WO2012013042A1

WO2012013042A1 - Configuration method and system for implementing the port address binding

Info

Publication number: WO2012013042A1
Application number: PCT/CN2011/071834
Authority: WO
Inventors: 支新军; 陈琦
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-07-28
Filing date: 2011-03-15
Publication date: 2012-02-02
Also published as: CN101888575B; CN101888575A

Abstract

A configuration method and system for binding and configuring port address are provided in the present invention. The method includes the following steps: setting a binding message which contains the Internet protocol (IP) address and the media access control (MAC) address of the user host and the Ethernet user port identification, and transmitting the binding message to the optical line terminal (OLT); the OLT generates a configuration message which contains the IP address, the MAC address and the management entity identification according to the binding message, and transmits the configuration message to the optical network unit (ONU) or the optical network terminal (ONT), wherein the management entity identification is corresponding to the Ethernet user port identification; the ONU or ONT writes the IP address and the MAC address into a binding table designated by the management entity identification of the MAC bridge port binding table management entity according to the received configuration message. The invention has flexible configuration, and enables the complete control for user authority, thus the safety of the user network is improved.

Description

Configuration method and system for realizing port address binding

The present invention relates to a Gigabit-Capable Passive Optical Network (GPON) technology in the field of communications, and in particular to a configuration method and system for implementing port address binding. Background technique

GPON is a point-to-multipoint optical access technology. Figure 1 shows the GPON system architecture. As shown in Figure 1, the GPON system includes an optical line terminal (OLT) and light consisting of passive optical splitting devices. Optical Distribution Network (ODN), Optical Network Unit (ONU) or Optical Network Terminal (ONT). The OLT is a central office device in the GPON system, usually placed in the central office of the operator; the ONU or ONT is the terminal device of the GPON system, and the ONU is generally used for fiber to the Curb (FTTC), ONT Generally used for Fiber To The Home (FTTH); OLT and ONU or ONT are connected by ODN; OLT configures ONU or ONT through ONT Management and Control Channel (OMCC); The dotted line in the figure represents the OMCC, and the solid line represents the physical link.

The GPON standard is the G.984 series, in which G.984.4 specifically defines the ONT Management and Control Interface (OMCI), which provides a standard management control protocol and related management entities (Managed Entity, ME), OLT. The related MEs are configured through OMCI to implement remote configuration and management of ONUs or ONTs.

As the terminal device of the GPON access network, the ONU or ONT needs to solve the security problem for the user. The MAC bridge port filter table management entity defined in G.984.4 can be used for Ethernet user ports. Destination MAC address filtering. The MAC bridge port filtering table management entity defines a data relationship, a management entity identifier, and a MAC filtering table. Each filtering entry in the MAC filtering table includes an entry number and a filtering byte ( It includes filtering/forwarding, adding/deleting bit information, and destination MAC address. The management entity controls the user's permission to receive services by filtering the destination MAC address of the MAC bridge port. For example, for multicast services, the multicast configuration of the user bridge port multicast MAC address can prevent unauthorized users from acquiring multicast services. Since the MAC bridge port filtering table management entity in G.984.4 only targets the outgoing service of the MAC bridge port, and does not target the inbound service, in order to further strengthen the control of the user authority and increase the security, the prior art is G. The filter byte of the MAC bridge port filter table management entity in 984.4 is extended, and the filter direction is further defined by the reserved bits in the filter byte, that is, the destination MAC address of the MAC bridge port outgoing data can be filtered. The destination MAC address of the incoming data can also be filtered, thereby further enhancing the control of the user rights and improving the security.

In the prior art, the MAC bridge port filtering table management entity defines the destination MAC address filtering of the Ethernet service that is in and out of the MAC bridge port, and controls the user rights. However, because the destination MAC address is filtered, it cannot be used in the user network. The host performs control, for example, the MAC address flood attack initiated by the host in the user network cannot be prevented. It is easy to cause the network security problem caused by the overflow of the MAC address table in the ONU/ONT. The security problem such as IP address theft cannot be prevented, which is easy to cause. The rights of legitimate users in the user network are stolen, and the rights of legitimate users suffer losses. Therefore, the MAC bridge port filter table management entity does not actually have full control of user rights, and the security is low. Summary of the invention

The object of the present invention is to provide a method and a system for implementing port address binding, which can better solve the problem that the MAC bridge port filtering table management entity does not completely control the user rights in the user network in the prior art, and the security is low. problem. According to an aspect of the present invention, a configuration method for implementing port address binding includes:

The management unit sets a binding message including the user host IP address and MAC address, the Ethernet user port identifier, and sends the binding message to the optical line terminal OLT;

The OLT generates a configuration message including the IP address, the MAC address, and the management entity identifier according to the binding message, and sends the configuration message to the optical network unit ONU or the optical network terminal ONT, where the management entity identifier is The Ethernet user port identifier corresponds to

The ONU or the ONT writes the IP address and the MAC address into the binding table specified by the management entity identifier of the MAC bridge port binding table management entity according to the received configuration message.

The method further includes: the MAC bridge port binding table management entity corresponding to the MAC bridge port configuration management entity that points to the Ethernet user port by using the same management entity identifier as the MAC bridge port configuration management entity.

The configuration message includes a configuration message for adding a binding entry obtained by using the binding message, a configuration message for deleting a binding entry, and a configuration message for configuring a binding mode and a binding table size.

Further, the method further includes:

After the configuration is complete, if the IP address and MAC address of the data frame received by the ONU or the ONT through the Ethernet user port are present in the binding table of the MAC bridge port binding table management entity, the Ethernet user port receiving the data frame is received. The binding mode is to forward the data frame when the binding is forward, and the binding mode is to discard the data frame when the binding is reverse.

Further, the method further includes:

After the configuration is complete, if the IP address and MAC address of the data frame received by the ONU or the ONT through the Ethernet user port do not exist in the binding table of the MAC bridge port binding table management entity, the Ethernet user receiving the data frame The binding mode of the port is to forward the data frame when the binding is reversed. The binding mode is to discard the data frame when the binding is forward. When the configuration message received by the ONU or the ONT is a configuration message for adding a binding entry, the ONU or the ONT adds an entry number to the MAC bridge port binding table management entity, indicating that the added entry is tied. Binding entries for properties, IP addresses, and MAC addresses.

When the configuration message received by the ONU or the ONT is a configuration message for deleting the binding entry, the ONU or the ONT deletes the entry including the entry number and the deleted entry in the MAC bridge port binding table management entity. Binding entries for properties, IP addresses, and MAC addresses.

When the configuration message received by the ONU or the ONT is a configuration message for configuring a binding mode and a binding table size, the ONU or the ONT configures binding mode information in the MAC bridge port binding table management entity. And bind table size information.

According to another aspect of the present invention, a system for implementing port address binding includes: a management unit, configured to set a binding message including a user host IP address and a MAC address, an Ethernet user port identifier, and bind the binding Sending a message to the optical line terminal OLT;

The OLT is configured to generate, according to the binding message, a configuration message that includes the IP address, the MAC address, and the management entity identifier, and send the configuration message to the optical network unit ONU or the optical network terminal ONT, where the management entity identifier Corresponding to the Ethernet user port identifier;

The ONU or ONT is used to write the IP address and the MAC address into the binding table specified by the management entity identifier of the MAC bridge port binding table management entity according to the received configuration message.

The MAC bridge port binding table management entity corresponds to a MAC bridge port configuration management entity that points to an Ethernet user port by using the same management entity identifier as the MAC bridge port configuration management entity.

Compared with the prior art, the present invention defines and uses the MAC bridge port binding table management entity to implement binding of the IP address and MAC address of the host in the user network and the Ethernet user port, thereby realizing the user right. Full control to further improve the security of the user network. DRAWINGS

1 is a schematic diagram of a GPON system architecture; 2 is a relationship diagram of a MAC bridge port binding table management entity defined by the present invention, a MAC bridge port configuration management entity, and a physical channel endpoint Ethernet user network interface management entity;

3 is a flowchart of setting a binding table size and a binding mode according to an embodiment of the present invention; FIG. 4 is a flowchart of adding a binding table entry according to an embodiment of the present invention;

FIG. 5 is a flowchart of deleting a binding table entry according to an embodiment of the present invention;

6 is a flowchart of processing a service flow according to an embodiment of the present invention;

FIG. 7 is a block diagram of a system according to an embodiment of the present invention. detailed description

The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

2 is a relationship diagram of a MAC bridge port binding table management entity defined by the present invention, a MAC bridge port configuration management entity, and a physical channel endpoint Ethernet user network interface management entity. As shown in FIG. 2, an ONU or an ONT creates a MAC bridge. When the port configuration management entity instance automatically creates an instance of the MAC bridge port binding table management entity defined in the present invention, the MAC bridge port binding table management entity passes the same management entity identifier as the MAC bridge port configuration management entity, and The MAC bridge port configuration management entity is associated; the MAC bridge port configuration management entity is associated with the Ethernet user port by a pointer to the physical channel endpoint Ethernet user network interface management entity, thereby implementing the MAC bridge port binding table management entity and Correspondence of Ethernet user ports. The MAC bridge port binding table management entity and related attributes of the present invention are newly added management entities for binding an IP address, a MAC address, and an Ethernet user port, and the MAC bridge port binding table management entity Each instance includes a management entity identifier, a binding mode, a binding table size, and a binding table.

The management entity identifier is a unique identifier of each instance of the MAC bridge port binding table management entity, and is a read-only identifier, which is the same as the management entity identifier in the MAC bridge port configuration management entity, and represents a MAC bridge. The port configuration management entity is associated. The binding mode is a readable and writable port address binding mode, including a forward binding set to "1" and a reverse binding set to "0", wherein the forward binding represents a port Only the data source and the source MAC address in the data frame are allowed to pass through the data frame in the binding table. The reverse binding indicates that the port only allows the source IP address and the source MAC address in the data frame to not exist in the binding. The data frames in the table pass, and in addition, you can set the reserved bits.

The binding table size is used to define a maximum number of entries in the binding table that can store an IP address and a MAC address, and the binding table size is readable and writable.

The binding table is configured to save the IP address and MAC address of the user host associated with the MAC bridge port, and determine whether to forward the data frame entering the MAC bridge port according to the binding mode. After the configuration is complete, if the source IP address and the source MAC address of the data frame received by the ONU or the ONT through the Ethernet user port are in the binding table, the data frame is forwarded when the binding mode is forward binding. If the source IP address and the source MAC address of the data frame received by the ONU or ONT through the Ethernet user port do not exist in the binding table, the binding mode is forward binding. The data frame is discarded when it is fixed, and the data frame is forwarded when the binding mode is reverse binding. The binding entry in the binding table contains the IP address and MAC address of the user host, and also includes the entry number and the binding nature of the entry.

The entry number is an index identifier of a binding entry in a MAC bridge port binding table management entity. The item binding properties include an entry binding property set to "1" indicating addition and an entry binding property indicating deletion of "0".

When the MAC bridge port binding table management entity is initialized, the ONU or ONT sets the binding table to null.

FIG. 3 is a flowchart of setting a binding table size and a binding mode according to an embodiment of the present invention. As shown in FIG. 3, the steps include:

Step 301: The management unit sets a binding message indicating a binding table size and a binding mode, where the binding message includes an ONT or ONU identifier information, an Ethernet user port identifier information, and a binding table. Size information, binding mode information, and send the binding message to the OLT.

Step 302: The binding message received by the OLT 4B generates a configuration message, and sends the configuration message to the ONU or the ONT through the OMCC channel.

The configuration message includes management entity identification information, binding table size information, and binding mode information. The management entity identifier information is derived from the Ethernet user port identifier information set by the management unit, and is the same as the identifier of the MAC bridge port configuration management entity instance that points to the Ethernet user port, and is used to correspond to the Ethernet user port.

Step 303: The ONU or the ONT sets the binding table size information and the binding mode information of the instance specified by the management entity identifier information in the MAC bridge port binding table management entity according to the configuration message, and returns a configuration response message after the setting is completed.

FIG. 4 is a flowchart of adding a binding table entry according to an embodiment of the present invention. As shown in FIG. 4, the steps include:

Step 401: The management unit sets a binding message for adding a binding entry, and sends the binding message to the OLT.

The binding message includes ONU or ONT identification information, Ethernet user port identification information, binding entry number information, information indicating the binding nature of the added entry, and IP address and MAC address information to be bound.

Step 402: The OLT generates a configuration message according to the received binding message, and sends the configuration message to the ONU or the ONT through the OMCC channel.

The binding message includes management entity identifier information, and add binding entry information. The management entity identifier information is derived from the Ethernet user port identifier information set by the management unit, and is the same as the identifier of the MAC bridge port configuration management entity instance that points to the Ethernet user port, and is used to correspond to the Ethernet user port; The adding binding entry information includes an item number, an item binding property, an IP address, and a MAC address.

Step 403: The ONU or the ONT binds the table to the MAC bridge port according to the received configuration message. Set the management entity identification information to specify the binding table of the instance, and add the binding entry information including the entry number, the added entry binding property, the IP address, and the MAC address in the binding table, and return the configuration response after the setting is completed. Message.

FIG. 5 is a flowchart of deleting a binding table entry according to an embodiment of the present invention. As shown in FIG. 5, the steps are as follows:

Step 501: The management unit sets a binding message for deleting the binding entry, and sends the binding message to the OLT.

The binding message includes an ONT or ONT identification information, an Ethernet user port identification information, a binding entry number information, an entry binding property information indicating deletion, and an IP address and MAC address information to be deleted.

Step 502: The OLT generates a configuration message according to the received binding message, and sends the configuration message to the ONU or the ONT through the OMCC channel.

The configuration message includes management entity identifier information, and deletion binding entry information. The management entity identifier information is derived from the Ethernet user port identifier information set by the management unit, and is the same as the identifier of the MAC bridge port configuration management entity instance that points to the Ethernet user port, and is used to correspond to the Ethernet user port; The delete binding entry information includes an entry number, an entry binding property, an IP address, and a MAC address.

Step 503: The ONU or the ONT sets the binding table of the specified instance of the management entity identification information in the MAC bridge port binding table management entity according to the received configuration message, and deletes the entry binding property including the entry number and the deletion in the binding table. Binding entry information of the IP address and the MAC address, and returning the configuration response message after the setting is completed.

FIG. 6 is a flowchart of processing a data frame according to an embodiment of the present invention, as shown in FIG.

Step 601: The ONU or the ONT receives the data frame.

Step 602: The ONT or the ONU receives the data frame through the Ethernet user port and parses it to obtain After the IP address and MAC address of the data frame, look up the binding table corresponding to the Ethernet user port receiving the data frame in the MAC bridge port binding table management entity to find whether there is an IP address and a MAC address and the received data frame. The binding entry with the same IP address and MAC address, if yes, proceeds to step 603, and if not, proceeds to step 606.

Step 603: The ONT or the ONU determines whether the binding mode of the Ethernet user port that receives the data frame is forward binding. If it is forward binding, proceed to step 604. If it is reverse binding, proceed to step 605.

Step 604: The ONT or the ONU forwards the data frame.

Step 605: The ONT or ONU discards the data frame.

Step 606: The ONT or the ONU determines whether the binding mode of the Ethernet user port that receives the data frame is forward binding. If it is forward binding, proceed to step 607. If it is reverse binding, proceed to step 608.

Step 607: The ONT or the ONU discards the data frame.

Step 608: The ONT or the ONU forwards the data frame.

FIG. 7 is a block diagram of a system according to an embodiment of the present invention. As shown in FIG. 7, the system includes a management unit (701), an OLT (702), and an ONU or ONT (703). among them,

a management unit (701), configured to set a binding message of the binding port address, and send the binding message to the OLT (702);

The OLT (702) is configured to receive a binding message sent by the management unit, generate a configuration message according to the binding message, and send the configuration message to the ONU or the ONT through the OMCC channel;

The configuration message includes a configuration message for adding a binding entry obtained by the binding message, a configuration message for deleting a binding entry, and a configuration message for configuring a binding mode and a binding table size.

The configuration message for adding the binding entry includes management entity identifier information originating from the Ethernet user port identification information set by the management unit, adding binding entry information; The destination information includes the entry number, the added binding nature of the entry, the IP address, and the MAC address. The configuration message for deleting the binding entry includes management entity identifier information originating from the Ethernet user port identification information set by the management unit, deleting the binding entry information; the deleting binding entry information including the entry number, indicating the deleted entry Binding properties, IP address, and MAC address.

The configuration message used to configure the binding mode and binding table size contains management entity identifier information, binding table size information, and binding mode information derived from the Ethernet user port identification information set by the management unit.

The ONU or the ONT ( 703 ) is configured to set an instance of the management entity identifier information in the MAC bridge port binding table management entity according to the configuration message, and bind the address binding table and the binding according to the MAC bridge port binding table management entity. The mode forwards or discards the received data frame.

The management unit (701) sends the binding message for the port address binding to the OLT through a simple network management protocol (SNMP) message, and the OLT (702) receives the binding sent by the management unit (701). After the message is generated according to the binding message, the configuration message is sent to the ONU or ONT through the OMCC channel (703), and the ONU or ONT (703) sets the MAC bridge port binding table management entity according to the configuration message. If the configuration message is a configuration message for configuring the binding mode and the binding table size, modify the binding mode information and the binding table size information in the MAC bridge port binding table management entity; if the configuration message is the configuration of adding the binding entry The message, in the MAC bridge port binding table management entity instance, adds the binding entry number information, indicates the added entry binding property, the IP address to be added, and the MAC address information; if the configuration message is a configuration message for deleting the binding entry , delete the binding entry of the corresponding binding entry number in the instance of the MAC bridge port binding table management entity.

In summary, the present invention uses the MAC bridge port binding table management entity to bind the IP address and MAC address of the user host to the Ethernet user port, thereby realizing complete control of user rights in the network and solving the user. The MAC address flood attack and IP address theft in the network enhance the security of the user network; in addition, the MAC bridge port binding table management entity and The IP address and MAC address entries of the user host bound to the Ethernet user port can be freely configured, including freely adding and deleting binding entries, and optionally binding the binding mode of the entry, which is very convenient and flexible.

Although the invention has been described in detail above, the invention is not limited thereto, and various modifications may be made by those skilled in the art in accordance with the principles of the invention. Therefore, modifications made in accordance with the principles of the present invention should be construed as falling within the scope of the present invention.

Claims

Claim

A method for configuring port address binding, the method includes: setting a binding message including a user host IP address, a MAC address, and an Ethernet user port identifier, and sending the binding message to the light Line terminal OLT;

2. The configuration method according to claim 1, wherein the method further comprises: the MAC bridge port binding table management entity, by using the same management entity identifier as the MAC bridge port configuration management entity, and pointing to the Ethernet The MAC bridge port configuration management entity of the network user port corresponds.

The configuration method according to claim 1 or 2, wherein the configuration message includes a configuration message for adding a binding entry obtained by using the binding message, and a configuration message for deleting a binding entry. And configuration messages for configuring the binding mode and binding table size.

The configuration method according to claim 3, wherein the method further comprises: after the configuration is completed, if an IP address and a MAC address of the data frame received by the ONU or the ONT through the Ethernet user port are present in the MAC bridge port In the binding table of the binding table management entity, the binding mode of the Ethernet user port that receives the data frame is forwarded when the binding is forwarded, and the binding mode is the data binding in the reverse binding. frame.

The configuration method according to claim 4, wherein the method further comprises: after the configuration is completed, if the IP address and MAC address of the data frame received by the ONU or the ONT through the Ethernet user port do not exist in the MAC bridge In the binding table of the port binding table management entity, the binding mode of the Ethernet user port that receives the data frame is a data frame that is forwarded when the binding is reversed. The binding mode is to discard data frames when forward binding.

The configuration method according to claim 3, wherein when the configuration message received by the ONU or the ONT is a configuration message for adding a binding entry, the ONU or the ONT is bound on the MAC bridge port. A binding entry including an entry number, an added entry binding property, an IP address, and a MAC address is added to the table management entity.

The configuration method according to claim 3, wherein when the configuration message received by the ONU or the ONT is a configuration message for deleting a binding entry, the ONU or the ONT is bound on the MAC bridge port. The table management entity deletes the binding entry including the entry number, the binding binding property indicating the deletion, the IP address, and the MAC address.

The configuration method according to claim 3, wherein when the configuration message received by the ONU or the ONT is a configuration message for configuring a binding mode and a binding table size, the ONU or the ONT is Binding mode information and binding table size information are configured in the MAC bridge port binding table management entity.

A system for implementing port address binding, the system includes: a management unit, configured to set a binding message including a user host IP address, a MAC address, and an Ethernet user port identifier, and bind the binding message Sending a message to the optical line terminal OLT;

10. The system according to claim 9, wherein the MAC bridge port binding table management entity has the same management entity identifier as the MAC bridge port configuration management entity, and a MAC bridge port that points to an Ethernet user port. The configuration management entity corresponds.