WO2011023016A1 - 一种层次化控制访问组播组的方法和装置 - Google Patents

一种层次化控制访问组播组的方法和装置 Download PDF

Info

Publication number
WO2011023016A1
WO2011023016A1 PCT/CN2010/073662 CN2010073662W WO2011023016A1 WO 2011023016 A1 WO2011023016 A1 WO 2011023016A1 CN 2010073662 W CN2010073662 W CN 2010073662W WO 2011023016 A1 WO2011023016 A1 WO 2011023016A1
Authority
WO
WIPO (PCT)
Prior art keywords
control
control layer
access
privilege
user
Prior art date
Application number
PCT/CN2010/073662
Other languages
English (en)
French (fr)
Inventor
刘爽
郁聪
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US13/384,321 priority Critical patent/US20120140771A1/en
Priority to EP10811176.6A priority patent/EP2448264A4/en
Publication of WO2011023016A1 publication Critical patent/WO2011023016A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/16—Analogue secrecy systems; Analogue subscription systems
    • H04N7/173—Analogue secrecy systems; Analogue subscription systems with two-way working, e.g. subscriber sending a programme selection signal
    • H04N7/17309—Transmission or handling of upstream communications
    • H04N7/17318—Direct or substantially direct transmission and handling of requests
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H04L12/185—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast with management of multicast group membership
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/21—Server components or server architectures
    • H04N21/222—Secondary servers, e.g. proxy server, cable television Head-end
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/239—Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests
    • H04N21/2393—Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests involving handling client requests
    • H04N21/2396—Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests involving handling client requests characterized by admission policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25866—Management of end-user data
    • H04N21/25875—Management of end-user data involving end-user authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/64—Addressing
    • H04N21/6405—Multicasting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/65—Transmission of management data between client and server
    • H04N21/658—Transmission by the client directed to the server
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2117—User registration
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2129—Authenticate client device independently of the user
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2145—Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H04L12/1886—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains

Definitions

  • the present invention relates to data communication technologies, and in particular, to a method and apparatus for hierarchically controlling access to a multicast group. Background technique
  • IPTV Internet Protocol
  • IP Internet Protocol
  • Step 101 The user terminal sends an Internet Group Management Protocol (IGMP) to join (Join) to request a multicast program.
  • IGMP Internet Group Management Protocol
  • the DSLAM is a central office device of various digital subscriber line (DSL) systems, belonging to the last mile access device, and the function of the DSLAM is to accept all DSL lines and aggregate traffic, which is equivalent to A Layer 2 switch.
  • the user terminal includes a personal computer (PC) or a "TV equipped with an IP set top box" and the like.
  • Step 102 The DSLAM receives the IGMP Join message sent by the user equipment, and forwards the message to the access device.
  • Step 103 The access device receives the IGMP Join message and queries the permission control table to perform access authentication on the user requesting access. If the user requesting access passes the access authentication, step 104 is performed; If the user does not pass the access authentication, step 105 is performed;
  • the privilege control table is generated by the IPTV system of the access device, and mainly includes: The port number of the switch, the access rights of the channel, the number of currently on-demand channels, and the current online user information.
  • the rights control for the user includes:
  • Step 104 The access device sends a multicast stream to the user.
  • Step 105 The access device rejects the access request of the user.
  • the main purpose of the present invention is to provide a method and apparatus for hierarchically controlling access to a multicast group, which can perform multi-level and flexible control on a multicast group that is requested by a user to improve the quality of the multicast group.
  • the present invention discloses a method for hierarchically controlling access to a multicast group, dividing the access control layer of the access multicast group, and setting a control rule for each rights control layer; the method includes: according to the set The control rule controls the accessing user at the current privilege control layer. If the user does not pass the privilege control, the user is denied access to the multicast group requested by the user; if the user passes the privilege control, the next privilege control layer is entered. Right to visit users Limit control, until it is judged according to the set authority control layer whether the user has access rights.
  • the privilege control layer that divides the access multicast group includes: a privilege control layer that accesses the multicast group from the whole to the local according to the logical relationship of the interface; and/or, according to different user privilege levels, from high to low
  • the hierarchy controls the access control layer of the access multicast group.
  • the privilege control layer that divides the access multicast group is: the privilege control layer that accesses the multicast group from the whole to the local according to the logical relationship of the interface, and includes: a first privilege control layer, a second privilege control layer, a third privilege control layer and a fourth privilege control layer; wherein, the first privilege control layer is an entire access device; the second privilege control layer is an interface of the access device; and the third privilege control layer is an interface and virtual access device
  • the local area network VLAN; the fourth privilege control layer is the interface of the access device, the VLAN and the internet protocol IP address; and/or, according to different user privilege levels, the access control layer of the access group is divided into high to low levels
  • the method includes: a first privilege control layer for limiting the bandwidth that the current user can occupy; a second privilege control layer for performing privilege control on the user-on-demand multicast group; and a number of multicast streams used for accessing the user
  • the third privilege control layer that performs the restriction includes: a first privilege control layer for limiting
  • the setting the control rule for each privilege control layer includes: setting the number of bandwidths that the privilege control layer can allow as the control rule of the privilege control layer; and/or, limiting the number of multicast groups that the user can join. To control user access to multicast groups.
  • the access control user is controlled by the current rights control layer as: controlling the user rights of the current rights control layer for the number of bandwidths allowed by each rights control layer, in the current rights control If the bandwidth occupied by the user-on-demand multicast group received by the layer plus the bandwidth already occupied by the current privilege control layer does not exceed the bandwidth limit value accommodated by the current privilege control layer, the control proceeds to the next level; and/or, Each privilege control layer allows the number of multicast streams that the user joins to control the access rights to the multicast group. The number of user-on-demand multicast streams received at the current privilege control layer plus the multicast stream that is ordered on the current layer.
  • the method further includes: setting a control policy, and determining, according to the set control policy, whether to enter the privilege control of the next privilege control layer, if entering the next privilege
  • the control layer controls the accessing user at the next privilege control layer; if the user is no longer subject to further privilege control, the user is allowed access.
  • the determining, according to the set control policy, whether to enter the next rights control layer, the rights control includes: traversing all the rights control layers until reaching the top level of the rights control layer; or, for each rights control layer
  • the control rule sets a value representing the priority level. The higher the value, the higher the priority, and the hierarchical control from the low priority, until the priority of the current privilege control layer reaches the next privilege control.
  • the permission control of the next permission control layer is stopped.
  • the present invention provides a device for hierarchically controlling access to a multicast group, including: a dividing module, a control module, and a triggering module; wherein, the dividing module is configured to divide the access control layer of the access multicast group, and Each privilege control layer sets a control rule; a control module, configured to perform privilege control on the multicast group requested by the user according to the control rule set by the dividing module; and a triggering module, configured to: according to the control module, the multicast group The result of the permission control triggers the permission control of the next permission control layer.
  • the foregoing apparatus further includes: a decision module, configured to set a control policy, and determine, according to the control policy, whether to perform permission control on a next permission control layer of the multicast group accessed by the user, and to enter the next permission control
  • the trigger module is notified when the layer's authority is controlled.
  • the dividing module is specifically configured to: access the access control layer of the multicast group from the whole to the local according to the logical relationship of the interface; or divide the access multicast group according to different user privilege levels from high to low And the privilege control layer; and/or, the dividing module is specifically configured to: set a number of bandwidths that the privilege control layer can allow as a control rule of the privilege control layer; and/or, limit a multicast group that the user can join The number controls the user's access rights to the multicast group.
  • the determining module is specifically configured to: traverse all the rights control layers until reaching a top level of the rights control layer; or, set a value indicating a priority level for each of the rights control layer control rules, The higher the value indicates the higher the priority, and the hierarchical control is started from the low priority.
  • the priority of the current privilege control layer reaches the value of stopping the access of the next privilege control layer, the next privilege control is stopped. Layer access control.
  • the access device of the present invention hierarchically divides a multicast group, and controls the multicast group according to the current privilege control layer and the configured control rule, if the privilege control is performed through the current privilege control layer. Then, you need to enter the next privilege control layer of the current privilege control layer until all the privilege control layers are set to achieve hierarchical control of the multicast group. It can be seen that the control of the multicast group of the user-on-demand multicast group is more detailed, and the operator can control the multicast group accessed by the user through multiple privilege control layers, and comprehensively consider various restrictions from the whole to the local to provide Better service, thus improving competitiveness.
  • the device adopted by the present invention is relatively simple and easy to implement.
  • the technical solution described in the embodiment of the present invention uses a standard from the whole to the local to divide the access control layer of the access group, and the control rule of each authority control layer may be Using the same strategy, different control strategies can be used to achieve flexible control, which breaks the limitations of the traditional single control method and satisfies the need for multi-level control of user-on-demand multicast groups, thus providing higher Quality and clear video programs, for the current IPTV business, such as Internet video live broadcast, long-distance true video on demand, program source production, high-definition digital program broadcast live broadcast, etc., have a strong advantage.
  • Figure 1 is a schematic diagram of an implementation process of an IPTV service
  • FIG. 2 is a schematic flowchart of a method for hierarchically controlling access to a multicast group according to the present invention
  • FIG. 3 is a schematic diagram of a control authority hierarchy according to the present invention.
  • FIG. 4 is a schematic structural diagram of an apparatus for hierarchically controlling access to a multicast group according to the present invention.
  • the basic idea of the present invention is to: implement a hierarchical control access group by dividing the rights control layer of the user accessing the multicast group and configuring the control rule for each rights control layer to perform authority control on the user accessing the multicast group. Broadcast group.
  • the division of the access control level of the multicast group is Different, generally according to the logical relationship of the interface from the overall to the local standard, step by step to further deepen the hierarchy of multicast group access control; also according to different user permission levels, from high to low level, It mainly includes but is not limited to the following two ways:
  • the access control hierarchy of the access group is divided from the whole to the local.
  • the following describes the configuration of the control rules of each privilege control layer and the control of the packet, as shown in Figure 3:
  • the first privilege control layer performs access control on the multicast group requested by the user from the access device as a whole;
  • the access device is a switch
  • the interfaces of the switch are occupied or reach the maximum load
  • the multicast group requested by the user is rejected.
  • the second privilege control layer performs privilege control on the multicast group from an interface in the access device; wherein the interface may be a 100 Mbps Ethernet interface, a GigaEthernet interface, or an asynchronous transmission Mode (ATM, Asynchronous Transfer Mode) interface, etc.
  • the link aggregation control protocol can be aggregated through these actual physical interfaces.
  • LACP Link Aggregation Control Protocol
  • the third privilege control layer based on the interface of the second privilege control layer in the access device, configured VLAN trunk control;
  • the VLAN Trunk is an interface that enables hosts in the same VLAN connected to different switches to communicate with each other. It can be seen that the real physical interface or the virtual interface can belong to multiple VLANs, and the VLAN to which the packet belongs can be determined according to the VLAN tag of the packet received by the interface.
  • the fourth privilege control layer Based on the VLAN Trunk control configured on the interface of the access device, the IP address limit is added.
  • the bandwidth occupied by the access device is 240M.
  • the bandwidth of the first layer is 240M.
  • the bandwidth occupied by the multicast group received by the access device plus the bandwidth already occupied by the access device does not exceed.
  • the control of the next level is entered; and the limit value of the bandwidth on the interface is not necessarily the bandwidth limit value of the access device, divided by the number of interfaces on the access device, according to Set the actual running status of each interface of the access device. If the bandwidth allowed by the interface is 50M, the bandwidth of the multicast group plus the bandwidth occupied by the current interface does not exceed 50M. Then, the next level of control is entered. This method looks for the control rules of all the levels below, and will not go into details here.
  • the access control layer of the access group is divided according to the logical relationship of the interface, it is not limited to the above four levels, and the permission control level may be increased or decreased according to the specific actual situation.
  • the first privilege control layer is configured to limit the bandwidth that the current user can occupy;
  • the second privilege control layer is configured to perform authority control on the user-on-demand multicast group;
  • the third privilege control layer is used to limit the number of multicast streams accessed by the user.
  • the foregoing restrictions on the user bandwidth, the rights of the on-demand multicast group, and the number of multicast streams to be accessed may be configured in different rights control layers, or may be configured on the same rights control layer.
  • FIG. 2 it is a schematic flowchart of a method for hierarchically controlling access to a multicast group according to the present invention. The main steps are as follows:
  • Step 201 The access device divides the access control layer of the access multicast group.
  • the entire access device is used as the first privilege control layer
  • the interface is the second privilege control layer
  • the interface + VLAN is the third privilege control layer
  • interface + VLAN + IP is the fourth privilege control layer.
  • Step 202 Set a control rule for each privilege control layer
  • the control rules of each level can be different. You can control the access rights of the multicast group for the number of multicast streams that the user can join for each level.
  • the configuration commands for the specific control rules are as follows: For the first privilege control layer that controls the access control of the device, configure the privilege control rule in the global mode, such as the command: iptv service start, indicating that the first privilege control layer starts IPTV; the control rule of the first privilege control layer may Set to channel mode, such as iptv control channel and iptv channel id-list 0-5 permit, this is the most basic permission control rule, there are other modes, such as package mode; the first access control layer can also access the user.
  • the number of multicast streams is limited. For example, the command: iptv max-stream 2400 indicates that the number of multicast streams in the first privilege control layer is limited to 2400.
  • the first privilege control layer can also perform the bandwidth occupied by the user.
  • Restrictions such as the command: iptv max-bandwidth 240, indicates that the bandwidth of the first privilege control layer is limited to 240M.
  • the command may be configured according to the permission control rule, or may be configured simultaneously with the permission control rule.
  • the command format of the privilege control rule is basically the same as that of the first privilege control layer, except that the configuration command is in the interface mode, and the maximum multicast stream that can be accessed at this time is The number and the number of occupied bandwidths must be changed. According to the actual needs of the interface, you can refer to the examples given in the above control rules for configuration.
  • the command format of the privilege control rule is in the interface mode, and the VLAN restriction is added, such as: iptv VLAN 10 service start; iptv VLAN 10 control channel; iptv VLAN 10 Channel id-list 0-5 permit; iptv VLAN 10 max-stream 10.
  • the command format needs to add VLAN and IP, such as: iptv VLAN 10 ip 10.1.1.1 service start; iptv VLAN 10 control channel; Iptv VLAN 10 channel id-list 0 deney.
  • VLAN and IP such as: iptv VLAN 10 ip 10.1.1.1 service start; iptv VLAN 10 control channel; Iptv VLAN 10 channel id-list 0 deney.
  • the channel refusal permission can also be set for a specific user.
  • the specific bandwidth and multicast can be set for a specific user. The limit on the number of streams.
  • Step 203 According to the set control rule, the access device performs rights control on the visiting user at the current rights control layer. If the user does not pass the rights control, step 204 is performed; If the user is controlled by rights, step 205 is performed;
  • the user sends an IGMP Join message of the multicast group to the access device.
  • the access device After receiving the user's request message, the access device generates the access control device according to the access control layer of the access multicast group.
  • Permission control table extracting user permission control parameters, such as the channel requested by the user requesting access, access rights, occupied bandwidth, number of multicast streams accessed, port number of the switch, access rights of the channel, currently on-demand The number of channels, as well as the current online user information, etc., initiates permission control for the user at the current authority control layer. If you control the hierarchy through the current permissions, you need to go to the next privilege control layer of the current privilege control layer until you have completed all the privilege control layers.
  • the access device For example: Suppose there are 24 interfaces on the access device, and the number of multicast streams that can be accessed by the whole device is 2,400. Then, in the first privilege control layer, when the number of multicast streams received by the access device plus the number of multicast streams that the entire device has accessed is less than 2400, the second privilege control layer is accessed; The device sets the number of multicast streams that each interface accesses to 100. When the number of multicast streams received by the interface plus the number of multicast streams that have been accessed by the interface is less than 100, the device performs the third permission.
  • Control layer control assuming that the interface belongs to two trunk VLANs, then the number of multicast streams in the third privilege control layer one interface + VLAN level is limited to 50, when the interface receives the VLAN If the number of multicast streams in the VLAN where the interface is located is less than 50, the fourth privilege control layer is controlled. Assume that the IP address of a VLAN in the interface is accessible. The number of the number of multicast streams in the fourth privilege control layer - interface + VLAN + IP is limited to 10, when the number of multicast streams accessed by this level does not exceed the limit value of 10, Just explain this Through user authentication, allowing the user to the requested multicast group it has demand.
  • Step 204 The access device rejects the user's access and ends the current process.
  • Step 205 The access device determines, according to the set control policy, whether to enter the permission control of the next rights control layer. If the next rights control layer is entered, the process returns to step 203; otherwise, If there is no need to further control the user, step 206 is performed;
  • the control policy is set according to the established permission control layer, such as different division manners. For example: By controlling the access rights of the visiting users by dividing the different permission control layers, and in order to further refine the permission control, each permission control layer needs to be executed, then whether to judge the basis of the next permission control layer is: Whether to traverse Complete all permission control layers until the permission control layer reaches the top level.
  • the control policy is set according to the priority of the control rule of each rights control layer that is formulated.
  • each authority control layer can adopt different control rules.
  • a value representing the priority level is set, for example, the higher value represents The higher the priority, the lower the priority from the bottom, that is, the lower the priority, until the priority of the current privilege control layer reaches the value of stopping the access of the next privilege control layer, the privilege control of the next privilege control layer is stopped.
  • the current privilege control layer control rules to decide whether to reject the user's request or accept the user's request. It should be pointed out that the judgment basis in actual application is not limited to the above two.
  • the access device performs the authority control judgment according to the set control policy, until it is determined according to the set authority control layer, the control rule, the control policy, and the like whether the user has the access authority.
  • Step 206 The access device allows access by the user.
  • the technical solution described in the embodiment of the present invention divides the authority control layer from the whole to the local to control the rights of the user to access the multicast group, and adopts different control policies and hierarchical division according to different requirements, so that the operator can Providing more high-quality, clear video programs has a strong advantage for the current IPTV business.
  • the present invention further provides a device for hierarchically controlling access to a multicast group.
  • the structure of the device is as follows:
  • a dividing module 401 configured to divide the access control layer of the access multicast group, and set a control rule for each permission control layer
  • the control module 402 is configured to perform permission control on the multicast group requested by the user according to the control rule set by the dividing module 401;
  • the triggering module 403 is configured to trigger the permission control of the next privilege control layer according to the privilege control result of the control module 402 on the multicast group.
  • the device further includes: a decision module 404: configured to set a control policy, and determine, according to the control policy, whether to perform permission control on a next access control layer for the multicast group accessed by the user, and to enter the next access control
  • the trigger module 403 is notified when the layer's authority is controlled.
  • the dividing module 401 is specifically configured to: access the access control layer of the multicast group from the whole to the local according to the logical relationship of the interface; or divide the access multicast according to different user privilege levels from high to low The permission control layer of the group.
  • the dividing module 401 is specifically configured to: set a number of bandwidths allowed by the privilege control layer to a control rule of the privilege control layer; and/or limit a number of multicast groups that the user can join to control user-to-multicast Group access rights.
  • the decision module 404 is specifically configured to: traverse all the rights control layers until reaching the top level of the rights control layer; or, set a value representing the priority level for each control rule of the rights control layer, the value The higher the higher the priority, and the lower the priority, the lower the priority, until the priority of the current privilege control layer reaches the value of the next privilege control layer access, the next privilege control layer is stopped. control.
  • the device used in the present invention is relatively simple and easy to implement, and the technical solution described in the embodiment of the present invention uses the standard from the whole to the local to divide the user's access to the multicast group.
  • Control level the same control strategy can be adopted for each level of authority control rules, or different control strategies can be adopted for flexible control, which breaks the limitations of the traditional single control method and can meet multiple levels of control requirements.
  • IPTV-developed services such as Internet video live broadcast, long-distance true video on demand, program source production, high-definition digital program broadcast live broadcast, etc., have a strong advantage.

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Databases & Information Systems (AREA)
  • Computer Graphics (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

一种层次化控制访问组播组的方法和装置 技术领域
本发明涉及数据通信技术， 特别是涉及一种层次化控制访问组播组的 方法和装置。 背景技术
交互式网络电视（IPTV )是由运营商基于宽带基础推出的， 利用网际 协议（IP )宽带网络， 集互联网、 多媒体、 通信等多种技术于一体， 向用户 提供直播电视、视频点播、上网浏览等多种交互式服务的业务。其中， IPTV 的实现流程可参照图 1所示：
步驟 101 , 用户终端发送因特网群组管理协议（IGMP, Internet Group Management Protocol )加入（Join )才艮文， 请求组播节目；
当用户终端请求组播节目时， 向数字用户线路接入复用器（ DSLAM, Digital Subscriber Line Access Multiplexer
Figure imgf000003_0001
Join报文。所述 DSLAM 是各种数字用户线 （DSL, Digital Subscriber Line ) 系统的局端设备， 属于 最后一公里 （the last mile )接入设备， DSLAM的功能是接纳所有的 DSL线 路， 汇聚流量， 相当于一个二层交换机。 其中， 所述用户终端包括个人计 算机（PC )或 "配有 IP机顶盒的电视" 等形式。
步驟 102, DSLAM接收用户终端发送的 IGMP Join报文， 并转发给接入 设备；
步驟 103 , 接入设备接收所述 IGMP Join报文并查询权限控制表， 对请 求接入的用户进行接入认证， 如果请求接入的用户通过接入认证， 则执行 步驟 104; 如果请求接入的用户没有通过接入认证， 则执行步驟 105;
其中， 所述权限控制表是由接入设备的 IPTV系统产生的， 主要包括： 交换机的端口号、 频道的访问权限、 当前已点播频道数目、 以及当前在线 的用户信息等。 在本步驟中， 对用户的权限控制包括：
1 )对用户加入的组播组的权限控制， 所述权限控制包括预览、 浏览、 查询、 拒绝权限；
2 )对当前用户所能加入的组播组个数的限制；
3 )对当前用户所能占用的带宽的限制；
4 )对于预览用户， 还包括对预览间隔和预览次数的限制。
步驟 104 , 接入设备向所述用户发送组播流。
步驟 105 , 接入设备拒绝所述用户的访问请求。
由上述可见， 现有技术中对于用户的权限控制仅仅是一次， 并且一般 限制在一个接口或者虚拟局域网 （VLAN ) 内， 然而， 对于现在迅速发展的 IP网络， 由于运营商需要提供更加高质量的服务，那么目前仅在一个层面上 对用户权限进行控制是不能提高服务质量的， 因此， 需要从多个方面对用 户权限进行层次化控制。
目前， 在 IPTV的用户接入控制中， 都是采用单一的权限控制层面， 还 没有对用户接入进行层次化控制。 发明内容
有鉴于此， 本发明的主要目的在于提供一种层次化控制访问组播组的 方法和装置， 能对用户点播的组播组进行多层次、 灵活地控制， 以提高组 播组的质量。
为达到上述目的， 本发明公开了一种层次化控制访问组播组的方法， 划分访问组播组的权限控制层， 并为每个权限控制层设置控制规则； 该方 法包括： 根据所设置的控制规则， 在当前权限控制层对来访用户进行权限 控制， 如果所述用户没有通过权限控制， 则拒绝用户访问其请求的组播组； 如果所述用户通过权限控制， 则进入下一个权限控制层对来访用户进行权 限控制， 直到根据所设置的权限控制层判断得出用户是否具有访问权限。 其中， 所述划分访问组播组的权限控制层包括： 按照接口的逻辑关系 从整体到局部划分访问组播组的权限控制层； 和 /或， 根据不同的用户权限 级别， 由高到低的层次来划分访问组播组的权限控制层。
上述方法中， 所述划分访问组播组的权限控制层为： 按照接口的逻辑 关系从整体到局部划分访问组播组的权限控制层， 包括： 第一权限控制层、 第二权限控制层、 第三权限控制层和第四权限控制层； 其中， 第一权限控 制层为整个接入设备； 第二权限控制层为接入设备的接口； 第三权限控制 层为接入设备的接口和虚拟局域网 VLAN;第四权限控制层为接入设备的接 口、 VLAN和网际协议 IP地址； 和 /或， 根据不同的用户权限级别， 由高到 低的层次来划分访问组播组的权限控制层， 包括： 用于对当前用户所能占 用的带宽进行限制的第一权限控制层； 用于对用户点播组播组进行权限控 制的第二权限控制层； 用于对用户访问的组播流的数目进行限制的第三权 限控制层： 。
其中， 所述为每个权限控制层设置控制规则包括： 将权限控制层所能 允许的带宽数目设置为该权限控制层的控制规则； 和 /或， 限制用户所能加 入的组播组个数来控制用户对组播组的访问权限。
上述方法中， 所述根据所设置的控制规则， 在当前权限控制层对来访 用户进行权限控制为： 针对每个权限控制层允许的带宽数目来控制当前权 限控制层的用户权限， 在当前权限控制层收到的用户点播组播组占用的带 宽加上当前权限控制层上已经占用的带宽没有超过当前权限控制层所容纳 的带宽限制值时， 则进入下一个层次的控制； 和 /或， 针对每个权限控制层 允许用户加入的组播流个数来控制访问组播组的权限， 在当前权限控制层 上收到的用户点播组播流个数加上当前层上已点播的组播流个数没有超过 当前权限控制层组播流个数限制值时， 则进入下一个层次的控制。 其中， 所述进入下一个权限控制层对来访用户进行权限控制之前， 该 方法还包括： 设置控制策略， 并根据所设置控制策略判断是否进入下一个 权限控制层的权限控制， 如果进入下一个权限控制层， 则在下一个权限控 制层对来访用户进行权限控制； 如果不再对用户作进一步的权限控制， 则 允许用户的访问。
上述方法中， 所述根据所设置的控制策略判断是否进入下一个权限控 制层的权限控制包括： 遍历完所有的权限控制层， 直到达到权限控制层的 最顶层； 或者， 为每个权限控制层的控制规则设定一个代表优先级高低的 数值， 所述数值越高代表优先级越高， 并从优先级低的开始进行层次控制， 直到当前权限控制层的优先级达到停止进行下一个权限控制层访问的数值 时， 便停止进行下一个权限控制层的权限控制。
为实现上述方法， 本发明提供一种层次化控制访问组播组的装置， 包 括： 划分模块、 控制模块、 触发模块； 其中， 划分模块， 用于划分访问组 播组的权限控制层， 并为每个权限控制层设置控制规则； 控制模块， 用于 根据所述划分模块设置的控制规则来对用户请求访问的组播组进行权限控 制； 触发模块， 用于根据所述控制模块对组播组的权限控制结果， 触发下 一个权限控制层的权限控制。
上述装置中， 还包括： 决策模块， 用于设置控制策略， 并根据所述控 制策略判断是否对用户访问的组播组进行下一个权限控制层的权限控制， 以及用于在进入下一个权限控制层的权限控制时通知所述触发模块。
其中， 所述划分模块具体用于： 按照接口的逻辑关系从整体到局部划 分访问组播组的权限控制层； 或者， 根据不同的用户权限级别， 由高到低 的层次来划分访问组播组的权限控制层； 和 /或， 所述划分模块具体用于： 将权限控制层所能允许的带宽数目设置为该权限控制层的控制规则；和 /或， 限制用户所能加入的组播组个数来控制用户对组播组的访问权限。 上述装置中， 所述决策模块具体用于： 遍历完所有的权限控制层， 直 到达到权限控制层的最顶层； 或者， 为每个权限控制层的控制规则设定一 个代表优先级高低的数值， 所述数值越高代表优先级越高， 并从优先级低 的开始进行层次控制， 直到当前权限控制层的优先级达到停止进行下一个 权限控制层访问的数值时， 便停止进行下一个权限控制层的权限控制。
由以上技术方案可以看出， 本发明的接入设备对组播组进行层次划分， 并根据当前权限控制层和所配置的控制规则对组播组进行控制， 如果通过 当前权限控制层的权限控制， 则需要进入到当前权限控制层的下一个权限 控制层， 直到完成设置的所有权限控制层， 以实现对组播组的层次化控制。 可见， 本发明对用户点播的组播组的权限控制更加细化， 运营商可通过多 个权限控制层来控制用户访问的组播组， 从整体到局部全面考虑各个方面 的限制条件， 以提供更加优质的服务， 从而提高竟争力。
另外， 本发明采用的装置比较简单， 易于实现， 同时本发明实施例所 述的技术方案采用从整体到局部的标准来划分访问组播组的权限控制层， 每个权限控制层的控制规则可以采用相同的策略， 也可以采用不同的控制 策略， 实现灵活控制， 打破了之前传统的单一控制方法的局限性， 满足了 对用户点播的组播组进行多层次控制的需求， 因而能够提供更加高质量、 清晰的视频节目， 对于现在 IPTV开展的业务， 如互联网视频直播、 远距离 真视频点播、 节目源制作、 高清数字节目转播直播等， 都有很强的优势。 附图说明
图 1为 IPTV业务的实现流程示意图；
图 2为本发明层次化控制访问组播组的方法流程示意图；
图 3为本发明控制权限层次的示意图；
图 4为本发明层次化控制访问组播组的装置结构示意图。 具体实施方式 本发明的基本思想在于： 通过划分用户访问组播组的权限控制层以及 为各权限控制层配置控制规则， 对访问组播组的用户进行权限控制， 从而 得以实现层次化控制访问组播组。
为使本发明上述目的、 特征和优点能够更加明显易懂， 下面结合附图 和具体实施例对本发明作进一步详细的说明。
在进行描述本发明对组播组进行层次化控制的方法之前， 需要说明一 下对组播组进行权限控制层次划分的方法： 根据不同的 IPTV业务需求， 对 组播组访问权限控制层次的划分有所不同， 一般可按照接口的逻辑关系从 整体到局部的标准， 一步步细化深入地划分组播组权限控制的层次； 也可 根据不同的用户权限级别， 由高到低的层次来划分， 主要包括但不限于以 下两种方式：
I、按照接口的逻辑关系从整体到局部划分访问组播组的权限控制层次， 下面对每个权限控制层的控制规则的配置以及对报文的控制进行说明， 如 图 3所示：
第一权限控制层： 从接入设备的整体上对用户所请求的组播组进行访 问权限控制；
例如： 所述接入设备为交换机时， 当交换机的接口均已被占用或者达 到最大负荷， 则拒绝用户所请求的组播组。
第二权限控制层： 从接入设备中的一个接口上对组播组进行权限控制； 其中， 所述接口可以是百兆以太网 （Ethernet ) 接口、 千兆以太网 ( GigaEhernet )接口或者异步传输模式（ ATM, Asynchronous Transfer Mode ) 接口等。 当然也可通过这些实际物理接口聚合成的链路汇聚控制协议
( LACP, Link Aggregation Control Protocol )接口。
第三权限控制层： 在接入设备中第二权限控制层接口的基础上， 配置 VLAN Trunk控制；
其中， 所述 VLAN Trunk为一种接口， 能使连接在不同交换机上的相同 VLAN中的主机互通。 由此可见， 无论是实物理接口还是虚拟接口， 都可以 属于多个 VLAN,可根据接口接收到的报文所带的 VLAN TAG标签来决定所 述报文所属的 VLAN。
第四权限控制层： 在接入设备的接口配置 VLAN Trunk控制的基础上， 再增加 IP地址的限制。
因为每个接口都可以收到不同 IP地址的报文，增加 IP地址的限制就更加 细化了组播组权限控制的层次。
例如： 接入设备整机可以占用的带宽是 240M, 那么第一个层次的带宽 限制是 240M, 当接入设备收到的组播组占用的带宽加上接入设备上已经占 用的带宽没有超过所能容纳的带宽限制值 240M时， 则进入下一个层次的控 制； 而对接口上带宽的限制值不一定是接入设备整机的带宽限制值除以接 入设备上的接口数， 可根据接入设备各个接口的实际运行情况进行设置， 假设接口允许的带宽值为 50M ,那么该组播组的带宽加上当前接口已经占用 的带宽不超过 50M时，则进入下一个层次的控制， 以此方法查找下面所有层 次的控制规则， 这里不再赘述。
需要指出的是， 按照接口的逻辑关系来划分访问组播组的权限控制层 次时， 并不局限于上述四个层次， 可结合具体的实际情况增加或减少权限 控制层次。
II、 按照权限控制的级别从高到低对组播组进行权限控制层次的划分。 其实， 这里所提到的控制权限的级别， 并不是一个定性的级别， 是根据在 实际中的具体需要， 根据运营商所关心的内容来指定的， 例如： 运营商提 供的节目有些是高质量的节目， 如高清晰数据电视（HDTV )类节目， 这些 节目的带宽一般比较高， 所以带宽的优先级比较高， 这样对权限控制层次 进行划分得到：
第一权限控制层： 用于对当前用户所能占用的带宽进行限制； 第二权限控制层： 用于对用户点播组播组进行权限控制；
第三权限控制层： 用于对用户访问的组播流的数目进行限制。
需要说明的是， 上述对用户带宽、 点播组播组的权限以及访问的组播 流的数目的限制可以配置在不同权限控制层， 也可以配置在同一个权限控 制层上。
以上简单的介绍了对组播组进行权限控制层次的两种划分方法， 其实， 在实际应用中， 并不局限于上述的两种方法， 并且每一种划分的层次也不 局限于四个或三个层次， 可以根据具体需要来减少一些或增加一些层次的 划分。 另外， 需要说明的是， 上面的限制规则只是最主要的， 当然在每个 层次中一些基本的限制规则还是需要存在的， 例如： 指定频道的访问权限 或者绑定某一套餐。
如图 2所示， 为本发明层次化控制访问组播组的方法流程示意图， 主要 步驟如下：
步驟 201 , 接入设备划分访问组播组的权限控制层；
例如： 按照接口的逻辑关系从整体到局部的层次划分方法， 将整个接 入设备作为第一权限控制层，接口为第二权限控制层，接口 + VLAN为第三 权限控制层， 接口 + VLAN + IP为第四权限控制层。
步驟 202, 为每个权限控制层设置控制规则；
针对每一个权限控制层所能允许的带宽数目， 来控制当前层次的用户 权限； 和 /或， 限制用户所能加入的组播组个数来控制用户权限， 每个层次 的控制规则可以不同也可以相同， 例如， 针对每一个层次所能允许的用户 加入的组播流个数来控制访问组播组的权限， 具体控制规则的配置命令如 下： 对于接入设备整机进行权限控制的第一权限控制层， 在全局模式下配 置权限控制规则，如命令： iptv service start,表示第一权限控制层启动 IPTV; 第一权限控制层的控制规则可设为频道模式， 如 iptv control channel和 iptv channel id-list 0-5 permit, 这是最基本的权限控制规则， 另外还有其他模式， 如套餐模式； 第一权限控制层还可对用户访问的组播流的个数进行限制， 如命令： iptv max-stream 2400,表示第一权限控制层的组播流的个数限制为 2400个； 第一权限控制层还可对用户所占用的带宽进行限制， 如命令： iptv max-bandwidth 240, 表示第一权限控制层的带宽限制为 240M。 所述命令可 根据权限控制规则来进行配置， 也可与权限控制规则同时进行配置。
对于第二权限控制层即接口权限控制层， 其配置权限控制规则的命令 格式与第一权限控制层基本一致， 只是配置命令是在接口模式下， 此时的 能够访问的最大组播流的个数和占用带宽的数目要改变， 根据所述接口的 实际需要来配置， 可以参照上述控制规则所举的实例进行配置。
对于第三权限控制层即接口 +VLAN权限控制层， 其配置权限控制规则 的命令格式在接口模式下， 并添加 VLAN的限制， 如： iptv VLAN 10 service start; iptv VLAN 10 control channel; iptv VLAN 10 channel id-list 0-5 permit; iptv VLAN 10 max-stream 10。
对于第四权限控制层即接口 +VLAN+IP权限控制层， 仍是在接口模式 下，命令格式上需要加 VLAN和 IP,如： iptv VLAN 10 ip 10.1.1.1 service start; iptv VLAN 10 control channel; iptv VLAN 10 channel id-list 0 deney。 在第四 权限控制层还可针对具体的用户设置频道拒绝权限， 这是为了在实际应用 中， 运营商拒绝某一个特定用户访问某个频道， 所以可针对特定的用户设 置具体的带宽和组播流个数的限制。
步驟 203 , 根据所设置的控制规则， 接入设备在当前权限控制层对来访 用户进行权限控制， 如果所述用户没有通过权限控制， 则执行步驟 204; 如 果所述用户通过权限控制， 则执行步驟 205;
其中， 用户向接入设备发送组播组的 IGMP Join报文， 接入设备收到用 户的请报文后， 根据所划分的访问组播组的权限控制层， 接入设备根据其 IPTV系统产生的权限控制表， 提取用户权限控制参数， 如请求接入的用户 所点播的频道、 访问权限、 占用带宽、 访问的组播流个数、 以及交换机的 端口号、 频道的访问权限、 当前已点播频道数目、 以及当前在线的用户信 息等， 在当前的权限控制层对所述用户开始进行权限控制。 如果通过当前 的权限控制层次， 则需要进入到当前权限控制层的下一个权限控制层， 直 到完成设置的所有权限控制层。
例如： 假设接入设备上共有 24个接口， 设置其整机可访问的组播流的 数量为 2400个。 那么， 在第一权限控制层， 当接入设备收到的组播流个数 加上当前其整机已经访问的组播流个数小于 2400个时， 则进入第二权限控 制层； 接入设备设置其每个接口访问的组播流个数为 100个， 当接口收到的 组播流个数加上当前该接口已经访问的组播流个数小于 100个时， 则进行第 三权限控制层的控制； 假设所述接口属于 2个 Trunk VLAN, 那么第三权限 控制层一一接口 + VLAN这个层次的组播流个数限制为 50个，当所述接口收 到的该 VLAN内的组播流个数加上当前所述接口所在 VLAN内已经访问的 组播流个数小于 50个时， 则进行第四权限控制层的控制， 假设所述接口所 在一个 VLAN内可以访问的 IP地址个数为 5个， 那么第四权限控制层——接 口 + VLAN + IP这个层次的组播流个数限制为 10个， 当这个层次所访问的组 播流个数没有超过限制值 10时， 就说明对这个用户的鉴权通过， 允许用户 点播其所请求的组播组。
步驟 204, 接入设备拒绝用户的访问， 结束当前流程。
步驟 205, 接入设备根据所设置控制策略， 判断是否进入下一个权限控 制层的权限控制， 如果进入下一个权限控制层， 则返回步驟 203; 否则， 如 果不需要再对用户作进一步的权限控制， 则执行步驟 206;
其中， 根据建立的权限控制层如不同划分方式， 来设置控制策略。 例 如： 通过对划分不同的权限控制层对来访用户进行权限控制， 而且为了进 一步细化权限控制， 则需要执行每一个权限控制层， 那么是否进行下一个 权限控制层的判断依据便为： 是否遍历完所有的权限控制层， 直到权限控 制层达到最顶层。
又如： 根据所制定的每个权限控制层的控制规则的优先级来设置所述 控制策略。 根据不同的控制规则以及优先级划分权限控制层， 每个权限控 制层可采用不同的控制规则， 那么为每个权限控制层的控制规则设定一个 代表优先级高低的数值， 如数值越高代表优先级越高， 这样从底层即优先 级低的开始进行层次控制， 直到当前权限控制层的优先级达到停止进行下 一个权限控制层访问的数值时， 便停止进行下一个权限控制层的权限控制 , 直接根据当前权限控制层的控制规则来决定是拒绝用户的请求还是接受用 户的请求。 需要指出的是， 在实际的应用中的判断依据并不局限于上述两 种。
需要指出的是， 通过步驟 203、 205 , 接入设备根据所设置控制策略， 进行权限控制判断， 直到根据所设置的权限控制层、 控制规则及控制策略 等判断得出用户是否具有访问权限为止。
步驟 206 , 接入设备允许用户的访问。
至此， 通过本发明实施例所述的技术方案从整体到局部来划分权限控 制层对用户访问组播组的权限进行控制， 并根据不同的需求采用不同的控 制策略和层次划分， 使得运营商能够提供更加高质量、 清晰的视频节目， 对于现在 IPTV开展的业务都有很强的优势。
对于上述的各实施例， 为了简单描述， 故将其都表述为一系列的动作 组合， 但是本领域技术人员应该知悉， 本发明并不受所描述的动作顺序的 限制， 因为依据本发明， 某些步驟可以采用其他顺序或者同时进行。
为实现上述方法， 本发明还提供一种层次化控制访问组播组的装置， 该装置的结构参照图 4, 主要包括如下模块：
划分模块 401 , 用于划分访问组播组的权限控制层， 并为每个权限控制 层设置控制规则；
控制模块 402 , 用于根据所述划分模块 401设置的控制规则来对用户请 求访问的组播组进行权限控制；
触发模块 403， 用于根据所述控制模块 402对组播组的权限控制结果， 触发下一个权限控制层的权限控制。
上述装置， 还包括： 决策模块 404: 用于设置控制策略， 并根据所述控 制策略判断是否对用户访问的组播组进行下一个权限控制层的权限控制， 以及用于在进入下一个权限控制层的权限控制时通知所述触发模块 403。
其中， 所述划分模块 401具体用于： 按照接口的逻辑关系从整体到局部 划分访问组播组的权限控制层； 或者， 根据不同的用户权限级别， 由高到 低的层次来划分访问组播组的权限控制层。
所述划分模块 401具体用于： 将权限控制层所能允许的带宽数目设置为 该权限控制层的控制规则； 和 /或， 限制用户所能加入的组播组个数来控制 用户对组播组的访问权限。
所述决策模块 404具体用于： 遍历完所有的权限控制层， 直到达到权限 控制层的最顶层； 或者， 为每个权限控制层的控制规则设定一个代表优先 级高低的数值， 所述数值越高代表优先级越高， 并从优先级低的开始进行 层次控制， 直到当前权限控制层的优先级达到停止进行下一个权限控制层 访问的数值时， 便停止进行下一个权限控制层的权限控制。
综上所述， 本发明采用的装置比较简单， 易于实现， 同时本发明实施 例所述的技术方案采用从整体到局部的标准来划分用户访问组播组的权限 控制层次， 对每个层次的权限控制规则可以采用相同的策略， 也可以采用 不同的控制策略， 进行灵活控制， 打破了之前传统的单一控制方法的局限 性， 可以满足多个层次的控制需求， 提供更加高质量、 清晰的视频节目， 对于现在 IPTV开展的业务， 如互联网视频直播、 远距离真视频点播、 节目 源制作、 高清数字节目转播直播等， 都有很强的优势。
在上述实施例中， 对各个实施例的描述都各有侧重， 某个实施例中没 有详述的部分， 可以参见其他实施例的相关描述即可。 以上所述， 仅为本 发明的较佳实施例而已， 只是用来说明和解释本发明， 并非用于限定本发 明的保护范围。 在本发明的精神和权利要求保护范围之内， 对本发明所作 的任何修改、 等同替换， 都落入本发明的保护范围。

Claims

权利要求书
1、 一种层次化控制访问组播组的方法， 其特征在于， 划分访问组播组 的权限控制层， 并为每个权限控制层设置控制规则； 该方法包括：
根据所设置的控制规则， 在当前权限控制层对来访用户进行权限控制， 如果所述用户没有通过权限控制， 则拒绝用户访问其请求的组播组；
如果所述用户通过权限控制， 则进入下一个权限控制层对来访用户进 行权限控制 , 直到根据所设置的权限控制层判断得出用户是否具有访问权 限。
2、 根据权利要求 1所述的层次化控制访问组播组的方法， 其特征在于， 所述划分访问组播组的权限控制层包括：
按照接口的逻辑关系从整体到局部划分访问组播组的权限控制层； 和 /或， 根据不同的用户权限级别， 由高到低的层次来划分访问组播组 的权限控制层。
3、 根据权利要求 2所述的层次化控制访问组播组的方法， 其特征在于， 所述划分访问组播组的权限控制层进一步包括：
按照接口的逻辑关系从整体到局部划分访问组播组的权限控制层， 包 括： 第一权限控制层、 第二权限控制层、 第三权限控制层和第四权限控制 层； 其中，
第一权限控制层为整个接入设备； 第二权限控制层为接入设备的接口； 第三权限控制层为接入设备的接口和虚拟局域网 VLAN;第四权限控制层为 接入设备的接口、 VLAN和网际协议 IP地址； 和 /或，
根据不同的用户权限级别， 由高到低的层次来划分访问组播组的权限 控制层， 包括：
用于对当前用户所能占用的带宽进行限制的第一权限控制层； 用于对用户点播组播组进行权限控制的第二控制层； 用于对用户访问的组播流的数目进行限制的第三权限控制层。
4、 根据权利要求 1、 2或 3所述的层次化控制访问组播组的方法， 其特 征在于， 所述为每个权限控制层设置控制规则包括：
将权限控制层所能允许的带宽数目设置为该权限控制层的控制规则； 和 /或，
限制用户所能加入的组播组个数来控制用户对组播组的访问权限。
5、 根据权利要求 4中所述的层次化控制访问组播组的方法， 其特征在 于， 所述根据所设置的控制规则， 在当前权限控制层对来访用户进行权限 控制包括：
针对每个权限控制层允许的带宽数目来控制当前权限控制层的用户权 限， 在当前权限控制层收到的用户点播组播组占用的带宽加上当前权限控 制层上已经占用的带宽没有超过当前权限控制层所容纳的带宽限制值时， 则进入下一个层次的控制； 和 /或，
针对每个权限控制层允许用户加入的组播流个数来控制访问组播组的 权限， 在当前权限控制层上收到的用户点播组播流个数加上当前层上已点 播的组播流个数没有超过当前权限控制层组播流个数限制值时， 则进入下 一个层次的控制。
6、 根据权利要求 1、 2或 3中所述的层次化控制访问组播组的方法， 其 特征在于， 所述进入下一个权限控制层对来访用户进行权限控制之前， 该 方法还包括：
设置控制策略， 并根据所设置的控制策略判断是否进入下一个权限控 制层的权限控制， 如果进入下一个权限控制层， 则在下一个权限控制层对 来访用户进行权限控制；
如果不需要再对用户作进一步的权限控制， 则允许用户的访问。
7、 根据权利要求 6所述的层次化控制访问组播组的方法， 其特征在于， 所述根据所设置的控制策略判断是否进入下一个权限控制层的权限控制包 括：
遍历完所有的权限控制层， 直到达到权限控制层的最顶层； 或者， 为每个权限控制层的控制规则设定一个代表优先级高低的数值， 所述 数值越高代表优先级越高， 并从优先级低的开始进行层次控制， 直到当前 权限控制层的优先级达到停止进行下一个权限控制层访问的数值时， 便停 止进行下一个权限控制层的权限控制。
8、 一种层次化控制访问组播组的装置， 其特征在于， 该装置包括： 划 分模块、 控制模块、 触发模块； 其中，
划分模块， 用于划分访问组播组的权限控制层， 并为每个权限控制层 设置控制规则；
控制模块， 用于根据所述划分模块设置的控制规则来对用户请求访问 的组播组进行权限控制；
触发模块， 用于根据所述控制模块对组播组的权限控制结果， 触发下 一个权限控制层的权限控制。
9、 根据权利要求 8所述的层次化控制访问组播组的装置， 其特征在于， 该装置还包括：
决策模块， 用于设置控制策略， 并根据所述控制策略判断是否对用户 访问的组播组进行下一个权限控制层的权限控制， 以及用于在进入下一个 权限控制层的权限控制时通知所述触发模块。
10、 根据权利要求 8或 9所述的层次化控制访问组播组的装置， 其特征 在于， 所述划分模块进一步用于： 按照接口的逻辑关系从整体到局部划分 访问组播组的权限控制层； 或者， 根据不同的用户权限级别， 由高到低的 层次来划分访问组播组的权限控制层； 和 /或，
所述划分模块进一步用于： 将权限控制层所能允许的带宽数目设置为 该权限控制层的控制规则； 和 /或， 限制用户所能加入的组播组个数来控制 用户对组播组的访问权限。
11、根据权利要求 9所述的层次化控制访问组播组的装置，其特征在于， 所述决策模块进一步用于：
遍历完所有的权限控制层， 直到达到权限控制层的最顶层； 或者， 为每个权限控制层的控制规则设定一个代表优先级高低的数值， 所述 数值越高代表优先级越高， 并从优先级低的开始进行层次控制， 直到当前 权限控制层的优先级达到停止进行下一个权限控制层访问的数值时， 便停 止进行下一个权限控制层的权限控制。
PCT/CN2010/073662 2009-08-24 2010-06-08 一种层次化控制访问组播组的方法和装置 WO2011023016A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US13/384,321 US20120140771A1 (en) 2009-08-24 2010-06-08 Method and Device for Hierarchically Controlling Accessed Multicast Group
EP10811176.6A EP2448264A4 (en) 2009-08-24 2010-06-08 METHOD AND DEVICE FOR HIERARCHIC CONTROL OF ACCESS TO A MULTICAST GROUP

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910091702.4 2009-08-24
CN2009100917024A CN101640787B (zh) 2009-08-24 2009-08-24 一种层次化控制访问组播组的方法和装置

Publications (1)

Publication Number Publication Date
WO2011023016A1 true WO2011023016A1 (zh) 2011-03-03

Family

ID=41615539

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/073662 WO2011023016A1 (zh) 2009-08-24 2010-06-08 一种层次化控制访问组播组的方法和装置

Country Status (4)

Country Link
US (1) US20120140771A1 (zh)
EP (1) EP2448264A4 (zh)
CN (1) CN101640787B (zh)
WO (1) WO2011023016A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404325A (zh) * 2011-11-23 2012-04-04 华为技术有限公司 报文访问控制方法及交换机

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101640787B (zh) * 2009-08-24 2011-10-26 中兴通讯股份有限公司 一种层次化控制访问组播组的方法和装置
CN103077336B (zh) * 2012-12-27 2015-09-02 中国建设银行股份有限公司 综合前端图形终端授权方法及系统
CN103227750B (zh) * 2013-04-26 2016-05-25 华为技术有限公司 控制报文传输的方法、装置和系统
US9996064B1 (en) * 2013-12-19 2018-06-12 Agiliance, Inc. System and method for propagating control results in an enterprise
US20180199116A1 (en) * 2015-06-30 2018-07-12 Thomson Licensing Method and apparatus for ip multicast grouping
CN106302399A (zh) * 2016-07-29 2017-01-04 中兴通讯股份有限公司 控制组播接入的方法及系统、云桌面、云终端
CN108268798B (zh) * 2017-06-30 2023-09-05 勤智数码科技股份有限公司 一种数据项权限分配方法及系统
CN109284617A (zh) * 2018-09-06 2019-01-29 郑州云海信息技术有限公司 控制多进程访问磁盘文件的方法、装置及存储介质
CN111259412B (zh) * 2020-01-09 2023-12-05 远景智能国际私人投资有限公司 权限控制方法、装置、计算机设备及存储介质
CN111934892B (zh) * 2020-07-09 2021-08-17 北京航空航天大学 一种基于多播的民航信息高效共享方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1416253A (zh) * 2002-08-07 2003-05-07 华为技术有限公司 实现组播代理多粒度用户管理的方法
CN1756210A (zh) * 2004-09-29 2006-04-05 上海贝尔阿尔卡特股份有限公司 一种接入网中的组播接入控制方法和设备
CN101640787A (zh) * 2009-08-24 2010-02-03 中兴通讯股份有限公司 一种层次化控制访问组播组的方法和装置

Family Cites Families (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5748736A (en) * 1996-06-14 1998-05-05 Mittra; Suvo System and method for secure group communications via multicast or broadcast
US7301944B1 (en) * 1997-10-24 2007-11-27 Tranz-Send Broadcasting Network, Inc. Media file distribution with adaptive transmission protocols
US7881477B2 (en) * 1999-02-05 2011-02-01 Avaya Inc. Method for key distribution in a hierarchical multicast traffic security system for an internetwork
US7280971B1 (en) * 2000-06-09 2007-10-09 At&T Bls Intellectual Property, Inc. Method and system for server-based error processing in support of legacy-based usage and billing systems
US20020053020A1 (en) * 2000-06-30 2002-05-02 Raytheon Company Secure compartmented mode knowledge management portal
US8037530B1 (en) * 2000-08-28 2011-10-11 Verizon Corporate Services Group Inc. Method and apparatus for providing adaptive self-synchronized dynamic address translation as an intrusion detection sensor
US8370507B1 (en) * 2000-09-13 2013-02-05 Rockstar Bidco Lp System, device, and method for receiver access control in an internet television
WO2003052993A2 (en) * 2001-12-15 2003-06-26 Thomson Licensing S.A. Quality of service setup on a time reservation basis
US8473355B2 (en) * 2002-12-06 2013-06-25 Facebook, Inc. System and method for electronic wallet conversion
CN1890920B (zh) * 2003-10-31 2011-01-26 丛林网络公司 多播通信业务的安全传送
US8688834B2 (en) * 2004-07-09 2014-04-01 Toshiba America Research, Inc. Dynamic host configuration and network access authentication
US7725605B2 (en) * 2004-08-06 2010-05-25 Salesforce.Com, Inc. Providing on-demand access to services in a wide area network
US7362776B2 (en) * 2004-11-01 2008-04-22 Cisco Technology, Inc. Method for multicast load balancing in wireless LANs
US7877796B2 (en) * 2004-11-16 2011-01-25 Cisco Technology, Inc. Method and apparatus for best effort propagation of security group information
US7266198B2 (en) * 2004-11-17 2007-09-04 General Instrument Corporation System and method for providing authorized access to digital content
EP1826697A1 (en) * 2006-02-24 2007-08-29 Giga Games System, SL Method for booting and using software for AWP and B type amusing gaming machines, and for C type casino machines
CN100463391C (zh) * 2006-09-23 2009-02-18 西安西电捷通无线网络通信有限公司 一种网络密钥管理及会话密钥更新方法
EP2102775B1 (en) * 2006-12-06 2019-07-03 Medtronic, Inc. Intelligent discovery of medical devices by a programming system
US20080186962A1 (en) * 2007-02-01 2008-08-07 Cisco Technology, Inc. Policy-Based Tunneling of Multicast Streams
CN101257616B (zh) * 2007-03-02 2010-06-23 中兴通讯股份有限公司 Iptv节目控制方法及系统
US20090128360A1 (en) * 2007-09-24 2009-05-21 Headwater Systems, Inc. Electronic tag location system
CN101127708B (zh) * 2007-09-25 2011-04-20 中兴通讯股份有限公司 一种对用户实现分时分级带宽控制的方法和装置
US8484747B2 (en) * 2008-05-09 2013-07-09 International Business Machines Corporation Method and system for managing electronic messages
US8023425B2 (en) * 2009-01-28 2011-09-20 Headwater Partners I Verifiable service billing for intermediate networking devices
US8458462B1 (en) * 2008-08-14 2013-06-04 Juniper Networks, Inc. Verifying integrity of network devices for secure multicast communications
US8417935B2 (en) * 2008-10-10 2013-04-09 The Boeing Company System and method for collaboration over shared storage
US20100328032A1 (en) * 2009-06-24 2010-12-30 Broadcom Corporation Security for computing unit with femtocell ap functionality
US20110288874A1 (en) * 2010-05-18 2011-11-24 Midamerican Healthcare Inc. System and Method for Providing Authentication of Medical Data Through Biometric Identifier

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1416253A (zh) * 2002-08-07 2003-05-07 华为技术有限公司 实现组播代理多粒度用户管理的方法
EP1388972A1 (en) 2002-08-07 2004-02-11 Huawei Technologies Co., Ltd. Multi-layer multicast user management method
CN1756210A (zh) * 2004-09-29 2006-04-05 上海贝尔阿尔卡特股份有限公司 一种接入网中的组播接入控制方法和设备
CN101640787A (zh) * 2009-08-24 2010-02-03 中兴通讯股份有限公司 一种层次化控制访问组播组的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2448264A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404325A (zh) * 2011-11-23 2012-04-04 华为技术有限公司 报文访问控制方法及交换机
CN102404325B (zh) * 2011-11-23 2015-03-11 华为技术有限公司 报文访问控制方法及交换机

Also Published As

Publication number Publication date
CN101640787A (zh) 2010-02-03
CN101640787B (zh) 2011-10-26
EP2448264A4 (en) 2013-09-25
EP2448264A1 (en) 2012-05-02
US20120140771A1 (en) 2012-06-07

Similar Documents

Publication Publication Date Title
WO2011023016A1 (zh) 一种层次化控制访问组播组的方法和装置
RU2384969C2 (ru) Устройство широкополосного доступа и способ предоставления видео услуги
AU678687B2 (en) Network having secure fast packet switching and guaranteed quality of service
US7830825B2 (en) Method for realizing the multicast service
JP4389605B2 (ja) マルチキャスト情報配信システムおよびマルチキャスト情報配信方法
US8908687B2 (en) Method for transmitting policy information between network equipment
US10009189B2 (en) System and method for a managed network with quality-of-service management
WO2007140702A1 (en) Multicast service processing method and access equipment
WO2009039690A1 (fr) Procédé et appareil pour commander la largeur de bande occupée par l'utilisateur selon l'heure et la classe
CN1270476C (zh) 基于服务质量的网络管理方法
WO2010099753A1 (zh) 一种接纳控制方法、系统及设备
WO2009132548A1 (zh) 策略决策功能实体、家庭网关、服务质量控制方法及系统
KR20120053516A (ko) 인터넷 프로토콜 텔레비전 채널 전환 시간 지연 감소 방법 및 시스템
WO2008148320A1 (fr) Procédé, dispositif et système pour un contrôle d'autorisation d'un service de multidiffusion
WO2008131651A1 (fr) Procédé, système et dispositif de commande de ressource multidiffusion
WO2008138238A1 (fr) Procédé, dispositif et système servant à réaliser un contrôle d'admission d'une connexion de multidiffusion
WO2005067208A1 (en) Multiple services with policy enforcement over a common network
WO2008046336A1 (fr) Système et procédé permettant un contrôle d'accès réparti dans un service multidiffusion
WO2008025205A1 (fr) Procédé et système d'application de service et unité d'agence d'application de service
WO2013097122A1 (zh) 接入网中的业务通道带宽管理方法、相关装置和系统
WO2008151528A1 (fr) Procédé, dispositif et système pour commander une ressource de multidiffusion
WO2010062227A1 (en) Method and system for establishing digital media streams
WO2009024096A1 (fr) Appareil de gestion de ressources, procédé et système
WO2008017226A1 (fr) Système et procédé de commande de multidiffusion
US20120124182A1 (en) Method, a terminal, an access node and a media server for providing resource admission control of digital media streams

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10811176

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13384321

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2010811176

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE