WO2011160457A1

WO2011160457A1 - Method and system for realizing member access control

Info

Publication number: WO2011160457A1
Application number: PCT/CN2011/071064
Authority: WO
Inventors: 陈世猛
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-06-25
Filing date: 2011-02-17
Publication date: 2011-12-29
Also published as: CN101883011A

Abstract

A method for realizing member access control is provided. The method includes: the system side assigns a group number for a member when the member accesses the system, the system side judges whether the group number of a first member is the same as the group number of a second member when the first member needs to communicate with the second member; and if the group numbers are the same, then the first member is allowed to communicate with the second member, otherwise, the first member is not allowed to communicate with the second member. A system for realizing member access control is also provided. The solution distinguishes the members that can communicate with each other and the members that can not communicate with each other by assigning the group numbers for the members, so as to control flexibly the access between the members.

Description

Method and system for implementing member access control

The present invention relates to access control techniques, and more particularly to a method and system for implementing member access control. Background technique

The Layer 2 VPN mainly includes Virtual Private LAN Service (VPLS) and VPWS (Virtual Private Wire Service). Among them, VPWS is a point-to-point Layer 2 VPN technology on Ethernet. VPLS is expanded on the basis of Point-to-connect Layer 2 VPN technology.

Figure 1 is a schematic diagram of a VPLS service network. As shown in Figure 1, a VPLS link is set up between the PE1 and PE2. The user edge devices CE1, CE2, and CE3 are connected to each other. Side access. Under normal circumstances, CE1, CE2, CE3, and CE4 can communicate with each other. If the local members cannot communicate with each other for certain service requirements, that is, CE1, CE2, and CE3 cannot communicate with each other. In this case, just configuring the normal VPLS service will not satisfy the customer's needs.

For this requirement, the existing method is to divide the member's attributes into the client (client) and the server (server). The members of the client attribute can only communicate with the server attribute members, and the client members cannot communicate with each other. It can be seen that this method is a simple method of dividing the members into two groups. It is not flexible to use. For example, if CE1 and CE2 are required to communicate with each other, but CE1 and CE3 cannot communicate with each other, CE2 and CE3 cannot communicate with each other. The method of implementing VPLS member access control will not meet the user requirements, thus affecting the user experience. Summary of the invention

In view of this, the main object of the present invention is to provide a method and system for implementing member access control, which can flexibly control access between members, thereby improving user experience.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for implementing member access control, the system side assigns a group number to the member when the member accesses, and the method includes:

When the first member needs to communicate with the second member, the system side determines whether the group number of the first member is the same as the group number of the second member, and if the group number is the same, the first member is allowed to The second member communicates; otherwise, the first member is not allowed to communicate with the second member.

When the system accesses the member, the group number is assigned to the member: the members who are allowed to communicate with each other are assigned the same group number, and the members who are not allowed to communicate with each other are assigned different group numbers.

The method further includes: the system side writes the group number assigned to the member to the forwarding table and the access attribute table corresponding to the member.

Determining, by the system side, whether the group number of the first member is the same as the group number of the second member: the system side acquires the first by searching an access attribute table corresponding to the first member A group number of a member, and obtaining a group number of the second member by searching a forwarding table corresponding to the second member, and determining.

The system side is a carrier edge device, and the member is a user edge device.

A system for implementing member access control, including a system side and a member;

The system side is configured to allocate a group number to the member when the member accesses, and determine, when the first member needs to communicate with the second member, the group number of the first member and the first Whether the group number of the two members is the same, and the group number is the same, the first member is allowed to communicate with the second member; otherwise, the first member is not allowed to communicate with the second member.

When the system side accesses the member, the group number is assigned to the member as: Members of the message are assigned the same group number, assigning different group numbers to members who are not allowed to communicate with each other. The system side is further configured to write the group number assigned to the member to the forwarding table and the access attribute table corresponding to the member.

The system side is a carrier edge device, and the member is a user edge device.

The method and system for implementing member access control of the present invention allocates a group ID (Group ID) to each member when the member accesses, and when a member needs to communicate with other members, it is necessary to determine the group of the member. The number is the same as the group number of the destination member. If they are the same, they can communicate with each other. Otherwise, communication cannot be performed. By assigning a group number to a member, the present invention distinguishes between members that can communicate with each other and members that cannot communicate with each other, thereby enabling flexible control of access between members and improving the user experience. DRAWINGS

Figure 1 is a schematic diagram of a VPLS service networking;

2 is a schematic flowchart of a method for implementing member access control according to the present invention;

FIG. 3 is a schematic flowchart of a method for implementing member access control according to an embodiment of the present invention. detailed description

The basic idea of the present invention is: assign a group ID to each member when the member accesses, and when a member needs to communicate with other members, it is necessary to determine the group number of the member and its destination member. Whether the group numbers are the same, if they are the same, they can communicate with each other, otherwise communication cannot be performed.

2 is a schematic flowchart of a method for implementing member access control according to the present invention, as shown in FIG. 2, Methods include:

Step 201: The system side allocates a group number to the member when the member accesses.

Here, different members can be assigned the same group number. The member group number is generally set by the staff on the system side, specifically to allow members who communicate with each other to set the same group number, and to set different group numbers for members who are not allowed to communicate with each other. In the case where all members are not allowed to communicate with each other, different groups can be assigned to the members that are randomly accessed by the system side.

The system side generally writes the group number assigned to the member to the forwarding table and access attribute table corresponding to the member.

In the VPLS service, the system side is the carrier edge device (PE) and the member is the user edge device (CE).

Step 202: The first member needs to communicate with the second member.

For example, when the first member sends a member to the system side with the second member as the destination member, the first member needs to communicate with the second member.

Step 203: The system side determines whether the group number of the first member is the same as the group number of the second member. If the same, perform step 204; otherwise, go to step 205.

The system side obtains the group number of the first member by searching the access attribute table corresponding to the first member, and obtains the group number of the second member by searching a forwarding table corresponding to the second member. And judge whether they can communicate with each other if they are the same, otherwise communication cannot be performed.

Step 204: Allow the first member to communicate with the second member.

Step 205: The first member is not allowed to communicate with the second member.

Through the implementation of the above steps, you can limit the communication between VPLS local members.

The present invention also provides a system for implementing member access control, including a system side and a member; The system side is configured to allocate a group number to the member when the member accesses, and determine, when the first member needs to communicate with the second member, the group number of the first member and the first Whether the group number of the two members is the same, and the group number is the same, the first member is allowed to communicate with the second member; otherwise, the first member is not allowed to communicate with the second member.

The system side is further configured to write the group number assigned to the member to the forwarding and access attribute table corresponding to the member.

The system side is a carrier edge device, and the member is a user edge device.

The technical solution of the present invention will be further described in detail below with reference to specific embodiments.

As shown in Figure 1, the VPLS link is set up between PE1 and PE2. The devices CE1, CE2, and CE3 are connected to PE1, and CE4 is connected to PE2. In this embodiment, CE1 is allowed to communicate with CE2 and CE1 and CE3 are not allowed to communicate. FIG. 3 is a schematic flowchart of a method for implementing member access control according to an embodiment of the present invention. As shown in FIG. 3, the method includes:

Step 301: When CE1 is connected to the PE1 side, PE1 is configured with its group number of 1. When CE2 is connected to the PE1 side, PE1 is configured with its group number of 1. When CE3 is connected to the PE1 side, PE1 configures its group. The number is 2. After the configuration is completed, the group number information of each member is written to the corresponding forwarding table and access attribute table.

Step 302: After receiving the packet of CE1, PE1 goes to 303 if the destination of the packet is CE2, and goes to 304 if the destination of the packet is CE3.

Step 303: The PE1 extracts the group number of the CE2 from the forwarding table corresponding to the CE2, from the CE1 pair. The group number of the CE1 is taken out and the comparison is performed. If the packets are the same, the packet is forwarded to the CE2; otherwise, the packet is discarded.

In this embodiment, the group number of CE1 and CE2 is 1 and the group number of the two is the same. Therefore, PE1 can send packets from CE1 to CE2, that is, CE1 and CE2 can communicate.

Step 304: The PE1 takes the group number of the CE3 from the forwarding table corresponding to the CE3, and takes the group number of the CE1 from the access attribute table corresponding to the CE1 and compares it. If the same, the packet is forwarded to the CE3. Otherwise, the packet is discarded.

In this embodiment, the group number of CE1 is 1 and the group number of CE3 is 2, because the group number of the two is different, PE1 discards the packets from CE1 to CE3, CE1 and CE3. Can't communicate.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for implementing member access control, wherein the system side allocates a group number to the member when the member accesses, and the method includes:

The method according to claim 1, wherein the system side assigns the group number to the member when the member accesses: assigning the same group number to the members that allow communication with each other, Members who are allowed to communicate with each other are assigned different group numbers.

The method according to claim 1, wherein the method further comprises: the system side writing the group number assigned to the member to the forwarding table and the access attribute table corresponding to the member.

The method according to claim 3, wherein the system side determines whether the group number of the first member is the same as the group number of the second member: The access attribute table corresponding to the first member obtains the group number of the first member, and obtains the group number of the second member by searching a forwarding table corresponding to the second member, and performs determination.

The method according to any one of claims 1 to 4, wherein the system side is a carrier edge device, and the member is a user edge device.

6. A system for implementing member access control, characterized in that the system comprises: a system side and a member;

The system according to claim 6, wherein the system side assigns the group number to the member when the member accesses: assigning the same group number to the members who are allowed to communicate with each other, Members who are allowed to communicate with each other are assigned different group numbers.

8. The system of claim 6 wherein:

The system according to claim 8, wherein the system side determines whether the group number of the first member is the same as the group number of the second member: The access attribute table corresponding to the first member obtains the group number of the first member, and obtains the group number of the second member by searching a forwarding table corresponding to the second member, and performs determination.

The system according to any one of claims 6 to 9, wherein the system side is a carrier edge device, and the member is a user edge device.