述标 识项 A、 标识项 B与终端所在 ONU端口的对应关系 , 同时还建立所述标识 项 A和标识项 B的关联关系， 否则直接进行下一步；
( d )主控交换芯片查找全局模式下的 QinQ业务映射关系表， 如果查找 到对应的 svlan tag,则用 svlan tag替换 insvlan tag后将上行数据报文发送到上 联端口， 如果没有查找到， 则直接将带有 insvlan tag的上行数据报文发送到 上联端口；
( e ) EPON接入设备的上联端口根据配置的标签属性， 将带有 svlan tag 和 vlan tag双层标签的上行数据报文进行双层标签发送，对带有 insvlan tag和 vlan tag双层标签的上行数据报文去掉 insvlan tag后进行单层标签透传。 进一步地， 步骤（a ) 中， 所述 QinQ业务映射关系表的内容为根据终端 自身的 vlan tag所处的范围段建立的 insvlan tag和终端自身的 vlan tag相结合 的关联项与 svlan tag的对应关系。
进一步地， 下行数据报文的发送过程包括如下步骤：
( f ) EPON接入设备的上联交换机将下行数据报文发送到 EPON接入设 备， EPON接入设备从所述下行数据报文中获取所述标识项 B的信息， 并根 据所述标识项 B和终端所在 ONU端口的对应关系确定 ONU端口 ,然后将所 述下行数据报文通过所述 ONU端口发送给目的终端。
进一步地，终端的 MAC地址老化后， EPON接入设备的主控交换芯片将 保存的所述标识项 A和终端所在 ONU端口的对应关系删除， 然后根据所述 标识项 A和标识项 B的关联关系自动删除标识项 B和终端所在 ONU端口的 对应关系。
由上可见， 本发明方法中， EPON接入设备在终端首次发送上行数据报 文时获取终端的 MAC地址， 以及终端所在 ONU对应的交换网端口， 并根据 终端所处范围段记录该终端的标签， 建立 MAC地址、 交换网端口与终端标 签的对应关系； EPON接入设备在发送下行数据报文时， 根据终端的标签以 及该终端的 MAC地址查找所述终端所在的 ONU对应的交换网端口，将下行 数据报文发送给该终端。 从而避免了下行数据报文在 EPON接入设备所有 ONU端口的广播洪泛， 消除了信息被窃听的安全隐患。 附图概述
图 1是 EPON接入设备组网示意图；
图 2是本发明中数据报文的上行和下行发送过程流程图。 本发明的较佳实施方式
在终端首次发送上行数据报文时， 以太无源光网络 EPON接入设备获取 所述终端的 MAC ( Media Access Control, 介质访问控制）地址， 以及终端所 在 ONU对应的交换网端口 （或称 ONU所在的以太网端口） , 并根据终端所 处范围段记录该终端的标签（svlan tag或者 vlan tag ) , 至少建立 MAC地址、 交换网端口与终端标签的对应关系； EPON接入设备在发送下行数据报文时， 根据终端的标签以及该终端的 MAC地址查找终端所在的 ONU对应的交换网 端口， 将下行数据报文发送给该终端。
具体地， 可以如下实现： 在终端发送上行数据 文时， 以太无源光网络 EPON接入设备对所述上行数据报文进行解析， 获取所述终端的 MAC地址 , 判断所述 MAC地址是否为新地址； 若所述 MAC地址为新地址， 则 EPON接 入设备将终端所在 ONU端口对应的内部设定的外层虚拟局域网标签 insvlan tag与终端的 MAC地址相结合作为标识项 A,将所述上行数据报文的外层虚 拟局域网标签 svlan tag或者终端自身的 vlan tag与终端的 MAC地址相结合作 为标识项 B( svlan tag与 vlan tag其中的一个与 MAC地址结合作为标识项 B ), 对透传终端即不增加外层 vlan的终端，是终端自身的 vlan tag与 MAC地址相 结合作为标识项 B; 对 QinQ业务终端， 则是用 QinQ外层 tag即 Svlan tag与 MAC地址相结合作为标识项 B。 分别建立标识项 A、 标识项 B与终端所在 ONU对应的交换网端口的对应关系， 同时还建立所述标识项 A和标识项 B 的关联关系， 即分别建立标识项 A、 标识项 B与终端所在 ONU对应交换网 端口的对应关系； EPON接入设备在发送下行数据报文时， 从所述下行数据 报文中获取标识项 B的信息， 根据所述标识项 B确定终端所在 ONU对应交 换网端口，然后将所述下行数据报文通过该 ONU对应的交换网端口发送给目 的终端。 这样就避免了 EPON接入设备将下行数据报文向所有 ONU端口广 播洪泛的问题。
上述标识项 A和标识项 B作为检索项使用， 釆用标识项 A和标识项 B 的描述仅是为了描述方便。
本文所述的终端可以是指家庭网关或者交换机等家庭终端设备。
下面结合附图和实施例对本发明的方法做进一步详细说明。
如图 2所示， 本发明中数据报文的上行和下行发送过程包括如下步骤： 第一步， EPON接入设备进行 QinQ业务配置， 包括： 为 QinQ业务终端 所在的 ONU端口配置 insvlan tag, 配置全局模式下的 QinQ业务映射关系表， 以及配置 EPON接入设备的上联端口的标签属性；
每一个 0NU端口可以对应唯一的 insvlan tag , 也可以多个 0NU端口对 应同一个 insvlan tag。
所述 QinQ业务映射关系表的内容为根据终端自身的 vlan tag所处的范围 段建立（ insvlan tag, 终端自身的 vlan tag )与 svlan tag的对应关系 , 即根据终 端自身的 vlan tag和标识 ONU的 insvlan tag组合来建立与 svlan tag的对应关 系， 该对应关系只有需要增加外层标签的终端才有， 透传的终端无此对应关 系， 建立此关系后， 接入设备根据 insvlan tag和终端自身的 vlan tag就可以查 找到 svlan tag。
所述 EPON接入设备的上联端口的标签属性包括标签 tag和非标签 untag， 此处将 svlan tag以及终端自身的 vlan tag的属性设置为标签 tag, insvlan tag 的属性设置为非标签 imtag。 此处 insvlan tag设置为 untag标签是为了实现透 传业务。
第二步， ONU端口的终端发送上行数据报文到 EPON接入设备， EPON 接入设备的线卡为所述上行数据报文增加 insvlan tag(对透传或者需要增加外 层标签的终端都釆用相同的处理）后送往 EPON接入设备的主控交换芯片； 这里釆用的是由 EPON接入设备的线卡为上行数据报文增加 insvlan tag 的方式，在其它实施例中也可以采用由 ONU端口为上行数据 4艮文增加 insvlan tag的方式。 增力口 insvlan tag后, 上行数据^ =艮文尤带有 insvlan tag和 vlan tag 双层标签了。
第三步， 主控交换芯片收到带 insvlan tag的上行数据报文后， 对该上行 数据报文进行解析， 获取终端的 MAC地址， 并判断是否为新 MAC地址， 若 是则 EPON接入设备将终端所在 ONU端口对应的内部设定的外层虚拟局域 网标签 insvlan tag与终端的 MAC地址相结合作为标识项 A , 将所述上行数 据报文的外层虚拟局域网标签 svlan tag或者终端自身的 vlan tag与终端的 MAC地址相结合作为标识项 B, 分别建立标识项 A、 标识项 B与终端所在 ONU端口的对应关系， 同时还建立所述标识项 A和标识项 B的关联关系， 否则直接进行第四步； 终端发送的报文中携带有 MAC地址， 如果在主控交换芯片中没有查找 到该 MAC的记录， 则认为该 MAC地址为新的 MAC地址， 主控交换芯片学 习这个 MAC地址后， 该终端再发送过来报文所携带的源 MAC就不再是新 MAC地址了。
建立所述关系时，主控交换芯片首先查找全局模式下的 QinQ业务映射关 系表， 即查找（ insvlan tag,终端自身的 vlan tag )对应的 svlan tag,根据 insvlan tag和 vlan tag查找对应的 svlan tag,如果没有查到对应的 svlan tag,说明该终 端是透传的终端， 则分别建立 insvlan tag, MAC地址、 vlan tag与终端所在 ONU对应的交换网端口的对应关系； 如果查找到对应的 svlan tag, 说明该终 端为需要增加外层标签的终端，则分别建立 insvlan tag、 MAC地址、 svlan tag 与终端所在 ONU对应的交换网端口的对应关系。
第四步，主控交换芯片查找全局模式下的 QinQ业务映射关系表，如果查 找到对应的 svlan tag,则用 svlan tag替换原来的 insvlan tag后将上行数据才艮文 发送到上联端口， 如果没有查找到对应的 svlan tag, 则直接将原上行数据报 文（即带有 insvlan tag和 vlan tag双层标签的上行数据报文 )发送到上联端口； 本步骤中的查找及转发功能由主控交换芯片的快速流分类模块实现。 第五步， EPON接入设备上联端口根据配置的标签属性，将带有 svlan tag insvlan tag和 vlan tag双层标签的上行数据报文去掉 insvlan tag后进行单层标 签透传；
第六步， EPON接入设备的上联交换机将带有双层虚拟局域网标签 svlan tag和 vlan tag或者仅带单层虚拟局域网标签 vlan tag的下行数据报文发送到 EPON接入设备， EPON接入设备从所述下行数据 4艮文中获取所述标识项 B 的信息即 vlan tag和 MAC,或者 svlan tag和 MAC地址，并根据所述标识项 B 确定终端所在 ONU对应的交换网端口， 然后将所述下行数据"¾文通过所述 ONU对应的交换网端口发送给目的终端；
这样 ONU端口的终端仅仅收到需要发送给自己的数据报文，避免了下行 数据报文的洪泛。 第七步，终端的 MAC地址老化后， EPON接入设备的主控交换芯片老化 其保存的标识项 A、 标识项 B与终端所在 ONU对应的交换网端口的对应关 系以及标识项 A和标识项 B的关联关系， 即将所述关系删除。
MAC地址老化是指终端暂时不再进行数据报文的传递了，因此主控交换 芯片不需要再保存所述关联关系了， 如果过一段时间后终端又进行数据报文 的传输了， 则 EPON接入设备按照前述步骤再次建立所述关系并保存。
老化时， EPON接入设备先老化标识项 A与终端所在 ONU对应的交换 网端口的对应关系， 再才艮据标识项 A和标识项 B的关联关系自动老化标识项 B与终端所在 ONU对应的交换网端口的对应关系。
下面再以一应用实例对本发明的方法#文进一步详细说明。
如图 1所示， EPON接入设备通过上联交换机与城域网相连， 下联通过 ODN ( Optical Distribution Network,光分配网络）连接多个 ONU端口； EPON 接入设备由 EPON线卡、上联板、主控板、电源板以及风扇板组成，其中 EPON 线卡可以有多块， 主控交换芯片在主控板上。
从 ONU1端口的终端， 假设根据 vlan tag所处范围分为以下四类： vlan tag在 200 ~ 1000 之间表示该终端用户的业务为 IPTV ( Internet Protocol Television, 交互式网络电视）， 需要将带有 vlan tag的上行数据报文 直接透传到上层交换机；
vlan tag为 60表示该终端是 ONU1下面设备的网络管理 vlan, 也需要将 带有 vlan tag的上行数据报文透传到上层交换机；
vlan tag在 1024 ~ 2047 之间表示该终端用户为 PPPOE ( Point-to-Point Protocol Over Ethernet, 以太网上的点对点协议）用户， 其上行的数据 4艮文需 要增加 svlan tag为 1024的外层虚拟局域网标签后再发送到上层交换机；
vlan tag在 2048 ~ 3071之间表示该终端用户为专线用户， 其上行的数据 报文需要增加 svlan tag为 2048的外层虚拟局域网标签后再发送到上层交换 机。
在这种需求下， 需要管理员进行以下配置： 首先在 EPON接入设备线卡的端口下配置 ONU1端口所携带的内部设定 的外层标签 insvlan tag为 4001；
然后配置全局模式下的 QinQ业务映射关系表：
insvlan tag为 4001并且 vlan tag范围在（ 1024 ~ 2047 ) 内的终端对应的 svlan tag为 1024;
insvlan tag为 4001并且 vlan tag范围在（ 2048 ~ 3071 ) 内的终端对应的 svlan tag为 2048;
最后在 EPON接入设备上联端口配置标签 1024、 2048 以及 60、 200 ~ 1000 为 tag类型， 4001为 untag类型。
下面分别以透传终端 vlan tag ( 60 )和需要增加外层标签的终端 vlan tag
( 1024 )为例加以说明， 假定它们的 MAC地址分别为 MAC 1以及 MAC2。
透传终端 vlan tag ( 60 ) 的上行数据报文方向：
ONU1上的终端 vlan tag ( 60 )将上行数据报文发送到 EPON接入设备的 线卡 3后， 线卡 3为所述上行数据报文增加 insvlan tag ( 4001 ) , 这样该终端 的上行数据报文变为双层标签（4001 , 60 ) , 然后线卡 3将其送至主控交换 芯片的下联端口 1 ; 主控交换芯片收到带双层标签（4001 , 60 ) 的上行数据报文后， 判断终 端的 MAC地址， 发现是一个新地址， 则分别建立 （4001 , MAC1 ) 、 ( 60, MAC1 )和端口 ONU1的对应关系， 同时建立（ 4001 , MAC1 )和（ 60, MAC1 ) 的关联关系， 主控交换芯片的下联端口 1再次收到终端 vlan tag ( 60 )的上行 数据报文时就不再建立上述关系了；
主控交换芯片查找全局模式下的 QinQ 业务映射关系表， 没有查找到 ( 4001 , 60 )到对应的 svlan tag, 则直接将带有 （4001 , 60 )双层标签的上 行数据报文发送到上联端口；
EPON接入设备的上联端口根据端口标签配置属性， 获知 4001为 untag 属性， 因此上联端口剥掉 4001 , 将只有单标签 vlan tag ( 60 )的上行数据报文 发送给上联交换机，这样就实现了终端 vlan tag ( 60 )的上行数据报文的透传； 透传终端 vlan tag ( 60 ) 的下行数据报文方向：
上联交换机将带有单层标签 vlan tag ( 60 ) 的下行数据报文发送到 EPON 接入设备的上联端口， 主控交换芯片从该下行数据报文中获取（60, MAC1 ) 信息， 并根据其保存的 （60, MAC1 )和端口 ONU1 的关联关系获知目的终 端 MAC1所在的 ONU端口为 ONU1 , 因此将所述下行数据报文通过 ONU1 端口发送给地址为 MAC1的终端；
当用户 vlan tag ( 60 ) 下线后， 主控交换芯片老化（4001 , MAC1 )和端 口 ONU1 的对应关系， 然后根据（4001 , MAC1 )和（60, MAC1 ) 的关联 关系自动老化（60, MAC1 )和端口 ONU1的对应关系， 即删除所述关系。
需要增加外层标签的终端 vlan tag ( 1024 ) 的上行数据报文方向：
ONU1上的终端 vlan tag ( 1024 )将上行数据报文发送到 EPON接入设备 的线卡 3后， 线卡 3为所述上行数据报文增加 insvlan tag ( 4001 ) , 这样该终 端的上行数据报文就带有双层标签（4001 , 1024 ) 了， 然后线卡 3将其送至 主控交换芯片对应的下联端口 1 ;
主控交换芯片收到带双层标签（4001 , 1024 ) 的上行数据报文后， 判断 终端的 MAC地址，发现是一个新地址，则分别建立（ 4001 , MAC2 )、 ( 1024, MAC2 )和端口 ONU1 的对应关系， 同时建立 （4001 , MAC2 )和（ 1024, MAC2 )的关联关系，主控交换芯片的下联端口 1再次收到终端 vlan tag( 1024 ) 的上行数据报文时就不再建立上述关系了；
主控交换芯片查找全局模式下的 QinQ业务映射关系表， 查找到 （4001 , 1024 )到对应的 svlan tag为 1024,则用 svlan tag( 1024 )替换 insvlan tag( 4001 ), 将带有 （ 1024, 1024 )双层标签的上行数据报文转发到上联端口；
上联端口根据端口标签配置属性， 获知 1024为 tag属性， 因此上联端口 保留 1024, 将带有（ 1024, 1024 )双层标签的上行数据报文发送给上联交换 机， 这样就实现了终端 vlan tag ( 1024 ) 的上行数据报文的双层标签传送；
需要增加外层标签的终端 vlan tag ( 1024 ) 的下行数据报文方向： 上联交换机将带有双层标签（ 1024, 1024 )的下行数据报文发送到 EPON 接入设备的上联端口，主控交换芯片从该下行数据报文中获取（ 1024, MAC2 ) 信息， 并根据其保存的 （ 1024, MAC2 )和端口 ONU1 的关联关系获知目的 终端 MAC2所在的 ONU端口为 ONU1 ,因此将所述下行数据报文通过 ONU1 端口发送给地址为 MAC2的终端；
当用户 vlan tag ( 1024 ) 下线后， 主控交换芯片老化（4001 , MAC2 )和 端口 ONU1 的关联关系， 然后根据（4001 , MAC2 )和（ 1024, MAC2 ) 的 关联关系自动老化（ 1024, MAC2 )和端口 ONU1 的关联关系， 即删除所述 关系。
这样就避免了下行数据报文的广播洪泛， 消除了信息泄露的安全隐患。
除了以太无源光网络接入领域，本发明所述方法也可应用于 DSL ( Digital Subscriber Loop, 数字用户环路）接入领域。
当然， 本发明还可有其他多种实施例， 在不背离本发明精神及其实质的 但这些相应的改变和变形都应属于本发明所附的权利要求的保护范围。 工业实用性
釆用本发明方法， 避免了下行数据报文在 EPON接入设备所有 ONU端 口的广播洪泛， 消除了信息被窃听的安全隐患。

Claims

权 利 要 求 书
以太无源光网络的接入设备上保存有光网络单元 ONU端口下连接的终 端的虚拟局域网标签 vlan tag;
终端在首次发送上行数据报文时， 所述接入设备至少记录所述终端的介 质访问控制 MAC地址、所述终端所在光网络单元 ONU对应的交换网端口与 所述 vlan tag的对应关系；
所述接入设备发送下行数据报文时， 根据下行数据报文的目的终端的 MAC地址和 vlan tag查找目的终端所在的 ONU对应的交换网端口， 将所述 下行数据报文发送给所述目的终端。
2、 如权利要求 1所述的方法， 其特征在于，
如果发送上行数据报文的终端是 QinQ业务终端，则所述接入设备还记录 该终端的外层虚拟局域网标签 svlan tag;
当所述接入设备发送下行数据报文时， 如果所述下行数据报文的目的终 端为 QinQ业务终端，则所述接入设备根据所述目的终端的 MAC地址和 svlan tag查找目的终端所在的 ONU对应的交换网端口， 将所述下行数据报文发送 给所述目的终端。
3、 如权利要求 2所述的方法， 其特征在于，
每个 ONU端口对应一个内部的外层虚拟局域网标签 insvlan tag, 所述接 入设备上保存有 insvlan tag与 vlan tag的对应关系， 对于 QinQ业务终端， 所 述接人设备上还保存有 insvlan tag. vlan tag与 svlan tag的对应关系；
所述接入设备在发送下行数据 4艮文时才艮据 insvlan tag和 vlan tag查找 svlan tag, 如果找到则认为该下行数据报文的目的终端为 QinQ业务终端。
4、 如权利要求 1或 2或 3所述的方法， 其特征在于，
所述接入设备中的主控交换芯片用于保存各种对应关系， 以及查找目的 终端所在的 ONU对应的交换网端口。 在终端发送上行数据报文时， 以太无源光网络 EPON接入设备对所述上 行数据报文进行解析， 获取所述终端的介质访问控制 MAC地址， 判断所述 MAC地址是否为新地址；
若所述 MAC地址为新地址，则 EPON接入设备将终端所在 ONU端口对 应的内部设定的外层虚拟局域网标签 insvlan tag与终端的 MAC地址相结合作 为标识项 A, 将所述上行数据报文的外层虚拟局域网标签 svlan tag或者终端 自身的 vlan tag与终端的 MAC地址相结合作为标识项 B,分别建立标识项 A、 标识项 B与终端所在 ONU端口的对应关系， 同时还建立所述标识项 A和标 识项 B的关联关系；
EPON接入设备在发送下行数据报文时， 从所述下行数据报文中获取标 识项 B的信息 ,根据所述标识项 B与终端所在 ONU端口的对应关系确定 ONU 端口， 然后将所述下行数据报文通过该 ONU端口发送给目的终端。
6、 如权利要求 5所述的方法， 其特征在于：
当终端为需要透传的终端时， 其对应的标识项 B为： 终端自身的 vlan tag 与终端的 MAC地址的结合；
当终端为需要增加外层标签的终端时， 其对应的标识项 B为： svlan tag 与终端的 MAC地址的结合。
7、 如权利要求 5所述的方法，其特征在于，上行数据报文的发送过程包 括如下步骤：
( a ) EPON接入设备进行 QinQ业务配置， 包括： 为 QinQ业务终端所在 ONU端口配置 EPON接入设备内部设定的外层虚拟局域网标签 insvlan tag, 配置全局模式下的 QinQ业务映射关系表， 以及配置 EPON接入设备上联端 口的标签属性；
( b )终端发送上行数据报文到 EPON接入设备， 所述上行数据报文增加 insvlan tag后被送到 EPON接入设备的主控交换芯片；
( c )主控交换芯片对带有 insvlan tag的上行数据报文进行解析， 获取终 端的 MAC地址 , 并进一步判断是否为新 MAC地址 , 若是则分别建立所述标 识项 A、 标识项 B与终端所在 ONU端口的对应关系 , 同时还建立所述标识 项 A和标识项 B的关联关系， 否则直接进行下一步；
( d )主控交换芯片查找全局模式下的 QinQ业务映射关系表， 如果查找 到对应的 svlan tag ,则用 svlan tag替换 insvlan tag后将上行数据报文发送到上 联端口， 如果没有查找到， 则直接将带有 insvlan tag的上行数据报文发送到 上联端口；
( e ) EPON接入设备的上联端口根据配置的标签属性， 将带有 svlan tag 和 vlan tag双层标签的上行数据报文进行双层标签发送，对带有 insvlan tag和 vlan tag双层标签的上行数据报文去掉 insvlan tag后进行单层标签透传。
8、 如权利要求 7所述的方法， 其特征在于：
步骤（ a )中，所述 QinQ业务映射关系表的内容为根据终端自身的 vlan tag 所处的范围段建立的 insvlan tag和终端自身的 vlan tag相结合的关联项与 svlan tag的对应关系。
9、 如权利要求 7所述的方法，其特征在于， 下行数据报文的发送过程包 括如下步骤：
( f ) EPON接入设备的上联交换机将下行数据报文发送到 EPON接入设 备， EPON接入设备从所述下行数据报文中获取所述标识项 B的信息， 并根 据所述标识项 B和终端所在 ONU端口的对应关系确定 ONU端口 ,然后将所 述下行数据报文通过所述 ONU端口发送给目的终端。
10、 如权利要求 5所述的方法， 其特征在于， 还包括：
终端的 MAC地址老化后 , EPON接入设备的主控交换芯片将保存的所述 标识项 A和终端所在 ONU端口的对应关系删除， 然后 4艮据所述标识项 A和 标识项 B的关联关系自动删除标识项 B和终端所在 ONU端口的对应关系。
PCT/CN2009/070282 2008-04-16 2009-01-22 一种防止以太无源光网络中下行数据洪泛的方法 WO2009127128A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2008100937184A CN101257452B (zh) 2008-04-16 2008-04-16 一种以太无源光网络接入设备发送下行数据报文的方法
CN200810093718.4 2008-04-16

Publications (1)

Publication Number Publication Date
WO2009127128A1 true WO2009127128A1 (zh) 2009-10-22

Family

ID=39891932

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/070282 WO2009127128A1 (zh) 2008-04-16 2009-01-22 一种防止以太无源光网络中下行数据洪泛的方法

Country Status (2)

Country Link
CN (1) CN101257452B (zh)
WO (1) WO2009127128A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2523399A1 (en) * 2010-02-10 2012-11-14 ZTE Corporation Method and device for realizing flexible qinq
CN108632175A (zh) * 2017-03-22 2018-10-09 中兴通讯股份有限公司 用于多形态网络中上联端口的切换方法及装置
CN109905785A (zh) * 2019-03-29 2019-06-18 新华三技术有限公司 一种报文转发方法及装置
CN113726635A (zh) * 2021-08-30 2021-11-30 新华三大数据技术有限公司 一种报文处理方法、装置及电子设备
CN114301993A (zh) * 2021-12-10 2022-04-08 海南乾唐视联信息技术有限公司 一种数据传输方法、装置、终端设备和存储介质
CN115134296A (zh) * 2022-05-31 2022-09-30 青岛海信宽带多媒体技术有限公司 一种智能网关
CN115134296B (zh) * 2022-05-31 2024-05-17 青岛海信宽带多媒体技术有限公司 一种智能网关

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101267452B (zh) * 2008-02-27 2011-02-16 华为技术有限公司 一种web服务合成方案转换方法及应用服务器
CN101257452B (zh) * 2008-04-16 2010-12-08 中兴通讯股份有限公司 一种以太无源光网络接入设备发送下行数据报文的方法
CN101997630B (zh) * 2009-08-29 2014-04-09 中兴通讯股份有限公司 时分复用业务的保护方法
CN101931835B (zh) * 2010-09-03 2013-07-03 深圳市共进电子股份有限公司 Epon中实现vlan汇聚和转换的方法及装置
CN102065018B (zh) * 2011-01-07 2014-12-17 中兴通讯股份有限公司 一种报文传输方法及系统
ES2588739T3 (es) * 2011-04-26 2016-11-04 Huawei Technologies Co., Ltd. Método, equipo y sistema para mapear una instancia de servicio
CN102957589B (zh) * 2011-08-23 2015-07-08 华为技术有限公司 业务数据传输的方法、网络节点及系统
CN102377679B (zh) * 2011-12-06 2014-12-31 烽火通信科技股份有限公司 一种在fttx接入系统中实现链路发现和管理的方法
CN103780982B (zh) * 2012-10-25 2018-03-27 上海斐讯数据通信技术有限公司 Olt设备及epon系统
CN102983913B (zh) * 2012-12-18 2015-08-05 瑞斯康达科技发展股份有限公司 一种光网络单元以及光网络
CN104104571B (zh) * 2013-04-10 2018-12-07 中兴通讯股份有限公司 实现虚拟局域网域映射与访问控制的方法和装置
CN105516832B (zh) * 2016-01-07 2019-01-15 烽火通信科技股份有限公司 一种gpon系统中终端设备数据qinq的实现方法
CN111277503B (zh) * 2020-01-20 2021-09-24 广州芯德通信科技股份有限公司 一种基于svlan的主cpu管理外挂交换芯片的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060274771A1 (en) * 2005-04-27 2006-12-07 Takashi Doi Electronic device
CN1997035A (zh) * 2005-12-15 2007-07-11 阿尔卡特朗讯公司 接入复用器
CN101110764A (zh) * 2007-08-13 2008-01-23 中兴通讯股份有限公司 一种以太网交换机数据帧划分虚拟局域网并转发的方法
CN101257452A (zh) * 2008-04-16 2008-09-03 中兴通讯股份有限公司 一种以太无源光网络接入设备发送下行数据报文的方法
US20080212578A1 (en) * 2007-03-02 2008-09-04 Adva Ag Optical Networking System and method for constrained machine address learning

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060274771A1 (en) * 2005-04-27 2006-12-07 Takashi Doi Electronic device
CN1997035A (zh) * 2005-12-15 2007-07-11 阿尔卡特朗讯公司 接入复用器
US20080212578A1 (en) * 2007-03-02 2008-09-04 Adva Ag Optical Networking System and method for constrained machine address learning
CN101110764A (zh) * 2007-08-13 2008-01-23 中兴通讯股份有限公司 一种以太网交换机数据帧划分虚拟局域网并转发的方法
CN101257452A (zh) * 2008-04-16 2008-09-03 中兴通讯股份有限公司 一种以太无源光网络接入设备发送下行数据报文的方法

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2523399A1 (en) * 2010-02-10 2012-11-14 ZTE Corporation Method and device for realizing flexible qinq
EP2523399A4 (en) * 2010-02-10 2014-06-11 Zte Corp METHOD AND DEVICE FOR FLEXIBLE QINQ
US9166819B2 (en) 2010-02-10 2015-10-20 Zte Corporation Method and device for realizing flexible QinQ
CN108632175A (zh) * 2017-03-22 2018-10-09 中兴通讯股份有限公司 用于多形态网络中上联端口的切换方法及装置
CN109905785A (zh) * 2019-03-29 2019-06-18 新华三技术有限公司 一种报文转发方法及装置
CN113726635A (zh) * 2021-08-30 2021-11-30 新华三大数据技术有限公司 一种报文处理方法、装置及电子设备
CN113726635B (zh) * 2021-08-30 2023-05-26 新华三大数据技术有限公司 一种报文处理方法、装置及电子设备
CN114301993A (zh) * 2021-12-10 2022-04-08 海南乾唐视联信息技术有限公司 一种数据传输方法、装置、终端设备和存储介质
CN115134296A (zh) * 2022-05-31 2022-09-30 青岛海信宽带多媒体技术有限公司 一种智能网关
CN115134296B (zh) * 2022-05-31 2024-05-17 青岛海信宽带多媒体技术有限公司 一种智能网关

Also Published As

Publication number Publication date
CN101257452A (zh) 2008-09-03
CN101257452B (zh) 2010-12-08

Similar Documents

Publication Publication Date Title
WO2009127128A1 (zh) 一种防止以太无源光网络中下行数据洪泛的方法
JP4898812B2 (ja) イーサネット（登録商標）パッシブ光ネットワークにおけるサービス品質の差別化の促進
JP5053376B2 (ja) ブリッジされたネットワークにおけるポイントツーマルチポイント機能
US8228928B2 (en) System and method for providing support for multipoint L2VPN services in devices without local bridging
US8064442B2 (en) Method and apparatus for L3-aware switching in an ethernet passive optical network
JP4663643B2 (ja) イーサネット（登録商標）受動光ネットワーク内でパケットを転送する方法および装置
US9166807B2 (en) Transmission of layer two (L2) multicast traffic over multi-protocol label switching networks
US7808994B1 (en) Forwarding traffic to VLAN interfaces built based on subscriber information strings
EP1816796B1 (en) Bi-directional forwarding in ethernet-based service domains over networks
EP1903723B1 (en) Method and apparatus for transmitting message
US8509243B2 (en) Method and device for sending a packet based on tunneling protocol used in layer 2
WO2009033428A1 (fr) Procédé, système et dispositif pour retirer une adresse de commande d'accès au support
US9185035B2 (en) Apparatus and method for processing packet in MPLS-TP network
WO2007147340A1 (fr) Procédé, système et dispositif de la technique ethernet d'échange et de transfert
JP2003032287A (ja) ネットワーク間接続方法、その装置およびその装置を用いたシステム
WO2005011197A1 (fr) Procede pour reseau local virtuel (vlan) mis en oeuvre par commutation multiprotocole par etiquette (mpls)
WO2017186069A1 (zh) 一种数据传输方法及网络设备
WO2009021371A1 (fr) Procédé et dispositif permettant de réaliser une émulation pseudo-filaire de bout en bout
WO2007124679A1 (fr) Procédé et système de communication en réseau
WO2013139159A1 (zh) 在网络中转发报文的方法和运营商边缘设备
WO2007062592A1 (fr) Systeme, procede et routeur de l2vpn d'interconnexions point a multipoints, et multipoints a multipoints
WO2006122502A1 (fr) Méthode de transmission de message en couche 2 et dispositif d’accès
WO2008011818A1 (fr) Procédé de fourniture d'un service réseau local privé virtuel à hiérarchie et système réseau
WO2011026335A1 (zh) 一种广播包/组播控制报文处理方法和装置
WO2007134501A1 (fr) Procédé d'interconnexion avec des ponts de fournisseurs de réseau fédérateur et système correspondant

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09732821

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09732821

Country of ref document: EP

Kind code of ref document: A1