WO2012053109A1

WO2012053109A1 - Communication control device, transmission device, reception device, communication system, and communication control method

Info

Publication number: WO2012053109A1
Application number: PCT/JP2010/068742
Authority: WO
Inventors: 佐藤　昌幸
Original assignee: 三菱電機株式会社
Priority date: 2010-10-22
Filing date: 2010-10-22
Publication date: 2012-04-26
Also published as: JP5465335B2; JPWO2012053109A1

Abstract

This communication control device is in a transmission device that transmits standard MACsec frames that are frames that have been encrypted by means of MACsec, and expanded MACsec frames that are frames that have been encrypted by means of MACsec including the addresses of the destination and transmission source, and is provided with a type encoding unit (2) that, when transmitting transmission frames as expanded MACsec frames, stores predetermined values, which indicate that the transmission frames are expanded MACsec frames, as type information of the transmission frames.

Description

COMMUNICATION CONTROL DEVICE, TRANSMISSION DEVICE, RECEPTION DEVICE, COMMUNICATION SYSTEM, AND COMMUNICATION CONTROL METHOD

The present invention relates to a communication control device, a transmission device, a reception device, a communication system, and a communication control method.

There is MACsec (MAC (Media Access Control) Security) defined in IEEE802.1AE as a technology for encrypting communication (see Non-Patent Document 1 below), but MACsec cannot encrypt a MAC address in a frame.

Therefore, by adding a MAC-in-MAC method (see Non-Patent Document 2 below) that encapsulates frames specified in IEEE802.1AH (Provider Backbone Bridge) to MACsec, encryption is performed up to the MAC address. A method to make it possible is being studied. Hereinafter, this method is referred to as an extended MACsec method.

In the extended MACsec method, the original destination and the source MAC address are stored after the SecTAG area that stores information used in MACsec, and the pseudo MAC address is stored before the SecTAG area. In the receiving apparatus, when a frame transmitted by the extended MAC method is received, the pseudo MAC address is unnecessary and is deleted, and the original destination and the source MAC address stored after the SecTAG area are deleted. As the MAC address.

On the other hand, in the standard MACsec method (a method in which MAC in MAC is not applied), the original destination and the source MAC address are stored before the SecTAG area. Accordingly, when receiving a frame transmitted by the standard MAC method, the receiving device recognizes the original destination and the source MAC address stored before the SecTAG area as the destination and source MAC addresses.

On the other hand, when a single communication apparatus communicates with both a device adopting the above-described extended MACsec method and a device adopting the standard MACsec method, reception processing of both the extended MACsec method and the standard MACsec method is performed. Will do.

Whether to use the extended MACsec method or the standard MACsec method is normally set by negotiation after connection between communication devices. However, if an error occurs during this negotiation, etc., there is a possibility that either the extended MACsec method or the standard MACsec method will be set incorrectly on the receiving side, or it may be set as unknown There is.

Also, the receiving device cannot determine from the frame itself whether the frame is transmitted by the extended MACsec method or the standard MACsec method. For this reason, for example, when a reception process is performed on a frame transmitted by the standard MACsec method using the extended MACsec method, there is a problem that a normal (original) MAC address is deleted. Conversely, when a frame transmitted using the extended MACsec method is received using the standard MACsec method, there is a problem in that omission of deletion of a MAC address (pseudo MAC address) to be deleted occurs.

Furthermore, even if such a problem occurs, the received frame itself is determined to be normal in error checks such as ICV (Integrity Check Value), FCS (Frame Check Sequence), etc. There was a problem of becoming.

The present invention has been made in view of the above, and when a frame is received, if both the extended MACsec method and the standard MACsec method can be received, erroneous processing due to a method selection error is performed. An object of the present invention is to obtain a communication control device, a transmission device, a reception device, a communication system, and a communication control method that can prevent problems caused by the implementation of.

In order to solve the above-described problems and achieve the object, the present invention provides a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of the destination and the transmission source. Identification information for storing a predetermined value indicating an extended MACsec frame at a predetermined bit position of the transmission frame when the transmission frame is transmitted as an extended MACsec frame A provision unit.

A communication control device, a transmission device, a reception device, a communication system, and a communication control method according to the present invention are used when a reception process of both the extended MACsec method and the standard MACsec method can be performed when a frame is received. There is an effect that it is possible to prevent problems caused by erroneous processing due to selection errors.

FIG. 1 is a diagram illustrating a functional configuration example of a transmission control unit of the transmission apparatus according to the first embodiment. FIG. 2 is a diagram illustrating a functional configuration example of the reception control unit of the receiving apparatus according to the first embodiment. FIG. 3 is a diagram illustrating a functional configuration example of the communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of the communication system according to the first embodiment. FIG. 5 is a diagram showing the structure of a standard MACsec frame. FIG. 6 is a diagram illustrating the configuration of an extended MACsec frame. FIG. 7 is a flowchart illustrating an example of the receiving operation according to the first embodiment. FIG. 8 is a diagram illustrating an example of a change in the frame format of the extended MACsec frame at the time of reception. FIG. 9 is a diagram illustrating an example of a communication sequence in the communication system according to the first embodiment. FIG. 10 is a flowchart illustrating an example of a receiving operation according to the second embodiment. FIG. 11 is a flowchart illustrating an example of a receiving operation according to the third embodiment. FIG. 12 is a flowchart illustrating an example of a receiving operation according to the fourth embodiment. FIG. 13 is a diagram illustrating a functional configuration example of the reception control unit of the receiving apparatus according to the fifth embodiment. FIG. 14 is a flowchart illustrating an example of a receiving operation according to the fifth embodiment. FIG. 15 is a flowchart illustrating an example of a receiving operation according to the sixth embodiment. FIG. 16 is a diagram illustrating a functional configuration example of a transmission control unit of the transmission apparatus according to the seventh embodiment. FIG. 17 is a diagram illustrating a functional configuration example of the reception control unit of the receiving apparatus according to the seventh embodiment. FIG. 18 is a flowchart illustrating an example of a standard MACsec frame reception operation according to the seventh embodiment. FIG. 19 is a flowchart illustrating an example of an operation for receiving an extended MACsec frame according to the seventh embodiment.

Hereinafter, embodiments of a communication control device, a transmission device, a reception device, a communication system, and a communication control method according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a functional configuration example of a first embodiment of a transmission control unit of a transmission apparatus according to the present invention. Moreover, FIG. 2 is a figure which shows the function structural example of the reception control part of the receiver of this Embodiment. In this embodiment, a frame encrypted by the transmission device is transmitted to the reception device, and the frame received by the reception device is decrypted.

In the present embodiment, the transmission device and the reception device constitute a PON (Passive Optical Network) system, but any communication system may be configured without being limited to the PON system.

As shown in FIG. 1, the transmission control unit of the transmission apparatus according to the present embodiment includes a transmission frame generation unit 1, a Type encoding unit 2, a MACsec SecTAG encoding unit 3, a standard MACsec SecTAG generation unit 4, and an extended MACsec SecTAG generation unit. 5, packet number giving unit 6, extended MACSec preamble generation unit 7, key management unit 8, data encryption unit 9, ICV generation unit 10, pseudo MAC address generation unit 11, PON control unit 12, FCS addition unit 13 and preamble addition unit 14.

As shown in FIG. 2, the reception control unit of the receiving apparatus according to the present embodiment includes a preamble check unit 101, an FCS check unit 102, a PON control unit 103, a received frame identification / decoded frame reconstruction unit 104, and a Type check unit. 105, frame determination unit 106, SecTAG decoding unit 107, extended MACsec SecTAG check unit 108, standard MACsec SecTAG check unit 109, replay check unit 110, SC / AN confirmation unit 111, key management unit 112, data decoding unit 113, and normality A confirmation (ICV check) unit 114 is provided.

FIG. 3 is a diagram illustrating a functional configuration example of the communication apparatus according to the present embodiment. The communication device 200 shown in FIG. 3 is a communication device having both the function as the transmission device and the function as the reception device shown in FIG. 1, and is an OLT (Optical Line Terminal: station side communication device) in the PON system or It functions as an ONU (Optical Network Unit). As shown in FIG. 3, the communication apparatus 200 includes a WDM (Wavelength Division Multiplex) 201, an optical Tx (optical transmitter) 202, an optical Rx (optical receiver) 203, a PON-LSI (Large Scale Integration). ) 204 and an interface 205. Further, the communication device 200 is connected to the upper network 210. The PON-LSI 204 that performs communication control is connected to a management apparatus 211 that manages apparatus operations. In some cases, it is connected to a terminal (user device) instead of the host network 210.

The PON-LSI 204 is a communication control device including a transmission control unit in the above-described transmission device and a reception control unit in the reception device. In FIG. 3, components having functions similar to those in FIG. 1 or FIG. The encryption unit 206 includes the transmission frame generation unit 1 of FIG. 1, the Type encoding unit 2, the MACsec SecTAG encoding unit 3, the standard MACsec SecTAG generation unit 4, the extended MACsec SecTAG generation unit 5, the packet number granting unit 6, and the extended MACSec preamble generation. Unit 7, key management unit 8, data encryption unit 9, ICV generation unit 10, and pseudo MAC address generation unit 11.

Also, the decoding unit 207 includes a received frame identification / decoded frame reconstruction unit 104, a type check unit 105, a frame determination unit 106, a SecTAG decoding unit 107, an extended MACsec SecTAG check unit 108, a standard MACsec SecTAG check unit 109, a replay check. Unit 110, SC / AN confirmation unit 111, key management unit 112, data decryption unit 113, and normality confirmation unit 114.

FIG. 4 is a diagram illustrating a configuration example of the communication system according to the present embodiment. As shown in FIG. 4, the communication system of the present embodiment is a PON system, and OLT 301 that is communication apparatus 200 shown in FIG. 3 and ONUs 302-1 to 302-N that are communication apparatuses 200 shown in FIG. (N is an integer of 1 or more).

In the present embodiment, for example, the communication system shown in FIG. 4 includes a MACsec (standard MACsec) method defined by IEEE 802.1AE and an extended MACsec in which a MAC in MAC method is added to the standard MACsec method. It is possible to cope with both communication by a method. Accordingly, the OLT 301 has a function of performing both transmission and reception by the standard MACsec method and transmission and reception by the extended MACsec method. Note that the ONUs 302-1 to 302-N are configured so that both transmission / reception using the standard MACsec method and transmission / reception using the extended MACsec method can be performed here. It is good also as a structure which implements transmission / reception.

FIG. 5 is a diagram showing a frame configuration in which a preamble area storing information used in the PON system is provided immediately before a MACsec (standard MACsec) frame defined by IEEE802.1AE. FIG. 6 is a diagram showing a frame configuration in which a preamble area is also provided immediately before an extended MACsec frame. This preamble area is defined by IEEE 802.3.

Here, as shown in FIG. 5, the MACsec (standard MACsec) method frame defined by IEEE802.1AE is added to the preamble area as a standard MACsec frame, and the following description will be given. The standard MACsec frame includes a preamble, DA (Destination Address: destination MAC address), SA (Source Address: source MAC address), SecTAG, Data, ICV, and FCS.

In the preamble, LLID (Logical Link IDentifier) is stored after storing 5 “0x55” based on the EPON specification of IEEE 802.3ah, and then 8-bit CRC (Cyclic Redundancy Check) 8 is stored. .

SecTAG is information used for MACsec. Type, which is Type information for identifying the type of frame, TCI (TAG Control Information), and AN (Association), which is the SA identification number in the same SC (Secure Channel). Number), SL (Short Length) which is information about the length of the encrypted data, PN (Packet Number) which is a packet identifying number, and SCI (Secure Channel IDentifier) which is identification information of SC. , Is composed.

The TCI includes a V bit indicating the MACsec version, an ES (End Station) bit, an SC bit indicating the presence of an SCI field, an SCB (Single Copy Broadcast) bit, a C bit indicating information on the ICV, And an E bit indicating the presence or absence of encryption.

On the other hand, an extended MACsec frame (hereinafter referred to as an extended MACsec frame) to which a MAC in MAC method is added is also an extended MACsec frame including a preamble area, as shown in FIG. 6, and includes a preamble, pseudo DA, pseudo SA, and SecTAG. , DA, SA, Data, ICV and FCS.

In the extended MACsec frame, DA (destination MAC address) and SA (source MAC address) are stored between the encrypted Data and SecTAG in the same manner as the standard MACsec frame. In the extended MACsec frame, pseudo DA and pseudo SA are stored at the positions where DA (destination MAC address) and SA (source MAC address) are stored in the standard MACsec frame.

Hereinafter, the operation of the present embodiment will be described based on the configuration example shown in FIG. First, the transmission operation of the transmission apparatus will be described. The transmission frame generation unit 1 of the transmission device (OLT 301 or ONUs 302-1 to 302-N) receives transmission data from the upper network 210 (or a terminal or the like), and is information related to encryption regarding the transmission data from the management device 211. Receive encryption information. The encryption information includes information indicating whether to perform encryption, information for determining whether to transmit as a standard MACsec frame or an extended MACsec frame, information used for encryption when performing encryption (encryption key) And the like) are included.

The transmission frame generation unit 1 notifies the encryption information to the type encoding unit 2. The Type encoding unit 2 generates Type information based on the notified encryption information from the transmission frame generating unit 1 and notifies the MACsec SecTAG encoding unit 3 of the generated Type information. Specifically, “0x88E5” defined by IEEE802.1AE is generated as Type information when transmitting with a standard MACsec frame, and “0x88E4” is generated when transmitting with an extended MACsec frame. In the present embodiment, the Type information when transmitting in the extended MACsec frame is set to “0x88E4”. However, the Type information is not limited to “0x88E4”, and any value that is not preliminarily defined by the standard or the like as Type information may be used. Any numerical value may be used.

If the transmission frame generation unit 1 determines that the transmission is performed using the standard MACsec frame based on the encryption information, the transmission frame generation unit 1 instructs the standard MACsec SecTAG generation unit 4 to generate the SecTAG. When the standard MACsec SecTAG generation unit 4 is instructed by the transmission frame generation unit 1 to generate a SecTAG, the standard MACsec SecTAG generation unit 4 generates a SECTAG (SecTAG other than Type information) defined by IEEE802.1AE and notifies the MACsec SecTAG encoding unit 3 To do.

On the other hand, if the transmission frame generation unit 1 determines to transmit in the extended MACsec frame based on the encryption information, the transmission frame generation unit 1 instructs the extended MACsec SecTAG generation unit 5 to generate a SecTAG. When the generation of SecTAG is instructed from the transmission frame generation unit 1, the extended MACsec SecTAG generation unit 5 generates SecTAG (SecTAG other than Type information) defined in IEEE802.1AE and notifies the MACsec SecTAG encoding unit 3 To do.

In this embodiment, the SecTAG (excluding Type information and PN) generated by the extended MACsec SecTAG generation unit 5 and the SecTAG (excluding Type information and PN) generated by the standard MACsec SecTAG generation unit 4 are the same. The standard MACsec SecTAG generation unit 4 may have the function of the extended MACsec SecTAG generation unit 5 without including the extended MACsec SecTAG generation unit 5.

The packet number giving unit 6 generates a packet number and notifies the generated packet number (PN) to the MACsec SecTAG encoding unit 3.

The MACsec SecTAG encoding unit 3 provides the type information notified from the type encoding unit 2, the SecTAG (excluding type information and PN) notified from the standard MACsec SecTAG generation unit 4 or the extended MACsec SecTAG generation unit 5, and packet number assignment. The PN notified from the unit 6 is encoded and notified to the transmission frame generating unit 1 as an encoded SecTAG.

When the transmission frame generation unit 1 determines to perform encryption based on the encryption information, the transmission frame generation unit 1 notifies the key management unit 8 and the data encryption unit 9 to that effect. At this time, the transmission frame generation unit 1 notifies the key management unit 8 and the data encryption unit 9 of information used for encryption included in the encryption information. Further, the transmission frame generation unit 1 outputs transmission data to the data encryption unit 9. The key management unit 8 uses information necessary for selecting an encryption key (LLID, MAC address, SCI, etc.) out of information used for encryption from an encryption key held in advance according to IEEE 802.1AE regulations. And the data encryption unit 9 is notified of the selected encryption key.

The data encryption unit 9 uses the transmission data output from the transmission frame generation unit 1 and the encryption key notified from the key management unit 8 to generate encrypted data obtained by encrypting the transmission data in accordance with the IEEE 802.1AE regulations. The encrypted data is output to the transmission frame generation unit 1 and the ICV generation unit 10. When transmitting as an extended MACsec frame, the transmission frame generation unit 1 passes the MAC address of the destination and the transmission source together with the transmission data to the data encryption unit 9, and the data encryption unit 9 transmits the transmission destination MAC address and the MAC address of the transmission source. Encrypt data. The ICV generation unit 10 generates an ICV (Integrity Check Value) according to the IEEE802.1AE standard using the encrypted data, and notifies the transmission frame generation unit 1 of the ICV.

Further, when the transmission frame generation unit 1 determines to transmit in the extended MACsec based on the encryption information, the transmission frame generation unit 1 instructs the extended MACsec preamble generation unit 7 to generate a preamble. The extended MACsec preamble generation unit 7 generates a preamble based on an instruction from the transmission frame generation unit 1 and notifies the preamble addition unit 14 of the generated preamble. In the present embodiment, the extended MACsec preamble generation unit 7 generates a preamble similar to the preamble in the case of a standard MACsec frame in order to generate a preamble compliant with the IEEE standard. Therefore, the extended MACsec preamble generation unit 7 may not be provided.

Further, when the transmission frame generation unit 1 determines to transmit in extended MACsec based on the encryption information, the transmission frame generation unit 1 instructs the pseudo MAC address generation unit 11 to generate a pseudo MAC address. When receiving a pseudo MAC address generation instruction from the transmission frame generation unit 1, the pseudo MAC address generation unit 11 generates a pseudo MAC address (pseudo DA, pseudo SA) and notifies the transmission frame generation unit 1 of the pseudo MAC address. In the present embodiment, the pseudo MAC address generation unit 11 can generate an arbitrary pseudo MAC address.

When transmitting the transmission data as an extended MACsec frame, the transmission frame generation unit 1 encodes the SecTAG notified from the MACsec SecTAG encoding unit 3, the encrypted data received from the data encryption unit 9, and the ICV generation unit. The transmission frame excluding the FCS and the preamble part is generated in the format shown in FIG. 6 using the ICV notified from 10 and the pseudo MAC address notified from the pseudo MAC address generation unit 11.

Further, when transmitting the transmission data as a standard MACsec frame, the transmission frame generation unit 1 encodes the coded SecTAG notified from the MACsec SecTAG encoding unit 3, the encrypted data received from the data encryption unit 9, Using the ICV notified from the ICV generation unit 10, a transmission frame excluding the FCS and the preamble portion is generated in the format shown in FIG. 5 and output to the PON control unit 12.

The PON control unit 12 is a function for performing transmission timing control by the PON architecture, and outputs a transmission frame to the FCS adding unit 13 by transmission control corresponding to the PON architecture. Specifically, in the case of the PON control unit 12 of the OLT 301, the transmission timing to each ONU (downlink transmission timing) and the transmission timing from each ONU (uplink transmission timing) are determined, and the transmission destination ONU is supported. A transmission frame is output based on the downlink transmission timing to be performed. In the case of the PON control unit 12 of the ONUs 302-1 to 302-N, a transmission frame is output based on the downlink transmission timing assigned to the own device notified from the OLT 301.

The FCS appending unit 13 calculates the FCS of the transmission frame, appends the calculated FCS to the transmission frame, and outputs the transmitted transmission frame to the preamble appending unit 14. The preamble assigning unit 14 assigns a preamble to the received transmission frame and outputs it to the optical Tx 202. The preamble assigning unit 14 assigns the notified preamble when the preamble is notified from the extended MACsec preamble generating unit 7, and assigns the IEEE802.3-compliant preamble otherwise.

The transmission frame after the preamble is added is converted into an optical signal by the optical Tx 202, multiplexed by the WDM 201, and transmitted to the destination.

Next, the receiving operation of the receiving apparatus of this embodiment will be described. FIG. 7 is a flowchart illustrating an example of a reception operation according to this embodiment. As shown in FIG. 7, when the receiving apparatus receives a frame via the WDM 201 and the optical Rx 203 (step S1), the preamble check unit 101 confirms the normality of the preamble according to IEEE 802.3 (step S2). The received frame from which the preamble part is deleted is output to the FCS check unit 102.

Next, the FCS check unit 102 performs an FCS check based on the received frame (step S3), and outputs the received frame from which the FCS has been deleted to the PON control unit 103. Further, the PON control unit 103 performs reception timing control by the PON architecture and identification of a frame addressed to the own receiver, and outputs a received frame addressed to the own device to the received frame identification / decoded frame reconstruction unit 104 (step S4).

Note that when the received frame is a standard MACsec frame, the PON control unit 103 can determine whether the received frame is addressed to the own apparatus based on the SA and DA after the preamble. On the other hand, in the case of an extended standard MACsec frame, pseudo SA and pseudo DA are stored after the preamble. Therefore, when determining whether or not the received frame is addressed to the own apparatus by the pseudo SA and pseudo DA, when generating the pseudo SA and pseudo DA in the transmitting apparatus, for example, based on the LLID as the pseudo SA and pseudo DA. Such information is stored as information that can be used to determine whether the received frame is addressed to the own apparatus.

Further, the preamble check unit 101 determines whether the received frame is addressed to the own device based on the LLID included in the preamble, and determines whether the received frame is addressed to the own device in the PON control unit 103. The determination may not be performed.

The received frame identification / decoded frame reconstruction unit 104 extracts type information from the received frame and notifies the type information to the type check unit 105. The type check unit 105 determines whether or not the type information is “0x88E5” (step S5). If the type information is “0x88E5”, the type check unit 105 determines that the received frame is a standard MACsec frame, and determines that frame. Notification to the unit 106.

When it is notified from the type check unit 105 that the received frame is a standard MACsec frame, the frame determination unit 106 notifies the received frame identification / decoded frame reconstruction unit 104 to that effect. When receiving the notification, the received frame identifying / decoded frame reconstructing unit 104 instructs the SecTAG decoding unit 107 to start decoding and extracts and outputs the SecTAG from the received frame. At this time, the received frame identification / decoded frame reconstruction unit 104 also notifies the SecTAG decoding unit 107 that the received frame is a standard MACsec frame. The SecTAG decoding unit 107 decodes the SecTAG output from the received frame identification / decoded frame reconstruction unit 104, and outputs the decoded SecTAG to the standard MACsec SecTAG check unit 109, the replay check unit 110, and the SC / AN confirmation unit 111 (step S6). ).

The standard MACsec SecTAG check unit 109 performs a SECTAG confirmation process defined in IEEE 802.1AE, and notifies the frame determination unit 106 of the determination result (step S7).

The replay check unit 110 performs a replay protection check defined by IEEE802.1AE based on the PN in the SecTAG, and notifies the frame determination unit 106 of the check result (step S8).

SC / AN confirmation unit 111 confirms SC and AN, and notifies SC and AN to key management unit 112 (step S9). Next, the key management unit 112 selects an encryption key based on SC and AN from among the encryption keys held in advance, and notifies the data decryption unit 113 of the selected encryption key (step S10).

The data decryption unit 113 acquires the reception frame from the reception frame identification / decryption frame reconstruction unit 104, decrypts the reception frame using the encryption key notified from the key management unit 112, and normalizes the decrypted data. It outputs to the confirmation part 114 (step S11).

The normality confirmation unit 114 performs an ICV check (normality confirmation) based on the ICV acquired from the received frame identification / decoded frame reconstruction unit 104 and the decoded data output from the data decoding unit 113 (step S12). ), And notifies the frame determination unit 106 of the check result.

If the check result is normal (Yes in step S12), the frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 to that effect, and the reception frame identification / decoded frame reconstruction unit 104 When the notification is received, the standard MACsec frame is reconstructed (step S13), and the frame reception is completed (step S15).

In addition, when the check result notified from the normality confirmation unit 114 is not normal (No in step S12), the frame determination unit 106 re-receives the received frame identification / decoded frame so that the frame is discarded. The configuration unit 104 is instructed, and the process ends (step S14).

On the other hand, when the Type check unit 105 determines in Step S5 that the Type information is not “0x88E5” (No in Step S5), the Type check unit 105 determines whether or not the Type information is “0x88E4” ( Step S16). When the Type information is “0x88E4” (Yes in Step S16), the Type check unit 105 determines that the received frame is an extended MACsec frame and notifies the frame determination unit 106 to that effect.

When it is notified from the type check unit 105 that the received frame is an extended quasi-MACsec frame, the frame determination unit 106 notifies the received frame identification / decoded frame reconstruction unit 104 to that effect. When receiving the notification, the received frame identifying / decoded frame reconstructing unit 104 instructs the SecTAG decoding unit 107 to start decoding and extracts and outputs the SecTAG from the received frame. At this time, the received frame identification / decoded frame reconstruction unit 104 also notifies the SecTAG decoding unit 107 that the received frame is an extended MACsec frame. The SecTAG decoding unit 107 decodes the SecTAG output from the received frame identification / decoded frame reconstruction unit 104 and outputs the decoded SecTAG to the extended MACsec SecTAG check unit 108, the replay check unit 110, and the SC / AN confirmation unit 111 (step S17). ).

The extended MACsec SecTAG check unit 108 performs a SECTAG confirmation process defined by IEEE 802.1AE and notifies the frame determination unit 106 of the determination result (step S18). In this embodiment, since the SECTAG confirmation process performed by the extended MACsec SecTAG check unit 108 and the SecTAG confirmation process performed by the standard MACsec SecTAG check unit 109 are the same, the extended MACsec SecTAG check unit 108 is not provided. In addition, the standard MACsec SecTAG check unit 109 may have a function as the extended MACsec SecTAG check unit 108.

Thereafter, Steps S19 to S23 are performed in the same manner as Steps S8 to S12. If the check result notified from the normality confirmation unit 114 is not normal in step S23 (No in step S23), the frame determination unit 106 receives the frame identification / decoded frame reconstruction unit 104 so as to discard the frame. To terminate the process (step S25).

If the check result is normal (Yes in step S23), the frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 to that effect, and receives the frame identification / decoded frame reconstruction unit. Upon receiving the notification, 104 reconstructs the extended MACsec frame (step S24), and completes frame reception (step S15).

If the Type information is not “0x88E4” in Step S16 (No in Step S16), the Type check unit 105 determines that the received frame is an unencrypted frame (not a standard MACsec frame or an extended MACsec frame). Then, the fact is notified to the frame determination unit 106. The frame determination unit 106 reconstructs the received frame as an unencrypted frame (step S26), and completes frame reception (step S15).

The received frame reconstructed by the received frame identifying / decoding frame reconstructing unit 104 by the above processing is transmitted to the upper network 210 (or terminal) via the interface 205. Note that the operations of the transmission device and the reception device described above are merely examples, and the order of individual processes may be different as long as the same processing results can be obtained.

As described above, in the present embodiment, the Type encoding unit 2 of the transmission device functions as an identification information adding unit that stores a value indicating that it is an extended MACsec frame in the Type information. In the receiving apparatus, the type check unit 105 functions as an identification unit that identifies whether the frame is an extended MACsec frame based on the type information.

FIG. 8 is a diagram illustrating an example of a change in the frame format of the extended MACsec frame at the time of reception. First, at the stage of input to the preamble check unit 101 via the WDM 201 and the optical Rx 203, as shown in FIG. 8 (1), the Data portion is encrypted ciphertext, and the received frame has the format shown in FIG. It is. In the received frame output from the preamble check unit 101, the preamble is deleted as shown in FIG.

Furthermore, at the time of output from the FCS check unit 102, the FCS is deleted as shown in FIG. When the data is output from the data decryption unit 113, the portion of the ciphertext becomes a plaintext with the decrypted MAC (MAC address: SA, DA), and the received frame identification / decoded frame reconstruction unit 104 reconstructs it. A frame having the format shown in FIG. 8 (4) is output as a frame. 8 (1) and 8 (2) are FCSs from the pseudo MAC to ICV in FIG. 8 (1), and the FCS in FIG. 8 (4) is shown in FIG. 8 (4). FCS for MAC and plain text.

Next, a communication sequence in the communication system of the present embodiment will be described. FIG. 9 is a diagram illustrating an example of a communication sequence in the communication system according to the present embodiment. Here, the communication system shown in FIG. 4 is assumed. Then, it is assumed that any one of the ONUs 302-1 to 302-N is a standard MACsec operation ONU # 1 that transmits / receives a standard MACsec frame, and any one of the ONUs 302-1 to 302-N other than the ONU # 1 is an extension. Assume that the extended MACsec operation ONU # 2 transmits and receives a MACsec frame.

Suppose that the OLT 301 has a function as a receiving apparatus according to the present embodiment, and the ONU # 1 and ONU # 2 have a function as a transmitting apparatus according to the present embodiment.

As shown in FIG. 9, first, when ONU # 1 receives the Discovery Gate transmitted from OLT 301 (step S31), it transmits Register Request (# 1) to OLT 301 (step S32). The Discovery Gate is a message periodically transmitted by the OLT 301, and the Register Request is a message that the ONU # 1 requests the OLT 301 to register.

When the OLT 301 receives the Register Request from the ONU # 1, the OLT 301 transmits a Register (# 1) indicating that the ONU # 1 has been registered (step S33). When ONU # 1 receives Register (# 1), ONU # 1 transmits Register Ack (# 1) as a response to OLT 301 (step S34).

Steps S35 to S38 are also performed between the OLT 301 and the ONU # 2 as in the case between the OLT 301 and the ONU # 1.

Then, the OLT 301 transmits an inquiry about the MACsec operation (whether or not the extended MACsec operation is supported) to the ONU # 1 (step S39), and the ONU # 1 supports the extended MACsec operation as an answer to the inquiry. (Step S40). The OLT 301 determines that the extended MACsec operation is to be performed with the ONU # 1 based on the received answer, and instructs the extended MACsec operation to be set as the MACsec operation setting (step S41). ONU # 1 sets itself to perform the extended MACsec operation based on the instruction, and notifies the OLT 301 of the completion of the MACsec operation setting (step S42).

Also, the OLT 301 transmits an inquiry about the MACsec operation to the ONU # 2 (step S43), and the ONU # 2 notifies the inquiry that the extended MACsec operation is not supported (step S44). The OLT 301 determines that the standard MACsec operation is to be performed with the ONU # 2 based on the received answer, and instructs the standard MACsec operation to be set as the MACsec operation setting (step S45). The ONU # 2 sets itself to perform the standard MACsec operation based on the instruction, and notifies the OLT 301 of the completion of the MACsec operation setting (step S46).

Thereafter, ONU # 1 generates an extended MACsec frame 401 by extended MACsec processing (processing when the above-described transmission apparatus transmits an extended MACsec frame) (step S47), and the OLT 301 extends the extended MACsec frame 401. Reception processing (processing when the above-described receiving apparatus receives an extended MACsec frame) is performed by MACsec processing (step S48).

The ONU # 2 generates a standard MACsec frame 402 by standard MACsec processing (processing when the above-described transmission device transmits a standard MACsec frame) (step S49), and the OLT 301 is standard with respect to the standard MACsec frame 402. Reception processing (processing when the above-described receiving apparatus receives a standard MACsec frame) is performed by MACsec processing (step S50).

The communication sequence described above is merely an example, and is not limited to this. Whether the extended MACsec operation or the standard MACsec operation is performed before data transmission / reception between the OLT 301 and the ONUs 302-1 to 302-N. Any sequence may be used as long as an agreement such as (or not to perform encryption) can be agreed.

In the above communication sequence, when the agreement regarding the MACsec operation is made normal, there is no problem even if the reception process is performed by the conventional reception method. However, when the agreement regarding the MACsec operation is not normally made, the OLT 301 sets the type of the received frame (whether it is a standard MACsec frame or an extended MACsec frame) or the type becomes indefinite. In the conventional receiving method, a normal (original) MAC address is erroneously deleted, or a MAC address (pseudo MAC address) to be deleted is omitted.

On the other hand, in this embodiment, when the transmitting apparatus transmits an extended MACsec frame, a value indicating that it is an extended MACsec frame is stored as Type information, and the receiving apparatus uses an extended MACsec frame based on the Type information. Judgment whether or not there is. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the erroneous deletion of the MAC address or the deletion omission of the MAC address to be deleted.

Embodiment 2. FIG.
Next, a transmitting apparatus and a receiving apparatus according to the second embodiment of the present invention will be described. The configuration of the transmission device and the reception device of the present embodiment is the same as the configuration of the transmission device and the reception device of the first embodiment. Components having functions similar to those of the first embodiment are denoted by the same reference numerals as those of the first embodiment. Hereinafter, the description which overlaps with Embodiment 1 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In the present embodiment, the Type encoding unit 2 generates the same Type information as that of the standard MACsec frame even when the extended MACsec frame is transmitted. Then, the extended MACsec SecTAG generation unit 5 sets the SECTAG V (V bit) to “1”. Further, the standard MACsec SecTAG generation unit 4 sets the V bit of the SecTAG to a value (“0”) defined by IEEE 802.1AE. The operations of the transmitting apparatus other than those described above are the same as those in the first embodiment.

Next, the operation of the receiving device will be described. FIG. 10 is a flowchart illustrating an example of a reception operation according to this embodiment. Steps S1 to S6 are the same as steps S1 to S6 of the first embodiment. In this embodiment, in step S6, the SECTAG decoding process is performed in either frame without determining whether the frame is a standard MACsec frame or an extended MACsec frame.

After step S6, the extended MACsec SecTAG check unit 108 determines whether or not the SECTAG V bit is 0 (or the value of the standard MACsec frame) (step S30). When it is determined that the V bit is 0 (Yes in step S30), the extended MACsec SecTAG check unit 108 determines that the received frame is a standard MACsec frame, and notifies the frame determination unit 106 of the determination result. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result.

In step S7, as in step S1 of the first embodiment, the standard MACsec SecTAG check unit 109 confirms SecTAG (step S7). However, in this embodiment, since the V bit has been confirmed in step S30, the confirmation of the V bit may be omitted. The subsequent steps S8 to S15 are the same as in the first embodiment.

On the other hand, when it is determined that the V bit is not 0 (No in step S30), the extended MACsec SecTAG check unit 108 determines that the received frame is an extended MACsec frame, and notifies the frame determination unit 106 of the determination result. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. The subsequent step S18 is the same as that in the first embodiment.

In step S18, as in step S18 of the first embodiment, the extended MACsec SecTAG check unit 108 confirms SecTAG (step S18). However, in this embodiment, since the V bit is different from the standard, it is confirmed whether or not it is “1”. The subsequent steps S19 to S25 are the same as in the first embodiment. Step S26 is also the same as that in the first embodiment.

As described above, in this embodiment, the extended MACsec SecTAG generating unit 5 of the transmission device functions as an identification information adding unit that stores a value indicating that an extended MACsec frame is in the V bit. In the receiving apparatus, the extended MACsec SecTAG check unit 108 functions as an identification unit that identifies whether the frame is an extended MACsec frame based on the V bit.

As described above, in the present embodiment, when the transmitting apparatus transmits an extended MACsec frame, the value “1” indicating the extended MACsec frame is stored as the V bit of the Sec TAG, and the receiving apparatus V Whether or not the frame is an extended MACsec frame is determined based on the bit. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the above-described erroneous deletion of the MAC address or omission of deletion of the MAC address to be deleted.

Embodiment 3 FIG.
Next, a transmitting apparatus and a receiving apparatus according to the third embodiment of the present invention will be described. The configuration of the transmission device and the reception device of the present embodiment is the same as the configuration of the transmission device and the reception device of the first embodiment. Components having functions similar to those of the first embodiment are denoted by the same reference numerals as those of the first embodiment. Hereinafter, the description which overlaps with Embodiment 1 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In the present embodiment, the Type encoding unit 2 generates the same Type information as that of the standard MACsec frame even when the extended MACsec frame is transmitted. Then, the extended MACsec SecTAG generation unit 5 sets the upper 2 bits of SL (SL byte) of SecTAG to “11”. Further, the standard MACsec SecTAG generation unit 4 sets the upper 2 bits of the SecTAG SL byte to “00”. The operations of the transmitting apparatus other than those described above are the same as those in the first embodiment.

Note that the SecTAG SL defined by IEEE 802.1AE is an area for identifying whether the frame is shorter than 64 bytes defined as the shortest Ethernet (registered trademark) frame. If the length between the last octet of the SECTAG and the first octet of the ICV is shorter than 48 bytes (64 bytes minus the MAC address), the number of octets in the Secure Data area (Data portion in FIG. 5) is set. In case of zero is set. When a pseudo MAC address is used as in the present embodiment, the original MAC address is included in the Secure Data area (DA, SA, and Data portions in FIG. 6). Therefore, instead of the above 48 bytes, Secure Data is used as a reference. The number of octets in the region or zero is set.

Next, the operation of the receiving device will be described. FIG. 11 is a flowchart illustrating an example of the reception operation according to the present embodiment. Steps S1 to S6 are the same as steps S1 to S6 of the first embodiment. In this embodiment, in step S6, the SECTAG decoding process is performed in either frame without determining whether the frame is a standard MACsec frame or an extended MACsec frame.

After step S6, the extended MACsec SecTAG check unit 108 determines whether the upper 2 bits of the SecTAG SL byte are “00” (step S40). When it is determined that the upper 2 bits of the SL byte are “00” (Yes in step S40), the extended MACsec SecTAG check unit 108 determines that the received frame is a standard MACsec frame, and the determination result is the frame determination unit 106. To notify. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result.

In step S7, as in step S1 of the first embodiment, the standard MACsec SecTAG check unit 109 confirms SecTAG (step S7). However, in this embodiment, since the MACsec Sec upper bit is set to “00” for the SL byte, the confirmation is performed in consideration thereof. The subsequent steps S8 to S15 are the same as in the first embodiment.

On the other hand, when it is determined that the upper 2 bits of the SL byte are not “00” (No in step S40), the extended MACsec SecTAG check unit 108 determines that the received frame is an extended MACsec frame, and the determination result is a frame determination unit. 106 is notified. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. The subsequent step S18 is the same as that in the first embodiment.

In step S18, as in step S18 of the first embodiment, the extended MACsec SecTAG check unit 108 confirms SecTAG (step S18). However, in the present embodiment, the upper 2 bits of the SL bit are set to “11”, and therefore the SL bit is checked in consideration of this. The subsequent steps S19 to S25 are the same as in the first embodiment. Step S26 is also the same as that in the first embodiment.

As described above, in this embodiment, the extended MACsec SecTAG generating unit 5 of the transmission device functions as an identification information adding unit that stores a value indicating that it is an extended MACsec frame in the SL byte. In the receiving apparatus, the extended MACsec SecTAG check unit 108 functions as an identification unit that identifies whether the MAC MAC frame is an extended MACsec frame based on the SL byte.

As described above, in this embodiment, when the transmitting apparatus transmits an extended MACsec frame, the upper 2 bits of the SL byte of the Sec TAG are set to a value “11” indicating that it is an extended MACsec frame, and the receiving apparatus Whether or not the frame is an extended MACsec frame is determined based on the SL byte. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the erroneous deletion of the MAC address or the deletion omission of the MAC address to be deleted.

Embodiment 4 FIG.
Next, a transmitting apparatus and a receiving apparatus according to the fourth embodiment of the present invention are described. The configuration of the transmission device and the reception device of the present embodiment is the same as the configuration of the transmission device and the reception device of the first embodiment. Components having functions similar to those of the first embodiment are denoted by the same reference numerals as those of the first embodiment. Hereinafter, the description which overlaps with Embodiment 1 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In the present embodiment, the Type encoding unit 2 generates the same Type information as that of the standard MACsec frame even when the extended MACsec frame is transmitted. Then, the extended MACsec preamble generation unit 7 sets the value of the fifth byte of the preamble (preamble fifth byte 500 in FIG. 6) to “0xAA”, and sets the other values to the values specified in IEEE 802.3. A preamble is generated and output to the preamble adding unit 14. The preamble adding unit 14 adds the input preamble when the preamble is input from the extended MACsec preamble generation unit 7, and adds the preamble defined by IEEE 802.3 otherwise. The operations of the transmitting apparatus other than those described above are the same as those in the first embodiment.

Next, the operation of the receiving device will be described. FIG. 12 is a flowchart illustrating an example of the reception operation according to the present embodiment. Steps S1 and S2 are the same as steps S1 and S2 in the first embodiment. However, in the present embodiment, in step S2, other than the fifth byte of the preamble is checked.

After step S2, the preamble check unit 101 determines whether or not the fifth byte of the preamble is “0xAA” (step S50). If the preamble check unit 101 determines that the fifth byte of the preamble is not “0xAA” (No in step S50), the preamble check unit 101 determines that the preamble is not an extended MACsec frame, passes through the FCS check unit 102 and the PON control unit 103, or The received frame identification / decoded frame reconstruction unit 104 is notified of the determination result via the frame determination unit 106. Thereafter, similarly to the first embodiment, steps S3 to S15 are performed.

On the other hand, if it is determined in step S50 that the fifth byte of the preamble is “0xAA” (step S50 Yes), the preamble check unit 101 determines that it is an extended MACsec frame, and the FCS check unit 102 and the PON The determination result is notified to the received frame identification / decoded frame reconstruction unit 104 via the control unit 103 or the frame determination unit 106. Thereafter, Steps S3 to S5 are performed as in the first embodiment. If the Type information is “0x88E5” in Step S5 (Yes in Step S5), Steps S17 to S5 are performed as in the first embodiment. Step S25 is performed.

If the Type information is not “0x88E5” in Step S5 (No in Step S5), Step S26 similar to that in Embodiment 1 is performed.

In this embodiment, the preamble check unit 101 determines whether or not the fifth byte of the preamble is “0xAA”, but instead determines whether or not the fifth byte of the preamble is “0xAA”. You may make it provide the extended preamble check part to judge.

As described above, in this embodiment, the extended MACsec preamble generation unit 7 of the transmission device functions as an identification information adding unit that stores a value indicating that it is an extended MACsec frame in the preamble. In the receiving apparatus, the preamble check unit 101 functions as an identification unit that identifies whether the preamble is an extended MACsec frame based on the preamble.

In the present embodiment, the fifth byte of the preamble is set to “0xAA”. However, the value to be set is not limited to “0xAA”, and any value other than those specified in the standard MACsec frame or other frames may be used. Any numerical value may be used. A value indicating an extended MACsec frame may be stored in another position in the preamble.

As described above, in this embodiment, when transmitting an extended MACsec frame, the transmitting apparatus sets the fifth byte of the preamble to a value “0xAA” indicating that it is an extended MACsec frame, and the receiving apparatus sets the fifth byte of the preamble. Whether or not the frame is an extended MACsec frame is determined. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the above-described erroneous deletion of the MAC address or omission of deletion of the MAC address to be deleted.

Embodiment 5 FIG.
FIG. 13: is a figure which shows the function structural example of the reception control part of the receiver of Embodiment 5 concerning this invention. The receiving apparatus according to the present embodiment is the same as the receiving apparatus according to the first embodiment except that an extended MACsec MAC address check unit 115 is added. The configuration of the transmission device is the same as the configuration of the transmission device of the first embodiment. Components having functions similar to those of the first embodiment are denoted by the same reference numerals as those of the first embodiment. Hereinafter, the description which overlaps with Embodiment 1 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In the present embodiment, the Type encoding unit 2 generates the same Type information as that of the standard MACsec frame even when the extended MACsec frame is transmitted. Then, the pseudo MAC address generation unit 11 generates a pseudo MAC address (pseudo DA, pseudo SA) as “0x01-80-C2-00-00-09” in the case of an extended MACsec frame. Since the pseudo MAC address is unnecessary, it is generated as “Null” having no value. The operations of the transmitting apparatus other than those described above are the same as those in the first embodiment.

Note that “0x01-80-C2-00-00-09” is an example, and for example, an address reserved in the own communication system among group addresses defined by IEEE can be used.

Next, the operation of the receiving device will be described. FIG. 14 is a flowchart illustrating an example of a reception operation according to the present embodiment. Steps S1 to S4 are the same as steps S1 to S4 of the first embodiment. After step S4, the extended MACsec MAC address check unit 115 determines whether or not the pseudo MAC address (pseudo DA, pseudo SA) is “0x01-80-C2-00-00-09” (step S60). .

When it is determined that the pseudo MAC address (pseudo DA, pseudo SA) is not “0x01-80-C2-00-00-09” (No in step S60), the extended MACsec MAC address check unit 115 determines that the received frame is an extended MACsec frame. Is determined, and the determination result is notified to the frame determination unit 106. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. Thereafter, similarly to the first embodiment, steps S5 to S15 are performed.

On the other hand, when it is determined that the pseudo MAC address (pseudo DA, pseudo SA) is “0x01-80-C2-00-00-09” (Yes in step S60), the extended MACsec MAC address check unit 115 determines that the received frame is It is determined that the frame is an extended MACsec frame, and the determination result is notified to the frame determination unit 106. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. After that, step S5 is performed as in the first embodiment, and when it is determined in step S5 that the Type information is “0x88E5” (step S5, Yes), steps S17 to S25 are performed as in the first embodiment. carry out.

In Step S5, when it is determined that the Type information is not “0x88E5” (No in Step S5), Step S26 similar to that in Embodiment 1 is performed.

In this embodiment, the pseudo MAC address is described. However, a value indicating an extended MACsec frame is set in one of the pseudo transmission destination MAC address (MAC destination address) and the pseudo transmission source MAC address (MAC source address). It may be set. Alternatively, a value indicating an extended MACsec frame may be set with both the pseudo transmission destination MAC address and the pseudo transmission source MAC address being the same value or different values.

As described above, in the present embodiment, the pseudo MAC address generation unit 11 of the transmission device functions as an identification information adding unit that stores a value indicating an extended MACsec frame in the pseudo MAC address. In the receiving apparatus, the extended MACsec MAC address check unit 115 functions as an identification unit that identifies whether the MAC frame is an extended MACsec frame based on the pseudo MAC address.

As described above, in this embodiment, when the transmitting apparatus transmits an extended MACsec frame, a value indicating the extended MACsec frame is set in the pseudo MAC address, and the receiving apparatus uses the extended MACsec frame based on the pseudo MAC address. Judgment whether or not there is. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the erroneous deletion of the MAC address or the deletion omission of the MAC address to be deleted.

Embodiment 6 FIG.
Next, a transmitting apparatus and a receiving apparatus according to the sixth embodiment of the present invention will be described. The configurations of the transmission device and the reception device of the present embodiment are the same as the configurations of the transmission device and the reception device of the fifth embodiment. Components having the same functions as those in the first embodiment or the sixth embodiment are denoted by the same reference numerals as those in the first or sixth embodiment. Hereinafter, the description which overlaps with Embodiment 1 or Embodiment 6 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In this embodiment, a PON system as shown in FIG. 4 of Embodiment 1 is assumed. The pseudo MAC address generation unit 11 generates the MAC address of the OLT 301 or the MAC addresses of the ONUs 302-1 to 302-N as the pseudo MAC address when transmitting the extended MACsec frame, and the pseudo MAC address generation unit 11 transmits the standard MACsec frame. Since the MAC address is unnecessary, “Null” having no value is generated.

Note that it is assumed that the transmission device can grasp the MAC address of the OLT 301 or the MAC addresses of the ONUs 302-1 to 302-N as the pseudo MAC address at the start of communication. For example, in the case of the PON system as shown in FIG. 4 of the first embodiment, the MAC address of the OLT 301 and the MAC addresses of the ONUs 302-1 to 302-N communicating with the OLT 301 are defined by IEEE 802.3 that is performed at the time of startup. The PON control unit 103 recognizes the detected discovery sequence. The PON control unit 103 notifies the extended MACsec MAC address check unit 115 of the recognized MAC address of the OLT 301 and the MAC addresses of the ONUs 302-1 to 302-N communicating with the OLT 301. The operations of the transmitting apparatus of the present embodiment other than those described above are the same as those in the fifth embodiment.

For example, either one of the pseudo DA and the pseudo SA may be set as the pseudo DA, and the MAC address of the destination OLT 301 and the MAC addresses of the ONUs 302-1 to 302-N communicating with the OLT 301 may be set. Alternatively, each of the pseudo DA and the pseudo SA may be either the MAC address of the OLT 301 or the MAC addresses of the ONUs 302-1 to 302-N that communicate with the OLT 301. For example, in the case of transmission from the OLT 301, a MAC address is set, and the MAC address of the OLT 301 is set as a pseudo SA. If a rule is defined in advance, conversely, the MAC address of the OLT 301 may be set as the pseudo DA, and the MAC address of the destination ONU may be set as the pseudo SA.

Next, the operation of the receiving device will be described. FIG. 15 is a flowchart illustrating an example of a reception operation according to this embodiment. Steps S1 to S4 are the same as steps S1 to S4 of the first embodiment. After step S4, the extended MACsec MAC address check unit 115 determines whether the pseudo MAC address (pseudo DA, pseudo SA) is not the MAC address of the ONUs 302-1 to 302-N communicating with the OLT 301 or the OLT 301 (step S4). S70).

When it is determined that the pseudo MAC address (pseudo DA, pseudo SA) is not the MAC address of the ONUs 302-1 to 302-N communicating with the OLT 301 or the OLT 301 (step S70 Yes), the extended MACsec MAC address check unit 115 It is determined that the frame is not an extended MACsec frame, and the determination result is notified to the frame determination unit 106. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. Thereafter, similarly to the first embodiment, steps S5 to S15 are performed.

On the other hand, when it is determined that the pseudo MAC address (pseudo DA, pseudo SA) is the MAC address of the ONUs 302-1 to 302-N communicating with the OLT 301 or the OLT 301 (No in step S70), the extended MACsec MAC address check unit 115 It is determined that the received frame is an extended MACsec frame, and the determination result is notified to the frame determination unit 106. The frame determination unit 106 notifies the reception frame identification / decoded frame reconstruction unit 104 of the determination result. After that, step S5 is performed as in the first embodiment, and when it is determined in step S5 that the Type information is “0x88E5” (step S5, Yes), steps S17 to S25 are performed as in the first embodiment. carry out.

In the present embodiment, the PON system has been described as an example. However, when the transmission apparatus and the reception apparatus relay communication between the destination apparatus and the transmission source apparatus other than the PON system, they communicate with the OLT 301 or the OLT 301. Similarly to the MAC addresses of the ONUs 302-1 to 302-N, the address of the transmission device or the reception device may be set as a pseudo MAC address.

As described above, in this embodiment, when the transmitting apparatus transmits an extended MACsec frame, the MAC address of the OLT 301 or the ONUs 302-1 to 302-N is set in the pseudo MAC address, and the receiving apparatus sets the pseudo MAC address. Based on this, it is determined whether the frame is an extended MACsec frame. Therefore, when receiving a frame, it is possible to correctly identify whether the frame is transmitted by the extended MACsec method or the standard MACsec method. Therefore, it is possible to prevent problems caused by erroneous processing due to a method selection error such as the erroneous deletion of the MAC address or the deletion omission of the MAC address to be deleted.

Embodiment 7 FIG.
FIG. 16 is a diagram illustrating a functional configuration example of the transmission control unit of the transmission apparatus according to the seventh embodiment of the present invention. FIG. 17 is a diagram illustrating a functional configuration example of the reception control unit of the receiving apparatus according to the seventh embodiment of the present invention. The transmission apparatus according to the present embodiment is the same as the transmission apparatus according to the first embodiment except that an ICV inverting unit 15 is added. The configuration of the receiving apparatus according to the present embodiment is the same as that of the receiving apparatus according to the first embodiment except that ICV inversion unit 116 is added. Components having functions similar to those of the first embodiment are denoted by the same reference numerals as those of the first embodiment. Hereinafter, the description which overlaps with Embodiment 1 is abbreviate | omitted, and a different part from Embodiment 1 is demonstrated.

First, the operation of the transmission apparatus according to this embodiment will be described. In the present embodiment, the Type encoding unit 2 generates the same Type information as that of the standard MACsec frame even when the extended MACsec frame is transmitted. In the present embodiment, the ICV generation unit 10 generates the ICV and outputs the ICV to the ICV inversion unit 15. Then, the ICV inversion unit 15 inverts the ICV in the case of transmission of the extended MACsec frame and outputs the inverted frame to the transmission frame generation unit 1. In the case of the standard MACsec frame, the ICV inversion unit 15 inverts the ICV without inversion. Output to 1. The transmission frame generation unit 1 instructs the ICV inversion unit 15 to determine whether the transmission frame is a standard MACsec frame or an extended MACsec frame. The operations of the transmitting apparatus of the present embodiment other than those described above are the same as those of the first embodiment.

Next, the operation of the receiving device will be described. In the present embodiment, it is not possible to determine whether the received frame is an extended MACsec frame that is a standard MACsec frame based on the received frame itself. However, in the receiving process of the standard MACsec frame and the receiving process of the extended MACsec frame, It can be identified that the frame type is correct. In the present embodiment, either the standard MACsec frame reception process or the extended MACsec frame is performed on the received frame. Usually, as described in the first embodiment, the standard MACsec operation is agreed, and based on the agreement, the received frame identification / decoded frame reconstruction unit 104 performs the reception process of the standard MACsec frame or the extended MACsec frame. Select what to do.

18 and 19 are flowcharts showing an example of the reception operation of the present embodiment. FIG. 18 shows a standard MACsec frame reception operation, and FIG. 19 shows an extended MACsec frame reception operation.

The reception operation of the standard MACsec frame shown in FIG. 18 is the same as step S1 to step S15 of the first embodiment (operation when the standard MACsec frame of the first embodiment is received). At this time, if the received frame processed as the standard MACsec frame is an extended MACsec frame obtained by inverting ICV, it is determined in step S12 that the check result is not normal (No in step S12), and the frame determination unit 106 Instructs the received frame identification / decoded frame reconstruction unit 104 to discard the frame, and ends the process (step S14). In this case, the extended MACsec frame cannot be reconstructed, but it can be prevented from being processed as a standard MACsec frame without causing an error.

Next, the operation for receiving the extended MACsec frame will be described with reference to FIG. Steps S1 to S5 and Steps S17 to S22 are performed. After step S22, the received frame identification / decoded frame reconstruction unit 104 outputs the ICV of the received frame to the ICV inversion unit 116, and the ICV inversion unit 116 inverts the received ICV and outputs it to the normality confirmation unit 114. (Step S80). The ICV performs normality confirmation processing based on the ICV received from the ICV inversion unit 116 and the decrypted data in the same manner as in the first embodiment (step S23). The processing after step S23 is the same as that in the first embodiment.

As described above, in this embodiment, the ICV inversion unit 15 of the transmission apparatus functions as an identification information adding unit that stores a value indicating an extended MACsec frame in the ICV by inverting the ICV. In the receiving apparatus, the normality confirmation unit 114 and the ICV inversion unit 116 function as an identification unit that identifies whether the recognition of the frame type is correct based on the ICV.

As described above, in the present embodiment, when the transmitting device transmits an extended MACsec frame, the MAC address of the OLT 301 or the ONUs 302-1 to 302-N is set in the pseudo MAC address, and the receiving device sets the pseudo MAC address. Based on this, it is determined whether it is an extended MACsec frame. For this reason, even when the reception processing method for the received frame is wrong, the erroneous received frame can be discarded, and problems caused by performing the incorrect process can be prevented.

As described above, the communication control device, the transmission device, the reception device, the communication system, and the communication control method according to the present invention are useful for a communication system that supports both standard MACsec and extended MACsec frames. It is suitable for the communication system which comprises.

DESCRIPTION OF SYMBOLS 1 Transmission frame generation part 2 Type encoding part 3 MACsec SecTAG encoding part 4 Standard MACsec SecTAG generation part 5 Extended MACsec SecTAG generation part 6 Packet number grant part 7 Extended MACSec preamble generation part 8,112 Key management part 9 Data encryption part 10 ICV generation Unit 11 Pseudo MAC address generation unit 12 PON control unit 13 FCS grant unit 14 Preamble grant unit 101 Preamble check unit 102 FCS check unit 103 PON control unit 104 Received frame identification / decoded frame reconstruction unit 105 Type check unit 106 Frame determination unit 107 SecTAG decoding unit 108 Extended MACsec SecTAG check unit 109 Standard MACsec SecTAG check unit 110 Replay check Block 111 SC / AN confirmation unit 113 data decoding unit 114 normality confirmation unit 115 extended MACsec MAC address check unit 116 ICV inversion unit 201 WDM
202 Light Tx
203 Light Rx
204 PON-LSI
205 Interface 210 Host network (terminal)
211 Management device 301 OLT
302-1 to 302-N ONU
401 Extended MACsec frame 402 Standard MACsec frame 500 5th byte of preamble

Claims

A communication control device in a transmission device for transmitting a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of the destination and the transmission source,
When transmitting a transmission frame as an extended MACsec frame, an identification information adding unit that stores a predetermined value indicating that the frame is an extended MACsec frame at a predetermined bit position of the transmission frame;
A communication control apparatus comprising:
The communication control apparatus according to claim 1, wherein the predetermined bit position is in a SecTAG field.
3. The communication control apparatus according to claim 2, wherein the predetermined bit position is a Type area in a SecTAG field.
3. The communication control apparatus according to claim 2, wherein the predetermined bit position is a V bit area in a SecTAG field.
3. The communication control apparatus according to claim 2, wherein the predetermined bit position is an SL bit area in a SecTAG field.
2. The communication control apparatus according to claim 1, wherein the predetermined bit position is a preamble area.
The predetermined bit position is an ICV area, and the predetermined value is an inverted value of ICV obtained based on encrypted data.
The communication control apparatus according to claim 1.
The communication control apparatus according to claim 1, wherein the predetermined bit position is an address area immediately after the preamble.
9. The communication control apparatus according to claim 8, wherein the predetermined value is an address reserved in a local communication system among group addresses defined by IEEE.
10. The communication control device according to claim 1, wherein the transmission device is a station-side communication device or a subscriber-side communication device that constitutes a PON system.
The transmitting device is a station side communication device or a subscriber side communication device constituting a PON system,
9. The communication control apparatus according to claim 8, wherein the predetermined value is at least one of an address of the own apparatus and an address of a communication partner apparatus.
A communication control device in a receiving device that receives a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of a destination and a transmission source,
An identification unit for identifying whether or not the frame is an extended MACsec frame based on information indicating whether or not the frame is an extended MACsec frame stored in a predetermined bit position of the received frame;
A communication control apparatus comprising:
A communication control device in a receiving device that receives a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of a destination and a transmission source,
When the reception frame type is set as an extended MACsec frame or a standard MACsec frame and reception processing is performed, based on information indicating whether the received frame is an extended MACsec frame stored in a predetermined bit position of the received frame An identification unit for identifying whether the set type is correct,
A communication control apparatus comprising:
A transmission device that transmits a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of the destination and the transmission source.
When transmitting a transmission frame as an extended MACsec frame, an identification information adding unit that stores a predetermined value indicating that the frame is an extended MACsec frame at a predetermined bit position of the transmission frame;
A transmission device comprising:
A receiving device that receives a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of the destination and the transmission source.
An identification unit for identifying whether or not the frame is an extended MACsec frame based on information indicating whether or not the frame is an extended MACsec frame stored in a predetermined bit position of the received frame;
A receiving apparatus comprising:
A receiving device that receives a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including the address of the destination and the transmission source.
When the reception frame type is set as an extended MACsec frame or a standard MACsec frame and reception processing is performed, based on information indicating whether the received frame is an extended MACsec frame stored in a predetermined bit position of the received frame An identification unit for identifying whether the set type is correct,
A receiving apparatus comprising:
A communication system for transmitting a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including addresses of a destination and a transmission source,
When transmitting a transmission frame as an extended MACsec frame, an identification information adding unit that stores a predetermined value indicating that the frame is an extended MACsec frame at a predetermined bit position of the transmission frame;
A transmission device comprising:
An identification unit for identifying whether or not the frame is an extended MACsec frame based on information indicating whether or not the frame is an extended MACsec frame stored in a predetermined bit position of the received frame;
A receiving device comprising:
A communication system comprising:
A communication system for transmitting a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including addresses of a destination and a transmission source,
When transmitting a transmission frame as an extended MACsec frame, an identification information adding unit that stores a predetermined value indicating that the frame is an extended MACsec frame at a predetermined bit position of the transmission frame;
A transmission device comprising:
Based on information indicating whether or not the received MAC frame is an extended MACsec frame stored in a predetermined bit position of the received frame when the reception frame type is set as an extended MACsec frame or a standard MACsec frame. An identification unit for identifying whether the set type is correct,
A receiving device comprising:
A communication system comprising:
A communication control method in a communication system that transmits a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including addresses of a destination and a transmission source,
A first step of storing a predetermined value indicating that it is an extended MACsec frame in a predetermined bit position of the transmission frame when a transmission device constituting the communication system transmits the transmission frame as an extended MACsec frame; ,
A second device for identifying whether or not the receiving apparatus constituting the communication system is an extended MACsec frame based on information indicating whether or not the extended MACsec frame is stored in a predetermined bit position of the received frame; Steps,
The communication control method characterized by including.
A communication control method in a communication system that transmits a standard MACsec frame that is a frame encrypted by MACsec and an extended MACsec frame that is a frame encrypted by MACsec including addresses of a destination and a transmission source,
A first step of storing a predetermined value indicating that it is an extended MACsec frame in a predetermined bit position of the transmission frame when a transmission device constituting the communication system transmits the transmission frame as an extended MACsec frame; ,
When the receiving device constituting the communication system performs reception processing by setting the type of the received frame as an extended MACsec frame or a standard MACsec frame, an extended MACsec frame stored in a predetermined bit position of the received frame is used. A second step for identifying whether or not the type set based on the information indicating whether or not there is correct;
The communication control method characterized by including.