WO2016197787A2

WO2016197787A2 - Access control method and apparatus

Info

Publication number: WO2016197787A2
Application number: PCT/CN2016/082236
Authority: WO
Inventors: 韩文; 韩丽; 陈春晖
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-03-02
Filing date: 2016-05-16
Publication date: 2016-12-15
Also published as: CN107154898A; WO2016197787A3

Abstract

Disclosed is an access control method, applied to an access device. The method comprises: after receiving a packet, determining a forwarding exit and a service type of the packet; querying a media access control (MAC) address learning record table, determining a VLAN identifier corresponding to a service type of a target MAC address, and carrying the determined VLAN identifier when forwarding the packet, the MAC address learning record table recording a corresponding relationship between a service type of each MAC address and a virtual local area network (VLAN) identifier.

Description

Access control method and device

Technical field

This document relates to, but is not limited to, the field of communication technologies, and in particular, to an access control method and apparatus.

Background technique

At present, the functions of the ONU (Optical Network Unit) are more and more powerful. A single device can support various entertainment functions. In addition to its traditional services, it can also be used to carry video on demand, IPTV, XBOX and other customized private networks. business.

For example, a new type of smart set-top box supports multiple services, such as IPTV, video on demand, and specific video on demand, and these different types of services are carried on different VLANs, but the set-top box has only one MAC (Media Access Control, media access control). )address. A single MAC/VLAN (Virtual Local Area Network) mapping relationship in the traditional forwarding model cannot be applied to such a requirement, because the traditional transport layer forwarding is implemented based on the ingress MAC address learning mechanism, and the source address of the ingress packet. It will be recorded on the port corresponding to the ingress. The egress packet will be clarified according to the destination address when forwarding the selected port.

Therefore, how to support the access device to implement packet forwarding of multiple services is a technical problem that needs to be solved.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present invention provides an access control method and apparatus, which enables an access device to forward and control packets of multiple virtual local area networks sharing the same physical address.

An embodiment of the present invention provides an access control method, which is applied to an access device, and the method includes:

After receiving the packet, determining the forwarding exit and the service type of the packet;

Querying a media access control MAC address learning record table, determining a VLAN identifier corresponding to the service type of the destination MAC address, and carrying the determined VLAN identifier when forwarding the packet;

The correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network is recorded in the MAC address learning record table.

Optionally, after receiving the packet, determining the forwarding exit and the service type of the packet, including:

If the Layer 2 packet is received, the forwarding port is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding egress is a Layer 2 LAN port, the service type of the packet is determined to be two. Layer LAN - LAN service; or

If the Layer 2 packet is received, the forwarding entry is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding outlet is a Layer 2 WAN port, the service type of the packet is determined to be two. Layer LAN-WAN service; or

If the Layer 3 packet is received, the forwarding entry is determined according to the destination IP address of the packet, and the service type of the packet is determined to be a Layer 3 service.

If the Layer 2 packet is received and the forwarding port is not found according to the destination MAC address of the packet, the Layer 2 packet is flooded in each VLAN of the port and the response of the port is received. After the packet, if the port is a Layer 2 LAN port, the service type of the packet is determined to be a Layer 2 LAN-LAN service; if the port is a Layer 2 WAN port, the service type of the packet is determined. It is a Layer 2 LAN-WAN service.

Optionally, after receiving the packet, determining the forwarding exit and the service type of the packet, the method further includes:

Querying the MAC address learning record table, if the record does not include any record of the source MAC address of the packet, or the record of the source MAC address of the packet does not include the record corresponding to the service type, the report is generated. A new record of the source MAC address of the text, where the new record records the correspondence between the service type of the source MAC address of the packet and the VLAN identifier.

Optionally, the access device comprises: an optical network unit ONU.

The embodiment of the invention further provides an access control device, which is applied to an access device, and includes:

The receiving module is configured to: after receiving the packet, determine a forwarding exit and a service type of the packet;

a forwarding module, configured to query a media access control MAC address learning record table, determine a VLAN identifier corresponding to the service type of the destination MAC address, and carry the determined VLAN identifier when forwarding the packet;

Optionally, the receiving module is configured to determine, according to the following manner, the forwarding exit and the service type of the packet after receiving the packet:

Optionally, the receiving module is further configured to: after receiving the packet and determining the forwarding exit and the service type of the packet, querying the MAC address learning record table, if the source MAC address of the packet is not included in any Recording, or the record corresponding to the service type in the record of the source MAC address of the packet, generating a new record of the source MAC address of the packet, the new record Corresponding relationship between the service type of the source MAC address of the packet and the VLAN identifier is recorded.

Optionally, the access device comprises: an optical network unit ONU.

The embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when executed by a processor.

Compared with the related art, an access control method and apparatus are provided by the embodiment of the present invention. After receiving the packet, the access device determines the forwarding exit and service type of the packet, and queries the media access control MAC address learning record. The MAC address learning record table records the correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network, and determines the VLAN identifier corresponding to the service type of the destination MAC address, and forwards the packet when the packet is forwarded. The carrying of the determined VLAN identifier, the embodiment of the present invention enables the access device to forward and control the packets of multiple virtual local area networks sharing the same physical address.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

FIG. 1 is a flowchart of an access control method according to an embodiment of the present invention.

FIG. 2 is a schematic diagram of an access control apparatus according to an embodiment of the present invention.

FIG. 3 is a schematic diagram of a home access scenario in an example of the present invention.

Embodiments of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

As shown in FIG. 1 , an embodiment of the present invention provides an access control method, which is applied to an access device, and the method includes:

S101. After receiving the packet, determine a forwarding exit and a service type of the packet.

S102: Query a media access control MAC address learning record table, determine a VLAN identifier corresponding to the service type of the destination MAC address, and carry the determined VLAN identifier when forwarding the packet;

The access device includes: an optical network unit ONU.

As shown in FIG. 2, an embodiment of the present invention provides an access control apparatus, which is applied to an access device, and includes:

The receiving module 201 is configured to: after receiving the packet, determine a forwarding exit and a service type of the packet;

The forwarding module 202 is configured to query the media access control MAC address learning record table, determine the VLAN identifier corresponding to the service type of the destination MAC address, and carry the determined VLAN identifier when forwarding the packet;

Optionally, the receiving module 201 is configured to determine, according to the following manner, the forwarding exit and the service type of the packet after receiving the packet:

The receiving module 201 is further configured to: after receiving the packet and determining the forwarding exit and the service type of the packet, querying the MAC address learning record table, if any record of the source MAC address of the packet is not included therein If the record of the source MAC address of the packet does not include the record corresponding to the service type, a new record of the source MAC address of the packet is generated, and the source MAC address of the packet is recorded in the new record. Correspondence between the service type of the address and the VLAN ID.

The access device includes: an optical network unit ONU.

Example

Figure 3 shows the home access scenario. The smart entertainment device is accessed through the LAN1 port on the ONU, and the PC is accessed through the LAN2 port on the ONU.

The smart entertainment device can interconnect with the internal devices of the home through the untag channel (Layer 2 LAN-LAN service) to carry out home services such as storage sharing and video sharing. Intelligent entertainment devices and PCs communicate via a local area network. VLAN8 (three-layer service) is an on-demand service for smart entertainment devices. It can broadcast video, games and entertainment interactions on the Internet. It can access the Internet through VLAN8 and access the Internet. These services are services that can be accessed by public platforms. The smart entertainment device on the network side belongs to the three-tier service. The smart entertainment device can also carry out the private content service, which belongs to the private network operated by the service. The service is on the VLAN 9 to be isolated from other public services, and the smart entertainment device is connected to the upper VLAN 9 service of the networking through the Layer 2 service channel. Belongs to the Layer 2 LAN-WAN service;

The forwarding control of the ONU includes the following steps:

S401. The LAN1 port of the ONU receives the packet sent by the smart entertainment device.

S402, it is determined whether it is a three-tier service, if yes, step S403 is performed, if not, step S406 is performed;

S403. The source MAC address and the VLAN identifier (for example, VLAN 8) of the smart entertainment device are learned at the LAN1 port, and the VLAN identifier of the Layer 3 service type corresponding to the smart entertainment device on the LAN1 interface (for example, VLAN8) is determined, and the source MAC address of the smart entertainment device is established. Correspondence between the address and the VLAN ID of the Layer 3 service type and recorded in the MAC address learning record table;

S404: The LAN1 sends the packet to the Layer 3 route to be transmitted to the upper layer network.

S405. When the downlink packet is sent from the ONU to the smart entertainment device, the VLAN identifier of the Layer 3 service of the smart entertainment device (for example, VLAN 8) is queried on the LAN1 port, and the downlink packet is tagged with the queried VLAN tag (for example, , VLAN8) is sent to the smart entertainment device;

S406, if an address request (broadcast message) initiated by the smart entertainment device (Dynamic Host Configuration Protocol) is received, step S407 is performed; if the access to the LAN2 port is sent by the smart entertainment device, The message of the PC (the message carrying the MAC address of the smart entertainment device, the VLAN identifier "untag", the MAC address of the PC), step S411 is performed;

S407, learning a source MAC address and a VLAN identifier (for example, VLAN 9) of the smart entertainment device on the LAN1 port;

S408: The DHCP response packet of the upper device reaches the LAN1 port. If the VLAN identifier corresponding to the LAN-WAN service type is not queried, it is flooded in all VLAN domains of the LAN1 port, including VLAN9, and the smart entertainment device can be in the downlink channel VLAN9. Receiving a DHCP response message from the upper device;

S409, the DHCP message of the smart entertainment device is sent from the LAN1 to the upper device again. Because the smart entertainment device has learned the MAC address of the upper device, the unicast message is sent; the LAN1 port determines the LAN-WAN service type of the smart entertainment device. a VLAN identifier (for example, VLAN 9), establishing a correspondence between a source MAC address of the smart entertainment device and a VLAN identifier of the LAN-WAN service type, and recording the MAC address learning record table;

S410, the VLAN 9 data packet sent by the upper device to the smart entertainment device is queried by the LAN1 to the VLAN ID corresponding to the LAN-WAN service type, and the VLAN of the packet sent from the LAN1 outlet to the smart entertainment device is set to VLAN9;

S411, the LAN1 port queries the MAC address learning record table. If the MAC address of the smart entertainment device and the record whose VLAN identifier is "untag" are not found, the physical address learning is performed and a record is generated:

a) Determine the entry type of the message:

It is found that the LAN1 port is a Layer 2 LAN port;

b) Determine the type of exit of the message:

B1) Find the forwarding exit corresponding to the destination address of the packet (the MAC address of the PC);

B2) If the forwarding exit is found, for example, the LAN 2 port, the type of the LAN 2 port is determined, and the LAN 2 port is a Layer 2 LAN port;

B3) If no forwarding exit is found, the message of the smart entertainment device is flooded at each port. Then, after receiving the packet, the PC connected to the LAN 2 sends a response packet, where the response packet carries the MAC address of the PC, the identifier of the VLAN "untag", the MAC address of the smart entertainment device, and the LAN 2 port receives. After the response message, physical address learning is performed and a record is generated:

Similar to the physical address learning of the LAN1 interface, the forwarding exit is searched for according to the destination address of the packet, that is, the forwarding address corresponding to the destination address (intelligent entertainment device) of the response packet is searched, and the forwarding outlet is the LAN1 port. The LAN1 port is a Layer 2 LAN port. Therefore, it is determined that the service type of the response message is a LAN-LAN type. The physical address learning record corresponding to the response message is generated, and the correspondence between the MAC address of the PC and the LAN 2, the identifier of the VLAN "untag", and the service type LAN-LAN are described.

c) The service type of the LAN1 port determination message is a LAN-LAN type, and the VLAN identifier (for example, untag) of the LAN-LAN service type corresponding to the smart entertainment device on the LAN1 port is determined, and the LAN-LAN of the source MAC address of the smart entertainment device is established. The correspondence between the service type and the VLAN identifier (for example, untag) is recorded in the MAC address learning record table.

S412. The smart entertainment device sends a Layer 2 packet to the PC again.

The message carries the MAC address of the smart entertainment device, the identifier of the VLAN "untag", and the MAC address of the PC;

S413, the LAN1 port receives the packet sent by the smart entertainment device, and the LAN1 port queries the forwarding exit as the LAN2 port according to the destination address of the packet, and the service type is determined to be a LAN-LAN type. In the MAC address record of the PC found in the forwarding egress LAN 2 port, the VLAN ID corresponding to the LAN-LAN service type is "untag". The packet is sent to the PC through the LAN 2 interface, and the VLAN identifier of the packet is “untag”.

In addition, an embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when executed by a processor.

The access control method and device provided by the foregoing embodiment, after receiving the packet, the access device determines the forwarding exit and the service type of the packet, and queries the media access control MAC address learning record table, where the MAC address is learned. The record table records the correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network, and determines the VLAN identifier corresponding to the service type of the destination MAC address, and carries the determined VLAN when forwarding the packet. In the embodiment of the present invention, the access device can perform forwarding control on the packets of multiple virtual local area networks sharing the same physical address.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. Instructions to achieve their corresponding functions. This application is not limited to any specific combination of hardware and software.

It should be noted that various other embodiments and modifications may be made by those skilled in the art without departing from the spirit and scope of the application, Corresponding changes and modifications are intended to fall within the scope of the appended claims.

Industrial applicability

According to the technical solution provided by the embodiment of the present invention, after receiving the packet, the access device determines the forwarding exit and the service type of the packet, and queries the media access control MAC address learning record table, where the MAC address learning record table records The correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network, and the VLAN tag corresponding to the service type of the destination MAC address is determined. In the embodiment of the present invention, the access device can forward and control the packets of multiple virtual local area networks sharing the same physical address.

Claims

An access control method is applied to an access device, and the method includes:

After receiving the packet, determining the forwarding exit and the service type of the packet;

Querying a media access control MAC address learning record table, determining a VLAN identifier corresponding to the service type of the destination MAC address, and carrying the determined VLAN identifier when forwarding the packet;

The correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network is recorded in the MAC address learning record table.
The method of claim 1 wherein:

After receiving the packet, determine the forwarding exit and service type of the packet, including:

If the Layer 2 packet is received, the forwarding port is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding egress is a Layer 2 LAN port, the service type of the packet is determined to be two. Layer LAN - LAN service; or

If the Layer 2 packet is received, the forwarding entry is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding outlet is a Layer 2 WAN port, the service type of the packet is determined to be two. Layer LAN-WAN service; or

If the Layer 3 packet is received, the forwarding entry is determined according to the destination IP address of the packet, and the service type of the packet is determined to be a Layer 3 service.
The method of claim 1 wherein:

After receiving the packet, determine the forwarding exit and service type of the packet, including:

If the Layer 2 packet is received and the forwarding port is not found according to the destination MAC address of the packet, the Layer 2 packet is flooded in each VLAN of the port and the response of the port is received. After the packet, if the port is a Layer 2 LAN port, the service type of the packet is determined to be a Layer 2 LAN-LAN service; if the port is a Layer 2 WAN port, the service type of the packet is determined. It is a Layer 2 LAN-WAN service.
The method of any of claims 1-3, wherein:

After receiving the packet, determining the forwarding exit and service type of the packet, the method further includes:

Querying the MAC address learning record table, if the record does not include any record of the source MAC address of the packet, or the record of the source MAC address of the packet does not include the record corresponding to the service type, the report is generated. A new record of the source MAC address of the text, where the new record records the correspondence between the service type of the source MAC address of the packet and the VLAN identifier.
The method of claim 1 wherein:

The access device includes: an optical network unit ONU.
An access control device is applied to an access device, including:

The receiving module is configured to: after receiving the packet, determine a forwarding exit and a service type of the packet;

The forwarding module is configured to query the media access control MAC address learning record table, determine the VLAN identifier corresponding to the service type of the destination MAC address, and carry the determined VLAN identifier when forwarding the packet;

The correspondence between the service type of each MAC address and the VLAN identifier of the virtual local area network is recorded in the MAC address learning record table.
The apparatus of claim 6 wherein:

The receiving module is configured to determine the forwarding exit and the service type of the packet after receiving the packet in the following manner:

If the Layer 2 packet is received, the forwarding port is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding egress is a Layer 2 LAN port, the service type of the packet is determined to be two. Layer LAN - LAN service; or

If the Layer 2 packet is received, the forwarding entry is searched according to the destination MAC address of the packet. If the forwarding exit is found and the forwarding outlet is a Layer 2 WAN port, the service type of the packet is determined to be two. Layer LAN-WAN service; or

If the Layer 3 packet is received, the forwarding entry is determined according to the destination IP address of the packet, and the service type of the packet is determined to be a Layer 3 service.
The apparatus of claim 6 wherein:

The receiving module is configured to determine the forwarding of the packet after receiving the packet in the following manner Export and business type:

If the Layer 2 packet is received and the forwarding port is not found according to the destination MAC address of the packet, the Layer 2 packet is flooded in each VLAN of the port and the response of the port is received. After the packet, if the port is a Layer 2 LAN port, the service type of the packet is determined to be a Layer 2 LAN-LAN service; if the port is a Layer 2 WAN port, the service type of the packet is determined. It is a Layer 2 LAN-WAN service.
A device according to any of claims 6-8, wherein:

The receiving module is further configured to: after receiving the packet and determining the forwarding exit and the service type of the packet, querying the MAC address learning record table, if any record of the source MAC address of the packet is not included, or If the record of the source MAC address of the packet does not include the record corresponding to the service type, a new record of the source MAC address of the packet is generated, and the source record of the source MAC address of the packet is recorded in the new record. Correspondence between the service type and the VLAN ID.
The apparatus of claim 6 wherein:

The access device includes: an optical network unit ONU.