WO2010048775A1

WO2010048775A1 - Service and user integration management method and system in ethernet service operation

Info

Publication number: WO2010048775A1
Application number: PCT/CN2009/001155
Authority: WO
Inventors: 王劲林; 王玲芳; 邓浩江; 刘学; 刘磊
Original assignee: 中国科学院声学研究所
Priority date: 2008-10-29
Filing date: 2009-10-19
Publication date: 2010-05-06
Also published as: CN101651670A; CN101651670B

Abstract

A service and user integration management method and system utilizing the Ethernet layer 2 extension technology are provided by the present invention, and can be used in the scenarios of service operation management, user access authentication, service usage and the like in the metropolitan area, wide area or local area Ethernet. The features of the Ethernet layer 2 extension technology are utilized sufficiently by the present invention, so that the relevant fields in the message format of the Ethernet layer 2 extension technology are mapped to the service and user; in view of the one or more fields defined in the message of the Ethernet layer 2 extension technology which are not used entirely or have been used as a single field at present, the one or more fields are matched to a service identifier and a user identifier by re-arranging and defining every binary bit in the single field, or by using several fields jointly, or by using the remainder value space which is not used entirely; and additionally by the operations of request service, service state update, quit service and the like, the problem of the service and user integration management is solved. The present invention has the advantages that the service identification efficiency is high, it is difficult to be fabricated, the traffic isolation is strong and so on.

Description

TECHNICAL FIELD The present invention relates to the field of information network technologies, and in particular, to an Ethernet two-layer extension technology for service operations on a metropolitan area, a wide area, or a regional Ethernet network. Business and user integrated management methods and systems. BACKGROUND OF THE INVENTION Ethernet technology originally used for local area networks has been reborn as the operating system reduces the cost of the network. Due to the expansion of the scope of application and the variety of service types, the message format of Ethernet technology is required to be extended to support new business models and connection methods, that is, a hierarchical approach. The two methods currently developed by IEEE are IEEE 802. lad and IEEE 802.1a. IEEE 802. lad provides a commercial bridge (also known as Q-in-Q or VLAN stacking) that extends the original concept of VLANs. IEEE 802. lad simply adds a new Q tag, which allows the service provider to manage its own tags for identifying individual client networks, while the original Q-tags are used to identify VLANs in the customer network. Although IEEE 802. lad supports a three-tier hierarchy, service providers can only create 4,094 user VLANs, which is not enough for large metro and regional networks. This flaw was addressed by the IEEE 802.1a provider backbone bridge, which encapsulates the client MAC header with a service provider MAC header. Compared to the use of additional Q-tags, the use of a 24-bit service tag in the service provider MAC header theoretically supports 16 million service instances, which completely eliminates the scalability problem. The IEEE 802.1ad standard was released in 2006, and IEEE 802.1ah is still in the draft stage. With the development of technology and the emergence of new requirements, new extensions to the Ethernet Layer 2 message format may emerge.

In the current operation support system, the management of services and users generally adopts a method of high-level custom protocol above the IP layer to perform service identification, user authentication, and service usage charging. For example, XML is used to define the payload message format, which is transmitted by the SOAP protocol; or the above information is directly transmitted using the HTTP transmission protocol (these are system-implemented, and each vendor has its own method based on individual circumstances). The commonality of these methods lies in the end-to-end solution, which does not utilize the characteristics of the intermediate network, and the scalability is easy, and the performance and security are reduced. SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide a service and user integrated management method and system using Ethernet Layer 2 extension technology, which is used for operation management and user connection of services in a metropolitan area, wide area or regional Ethernet. In the scenario of authentication, service usage, and the like, the system of the present invention includes an entity such as a customer premises equipment (CPE), a network end equipment (NPE), a routing equipment (Router), and an authentication charging authentication equipment (AAA server). The invention fully utilizes the characteristics of the Ethernet Layer 2 extension technology, solves the problem of integrated management of services and users, and has the advantages of high service identification efficiency and strong traffic isolation.

In order to achieve the above object, the service and user integrated management method using the Ethernet Layer 2 extension technology of the present invention specifically includes the following methods: 1) The related fields in the packet format of the Ethernet Layer 2 extension technology are mapped to the service and the user. Method, 2) method of requesting service, 3) method of updating business status, and 4) method of terminating service. It also relates to a Layer 2 data frame forwarding method and a Layer 2 data extended frame analysis method. Ethernet Layer 2 extension technology is currently known as IEEE 802.1ad, IEEE 802.1 ah, and new extension technologies may emerge in the future.

among them,

1) The method of mapping the relevant fields in the packet format of the Ethernet Layer 2 extension technology to the service and the user is a pointer to the one defined in the Ethernet Layer 2 extension technology message that is not fully used or has been used as a single field. Several fields, which re-arrange the definition of each bit in a single field, or a combination of several fields, or use a method that does not fully use the remaining numeric space to match it to the business identity and user identity.

2) The method of requesting a service means that the terminal device (CPE) acquires the request flag and the service id, and completes the process of mapping the service id and the user id mapping in the above mapping method together with the network device (CPE) (forming a complete extension) The second layer of data frames is transmitted to the routing device on the Ethernet line, and the routing device terminates the Layer 2 data frame (ie, the Ethernet encapsulation is removed), and the Layer 2 payload is sent according to the protocol of Layer 3 or higher. The routing device needs to log the header information + time stamp of the layer 2 extended frame, and send the log to the authentication and accounting authentication device periodically or in real time, and decompose the log record to complete the initial related authentication and accounting. Right function.

3) The service status update method refers to setting the flag bit to the update status and performing the same steps in the method for requesting the service, that is, the difference between the two is the difference of the flag bits: the flag bit in the request service is set to blue. Request, the flag in the business status update is set to 'update,;

4) The method of exiting the business, including the method of exiting the normal business and the method of exiting the abnormal business, wherein The normal service exit method refers to setting the flag bit to the exit state, and performing the same steps as the method for requesting the service, that is, the difference between the two is that the flag bit is different: the flag bit in the request service is set to 'request', The exiting service flag is set to 'exit'; the abnormal exit method means that the routing device checks the service status update timer, and when the timeout is found, the service is set as an abnormal exit event, and the original Layer 2 extended frame is The header information + time stamp is recorded, and the log is sent to the authentication and accounting authentication device periodically or in real time, and the log record is decomposed to complete the initial related authentication and accounting authentication function. In addition, the service and user integrated management system that utilizes the Ethernet Layer 2 extension technology of the present invention includes: a client device, a network device, an Ethernet, a routing device, and an authentication and accounting authentication device, wherein The system maps related fields in the Ethernet Layer 2 extended technology packet format to the service and the user, and one or several fields that are not fully used or used as a single field as defined in the Ethernet Layer 2 extended technology message. , re-arrange the bins in a single field, or combine several fields, or use the remaining numeric space that is not fully used to match the business ID and user ID. Among them, Ethernet Layer 2 extension technology includes IEEE 802. lad, IEEE 802.1a.

In addition, in the request service of the system, the terminal device acquires the request flag and the service id, and completes the process of the service id and the user id mapping encapsulation in the mapping method together with the network device to form a complete extended a Layer 2 data frame is transmitted to the routing device in the uplink of the Ethernet line, and the routing device terminates the Layer 2 data frame to remove the Ethernet encapsulation, and sends the Layer 2 payload according to a protocol of three or more layers. The routing device needs to record the header information + time stamp of the layer 2 extended frame, and send the log to the authentication and accounting authentication device periodically or in real time, and decompose the log record to complete the initial correlation. Authentication and accounting authentication function.

Further, in the service status update of the system, the flag bit is set to the update status, and the same action as the request service is performed, and the service status update is transmitted by the terminal device in a configurable fixed period. '

In addition, the exiting service of the system includes a normal service exit and an abnormal service exit, wherein the normal service exit is to set the flag bit to the exit state, and perform the same action as the request service; The routing device checks the service status update timer. When the timeout is found, the service is set to be an abnormal exit event, and the header information of the original Layer 2 extended frame + timestamp is recorded, and the log is sent to the authentication meter periodically or in real time. The fee authentication device, which decomposes the log records, completes the initial related authentication and accounting authentication function. Compared with the current method, the present invention has the following advantages: (1) The service identifier and the user identifier are mapped with related fields in the Ethernet Layer 2 extension technology, and the Layer 2 information is used, which has features that are difficult to forge;

(2) Using the two-layer technology to achieve effective isolation and identification of services and users, which is simple and convenient to implement and compatible with existing technologies. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram showing a business system entity connection diagram of a service and user integrated management method using an Ethernet Layer 2 extension technology according to the present invention.

2 is a service and user integrated management method using the Ethernet Layer 2 extension technology of the present invention, and an 802.1ad packet format used in the system. DETAILED DESCRIPTION OF THE INVENTION The present invention will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a connection diagram of a service system entity of a service and user integrated management method using an Ethernet Layer 2 extension technology according to the present invention. As shown in FIG. 1, the service system of the method of the present invention includes: a client equipment (CPE), a network equipment (NPE), a routing device (Router), and an authentication and accounting authentication device (AAA server).

The service and user integrated management method using the Ethernet Layer 2 extension technology of the present invention specifically includes the following methods: 1) A method for mapping related fields in a packet format of an Ethernet Layer 2 extension technology to a service and a user, and 2) requesting a service Method, 3) business status update method and 4) method of terminating the business. It also involves a Layer 2 data frame forwarding method and a Layer 2 data extension frame analysis method. Among them, the Ethernet Layer 2 extension technology is known as IEEE 802.1ad and IEEE 802.1 ah, and new expansion technologies may appear in the future.

The method of mapping the relevant fields in the packet format of the Ethernet Layer 2 extension technology to the service and the user refers to one or several fields defined in the Ethernet Layer 2 extension technology packet, which is not completely used at present, or It has been used as a single field. In the present invention, each binary bit in a single field is rearranged, or several fields are used in combination, or a method of matching the service identifier and the user identifier with a remaining numeric space that is not fully used is used.

2) The method of requesting the service, the terminal (user end) device (CPE) acquires the request flag and the service id, and completes the process of mapping the service id and the user id mapping in the above mapping method together with the network end device (NPE) ( Forming a complete extended Layer 2 data frame) and passing it on the Ethernet line to the routing device. The routing device terminates the Layer 2 data frame (ie, removes the Ethernet encapsulation), and sends the Layer 2 payload according to the protocol of Layer 3 or higher; the routing device needs to record the header information of the Layer 2 extended frame + the timestamp log. And sending the log to the authentication and accounting authentication device periodically or in real time, and decomposing the log record to complete the initial related authentication and accounting authentication function.

3) The service status update method refers to setting the flag bit to the update status and performing the same steps in the method for requesting the service, that is, the difference between the two is the difference of the flag bits: the flag bit in the request service is set to ' Request ', the flag in the business status update is set to 'update';

4) A method for exiting a service, including a method for exiting a normal service and a method for exiting an abnormal service, wherein the method for exiting the normal service refers to setting a flag bit to an exit state, and performing the same steps as the method for requesting a service, That is, the difference between the two is the difference of the flag bits: the flag in the request service is set to 'request', and the flag in the exit service is set to exit '; the abnormal exit method means that the routing device checks the service status update timing. If the timeout is found, the service is set to be an abnormal exit event, and the header information of the original Layer 2 extended frame + timestamp is recorded, and the log is sent to the authentication and accounting authentication device periodically or in real time, and the log is decomposed by the log. Record, complete the initial related authentication and accounting authentication function. The present invention provides a business and user integrated management method and system using Ethernet Layer 2 extension technology in the following with reference to the accompanying drawings and specific embodiments.

Example

Combined with the 802.1ad Layer 2 extension technology, the business and user integrated management method and system using the Ethernet Layer 2 extension technology are described.

2 is a packet format of an 802.1ad used in the service and user integrated management method using the Ethernet Layer 2 extension technology of the present invention. 802.1ad (also known as Q-in-Q) is mainly used to expand the number of VLANs. It adds an 802.1Q tag to the original 802.1Q packet to increase the number of VLANs to 4K. *4K, with the development of metro Ethernet and the requirements of operators' refined operation, Q-in-Q's double-layer label has further usage scenarios. As shown in Table 1 below, its inner and outer labels can represent Different information, such as the inner label represents the user, and the outer label represents the service. In addition, the Q-in-Q message carries the two-layer tag through the carrier network, and the inner tag is transparently transmitted. It is also a simple and practical VPN. Technology, so it can be used as an extension of the core MPLS VPN in the Metro Ethernet VPN, eventually forming an end-to-end VPN technology. In this embodiment, it is used for the management of users and services. At the same time, we represent the service with the inner label and the outer label represents the user.

Table 1: Double-layer VLAN mapping service id and user id

The method of the invention is embodied as:

I. Related fields in the packet format of the Ethernet Layer 2 extension technology are mapped to services and users.

In this embodiment, the 12 bits of the inner VLAN ID are redefined as follows: 髙 2 bits represent service operations (01 means service request, 10 means service status update, 11 means service exits normally, 00 means service exits abnormally), last 10 bits Represents the service identifier, and its mapping relationship is shown in Table 2 below. Use the outer VLAN ID as the user ID. (Here, you can also define business operations by extending the ETHERTYPE definition, but be careful not to conflict with existing standards.) Continue the following steps under such redefinition and usage:

Table 2: Mapping of inner VLAN IDs to business operations and service identifiers

Second, request business

(1) Before the user uses the service, the service id is obtained from the service portal. (Note: The planning and setting constraints of the service id can be formulated according to the service operation of the operator, and are not used as the content of this embodiment. It is assumed here that such planning and design Must already exist);

(2) The user initiates a service use request, carrying the service id (in the IP payload);

(3) The CPE obtains the service id;

(4) The CPE device uses (service id 1 0x100) as the inner VLAN id, and the other parameter content of the service request is used as the layer 2 payload, and is encapsulated into a layer 2 frame and sent;

(5) The NPE device adds the outer VLAN to the port sent by the CPE device and forwards it to the routing device (Router).

(6) The routing device terminates the double-layer VLAN and logs the double-layer VLAN (including the outer VLAN id, the inner VLAN id, and the request parameters), and the log is sent to the AAA device.

(7) The AAA device analyzes the double-layer VLAN information to obtain the user id, service id, parameters, and start time.

NOTE: CPE refers to the user-side device, and NPE refers to the network-side device.

Third, business status updates and business abnormal exit

(1) The CPE device (service id | 0χ200) is used as the inner VLAN id, and is encapsulated into a layer 2 frame and sent; (2) The NPE device sends the outer VLAN according to the port sent by the CPE device, and the device forwards it to the routing device (Router).

(3) The routing device terminates the dual-layer VLAN and performs a preliminary analysis on the dual-layer VLAN. When the service status is updated, the service user timer is reset.

(4) If the service status update packet is not received for a long time (that is, the timeout period), it is determined that the service is abnormally exited, and the routing device performs the termination log of the VLAN and sends it to the AAA device.

Fourth, withdraw from the business

(1) When the user stops using the service, the user sends an exit service request and carries the service id;

(2) The CPE device (service id 1 0x300) is used as the inner VLAN id, and is encapsulated into a layer 2 frame and sent;

(3) The NPE device puts the outer VLAN according to the port sent by the CPE device and forwards it to the routing device (Router).

(4) The routing device terminates the double-layer VLAN and logs the double-layer VLAN (including the outer VLAN id, the inner VLAN id, and the request parameters), and the log is sent to the AAA device.

(5) The AAA device analyzes the double-layer VLAN information to obtain the user id, service id, parameters, and termination time.

Five, data forwarding

The routing device encapsulates the double-layer VLAN according to the received service data flow, and performs Layer 2 data transmission. This is standard content and is supported by devices that support Q-in-Q.

Sixth, business billing

The AAA device collects and analyzes the original data according to the log information provided in Parts 2, 3, and 4, and performs integrated management of users and services according to relevant policies.

In addition, this embodiment is described by the 802.1ad Ethernet Layer 2 extension technology, and the same method is also applicable to the Layer 2 extension technology such as 802.1ah.

Claims

right

A service and user integrated management method using the Ethernet Layer 2 extension technology, which is characterized in that: 1) a method for mapping related fields in a packet format of an Ethernet Layer 2 extension technology to a service and a user, 2) Method for requesting a service, 3) method for updating a business status, 4) method for terminating a service, wherein

1) The method of mapping the relevant fields in the packet format of the Ethernet Layer 2 extension technology to the service and the user is a pointer to the one defined in the Ethernet Layer 2 extension technology message that is not fully used or has been used as a single field. Several fields, which re-arrange the definition of each bit in a single field, or combine several fields, or use a method that does not fully use the remaining numeric space to match it to the business identity and user identity;

2) The method of requesting the service, the terminal device acquires the request flag and the service id, and completes the process of the service id and the user id mapping encapsulation in the mapping method together with the network device to form a complete extended layer 2 data frame. And the Ethernet device is forwarded to the routing device, and the routing device terminates the Layer 2 data frame to remove the Ethernet encapsulation, and sends the Layer 2 payload according to the protocol of Layer 3 or higher. The routing device needs to use the Layer 2 layer. Extending the header information of the frame + the timestamp log, and sending the log to the authentication and accounting authentication device periodically or in real time, and decomposing the log record to complete the initial related authentication and accounting authentication function;

3) The service status update method refers to setting the flag bit to the update status and executing the same steps in the method of requesting the service;

4) The method for exiting the service, including the method for exiting the normal service and the method for exiting the abnormal service, wherein the method for exiting the normal service refers to setting the flag bit to the exit state, and performing the same steps as the method for requesting the service; The abnormal exit method means that the routing device checks the service status update timer, finds that the timeout, sets the service as an abnormal exit event, and logs the header information of the original Layer 2 extended frame + time stamp, and The log is sent to the authentication and accounting authentication device periodically or in real time, and the log records are decomposed to complete the initial related authentication and accounting authentication function.

The service and user integrated management method using the Ethernet Layer 2 extension technology according to claim 1, wherein the status update in the service status update method is performed by using the terminal device in a configurable fixed period manner. send.

The service and user integrated management method using the Ethernet Layer 2 extension technology according to claim 1 or 2, wherein the Ethernet Layer 2 extension technology comprises IEEE 802.1ad, IEEE 802.1 a o

The service and user integrated management method using the Ethernet layer 2 extension technology according to claim 3, wherein the Ethernet two-layer extension technology is related to the field in the IEEE 802.1ad packet format. In the method of mapping to the service and the user, the 12 bits of the inner VLAN ID are redefined: the upper 2 bits represent the service operation, the last 10 bits represent the service identifier, and the outer VLAN ID is used as the user ID.

The service and user integrated management method using the Ethernet Layer 2 extension technology according to claim 3, wherein the method for requesting services by using the Ethernet Layer 2 extension technology IEEE 802.1ad is as follows The terminal device obtains the service id, and the terminal device uses the service id I 0x100 as the inner VLAN id, and the other parameter content of the service request is used as the layer 2 payload, and is encapsulated into a layer 2 frame and sent, and the network end device is configured according to the terminal. The port sent by the device is tagged with the outer VLAN and passed up to the routing device.

The service and user integrated management method using the Ethernet Layer 2 extension technology according to claim 3, wherein the service state update method and the abnormality of the IEEE 802.1ad using the Ethernet Layer 2 extension technology are utilized. In the method of the service exit, the terminal device encapsulates the service id I 0x200 as an inner VLAN id into a layer 2 frame, and sends the packet to the outer VLAN according to the port sent by the terminal device. The routing device is delivered to the routing device, and then the routing device terminates the dual-layer VLAN and performs a preliminary analysis on the dual-layer VLAN. If the service status is updated, the service user timer is reset. If the service status update message is not received for a long time. Then, it is determined that the service is abnormally exited, and the routing device performs the termination log of the VLAN, and sends the termination log to the authentication and accounting authentication device.

The service and user integrated management method using the Ethernet Layer 2 extension technology according to claim 3, wherein the user uses the Ethernet two-layer extension technology IEEE 802.1ad to exit the normal service, the user When the service is stopped, the service request is sent, and the service id is carried, and the terminal device encapsulates the service id | 0x300 as the inner VLAN id, and then sends the packet to the layer 2 frame, and sends the packet to the network device according to the terminal device. The port is tagged with the outer VLAN and is forwarded to the routing device. The authentication and accounting authentication device analyzes the double-layer VLAN information to obtain the user id, service id, parameter, and termination time.

8. A service and user integrated management system that utilizes Ethernet Layer 2 extension technology, including: a client device, a network device, an Ethernet, a routing device, and an authentication and accounting authentication device, wherein the system The related fields in the packet format of the Ethernet Layer 2 extension technology are mapped to the service and the user. For the one or several fields defined in the Ethernet Layer 2 extension technology packet that are not fully used or used as a single field, the single field will be single. Each bit in the field is rearranged by definition, or several fields are used in conjunction, or the remaining numeric space that is not fully used is used to match it to the service identifier and user ID;

In the request service of the system, the terminal device acquires a request flag and a service id, and completes the process of the service id and the user id mapping encapsulation in the mapping method together with the network device to form a complete And extending the Layer 2 data frame to the routing device, and the routing device terminates the Layer 2 data frame to remove the Ethernet encapsulation, and the Layer 2 payload is more than three layers. The protocol is sent, the routing device needs to record the header information of the layer 2 extended frame + the time stamp, and send the log to the authentication and accounting authentication device periodically or in real time, and the log record is decomposed and the initial is completed. Related authentication and accounting authentication function;

In the service status update of the system, the flag bit is set to the update status, and the same action as the request service is performed;

The exiting service of the system includes a normal service exit and an abnormal service exit, where the normal service exit is to set the flag bit to the exit state, and perform the same action as the request service; the abnormal exit refers to the route The device checks the service status update timer. When the timeout is found, the service is set to be an abnormal exit event, and the header information of the original Layer 2 extended frame + time stamp is recorded, and the log is sent to the authentication and accounting in a regular or real time. The right device, which decomposes the log record, completes the initial related authentication and accounting authentication function.

9. The service and user integrated management system using the Ethernet Layer 2 extension technology according to claim 8, wherein the service status update is performed by using the terminal device in a configurable fixed period.

The service and user integrated management system using the Ethernet Layer 2 extension technology according to claim 8 or 9, wherein the Ethernet Layer 2 extension technology comprises IEEE 802.1ad and IEEE 802.1a.