CN100550857C - Method, system and access device for realizing layer-2 intercommunication of local specific services - Google Patents

Abstract

The invention provides a method, a system and an access device for realizing two-layer intercommunication of local specific services, belonging to the communication field. The method includes: selecting a source access node corresponding to a source device of a local specific service and a destination access node corresponding to a destination device, increasing the ability to distinguish specific service packets at the source access node, and when the source access node receives After the message, determine whether the message is a specific service message, if so, send the message to the destination access node through the virtual local area network; after the destination access node receives the message, send the message to the The text is sent to the destination device. The system includes: a network access server, a source access device and a destination access device. The access device includes: a receiving module, a judging module and a sending module. The scheme of the present invention is used to reduce the burden of NAS and ensure the security of the access network at the same time.

Description

Method, system and access device for realizing layer-2 intercommunication of local specific services

technical field

The invention relates to the communication field, in particular to a method, a system and an access device for realizing the two-layer intercommunication of local specific services.

Background technique

The existing access network architecture includes three parts: NAS (Network Access Server, Network Access Server), aggregation layer and access layer. Among them, NAS is the boundary between the access network and the IP network. All traffic between users needs to be forwarded through the NAS. The convergence layer is composed of multiple convergence points, which are used to realize the two-layer convergence of the user's physical or logical access channel to the NAS. , the access layer is composed of AN (Access Node, access node), AN is responsible for accessing the user's data link layer and physical layer, and performs simple two-layer access control. Currently, AN is mainly DSLAM (Digital Subscriber Line Access Mutliplexer, digital subscriber line access multiplexer) or Ethernet Layer 2 switch. Referring to Figure 1, Figure 1 is a schematic diagram of a broadband access network provided by the prior art. User A and user B are connected to the same NAS. When user A wants to communicate with user B, it needs to pass through access node AN1 and convergence point 1 and the convergence point 2 to send the data to the NAS, and the NAS forwards the data to the user B through the convergence point 2, the convergence point 3 and the access node AN2 after receiving the data. With the continuous growth of users and the continuous emergence of P2P (Peer to Peer, point-to-point) streaming media services, the existing access network architecture will make the traffic passing through the NAS too high, resulting in an overloaded network.

The prior art provides a scheme for realizing P2P traffic Layer 2 intercommunication in the access network. This scheme first needs to create a new dedicated VLAN (Virtual Local Area Network, Virtual Local Area Network) in the access network, which is called P2P VLAN, namely Create P2P VLANs on all ANs and convergence point devices, so that these devices can realize Layer 2 intercommunication through P2P VLANs; at the same time, add ARP (Address Resolution Protocol, Address Resolution Protocol) proxy function and judgment function on all ANs, and ARP proxy on ANs The function includes three modules: uplink ARP module, downlink ARP module and ARP cache module; the judging function on the AN is used to judge whether the user directly connected to it currently enables P2P services. Referring to FIG. 2, FIG. 2 is a schematic diagram of an access network for realizing P2P traffic Layer 2 intercommunication provided by the prior art. Ingress node AN1 and access node AN2, gateway BRAS (Broadband Remote Access Server, broadband remote access server). Wherein, the function of the gateway BRAS is the same as that of the NAS.

Referring to FIG. 3, FIG. 3 is a flow chart of a method for realizing P2P traffic Layer 2 intercommunication provided by the prior art. Taking the access network provided in FIG. 2 as an example, the specific steps for establishing the source device D2 to the destination device D1 Layer 2 intercommunication are as follows:

Step 101: The source device D2 sends an ARP request to the destination device D1, requesting the MAC (Media Access Control, Media Access Control) address of the destination device D1.

Step 102: the access node AN2 performs an ARP proxy function, and receives the ARP request sent by the source device D2.

Step 103: The access node AN2 judges whether the source device D2 has enabled the P2P service, if the source device D2 has enabled the P2P service, proceed to step 104; if the source device D2 has not enabled the P2P service, proceed to step 105.

Step 104: The uplink ARP module in the access node AN2 broadcasts the received ARP request in the P2P VLAN, and then executes step 106.

Step 105: the access node AN2 replies to the source device D2 with the MAC address of the BRAS.

Step 106: The downlink ARP module in the access node AN1 receives the ARP request of the request destination device D1 broadcast by the access node AN2.

Step 107: The access node AN1 judges whether the destination device D1 has enabled the P2P service, if the destination device D1 has enabled the P2P service, proceed to step 108; if the destination device has not enabled the P2P service, proceed to step 109.

Step 108: the access node AN1 queries the MAC address of the destination device D1 in the ARP cache module, and the uplink ARP module in the destination access node AN1 responds to the access node AN2 in the P2P VLAN with the MAC address of the destination device D1, namely Send an ARP reply packet, and then perform step 110.

Step 109: the access node AN1 responds to the access node AN2 with the MAC address of the BRAS.

Step 110: The downlink ARP module of the access node AN2 receives the ARP reply message sent by AN1, and forwards the ARP reply message to the source device D2.

Step 111: The source device D2 receives the ARP reply message and obtains the MAC address of the destination device D1. At this time, the source device D2 uses the MAC address of the destination device D1 to send the message. The message does not pass through the BRAS, but through the access node AN1 and access node AN2 perform Layer 2 forwarding to the destination device D1 in the P2P VLAN.

In this solution, users realize Layer 2 intercommunication through P2P VLAN, which reduces the load on the NAS. However, during the intercommunication process, the source device knows the MAC address of the destination device, which has certain security risks.

Contents of the invention

In order to share the load on the NAS and ensure the security of the access network, the embodiment of the present invention provides a method, system and access device for realizing layer-2 intercommunication of local specific services, and the technical solution is as follows:

A method for realizing two-layer intercommunication of local specific services, the method comprising:

Selecting a source access node corresponding to a source device of a local specific service and a destination access node corresponding to a destination device in the same virtual local area network, and creating a layer-2 channel between the source access node and the destination access node;

After the source access node receives the message, judge whether the message is a specific service message, and if so, send the message to the destination access node through the layer-2 channel;

After receiving the packet, the destination access node sends the packet to the destination device.

The embodiment of the present invention also provides a system for realizing Layer 2 intercommunication of local specific services, and the system includes: a network access server, a source access device, and a destination access device;

The network access server is used to notify the source access device to record characteristic information of specific service packets;

The source access device and the destination access device are in the same virtual local area network, and there is a layer-2 channel between the source access device and the destination access device;

The source access device is used to receive the message, extract the feature information of the message, judge whether the feature information of the message is the same as the feature information of the specific service message, and if they are the same, extract the feature information of the message sending the message to the destination access device through the Layer 2 channel;

The destination access device is configured to receive the message sent by the source access device, and send the message to the destination device.

The embodiment of the present invention also provides an access device, and the device includes:

A receiving module, configured to receive messages;

A judging module, configured to judge whether the message received in the receiving module is a specific service message;

A sending module, configured to forward the message through a Layer 2 channel in the virtual local area network when the judging result of the judging module is that the message is a specific service message, otherwise, forward the message through a network access server arts.

By adopting the technical solution provided by the embodiment of the present invention, by establishing a layer-2 channel between two specific access nodes of the virtual local area network, and using the layer-2 channel to forward messages, it is not necessary to forward specific service messages to the NAS, reducing the burden on the NAS load. Moreover, the source device does not need to know the MAC address of the destination device, which ensures the security of the access network.

Description of drawings

FIG. 1 is a schematic diagram of a broadband access network provided by the prior art;

FIG. 2 is a schematic diagram of an access network for realizing P2P traffic Layer 2 intercommunication provided by the prior art;

FIG. 3 is a flow chart of a method for realizing P2P traffic Layer 2 intercommunication provided by the prior art;

FIG. 4 is a schematic diagram of an access network topology provided by Embodiment 1 of the present invention;

FIG. 5 is a flow chart of a method for implementing Layer 2 interworking of local specific services provided by Embodiment 1 of the present invention;

FIG. 6 is a system structure diagram for implementing Layer 2 intercommunication of local specific services provided by Embodiment 2 of the present invention;

FIG. 7 is a structural diagram of an access device provided by Embodiment 3 of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

The embodiment of the present invention creates a special layer-2 channel for specific service messages, so that these messages do not pass through the NAS when they are forwarded, thereby reducing the burden of the NAS and ensuring the security of the access network.

Example 1

Referring to Figure 4, it is a schematic diagram of the access network topology provided by Embodiment 1 of the present invention, which includes: two user equipments (user 1 and user 2), access node AN1 and access node AN2, aggregation layer, network access Server NAS.

Wherein, user 1 and user 2 are connected to the same NAS through access nodes AN1 and AN2 connected to the convergence layer. The specific service message transmitted between user 1 and user 2 is a local specific service message, for example: IPTV (Internet Protocol TeleVision, Internet TV) service message, FTP (File Transfer Protocol, file transfer protocol) service message, SMTP ( Simple Mail Transfer Protocol, Simple Mail Transfer Protocol) business messages, etc.

The access nodes AN1 and AN2 are in the same VLAN as the nodes in the aggregation layer. According to the physical topology of the network, the NAS selects the access node AN1 corresponding to user 1 and the access node AN2 corresponding to user 2. Create a layer-2 channel between AN1 and AN2; and add the ability to distinguish local specific service messages on the access node AN1, for example: ACL (Access Control List, access control list) function. When AN2 is used as a source access node, it is also necessary to increase the capability of distinguishing local specific service packets on AN2.

Referring to Fig. 5, Fig. 5 is a flow chart of the method for implementing Layer 2 intercommunication of local specific services provided by Embodiment 1 of the present invention. This embodiment provides a method for realizing Layer 2 interworking of local specific services. network as an example. Wherein, user 1 and user 2 are respectively used as a source device and a destination device, and AN1 and AN2 are respectively used as a source access node and a destination access node. The method includes:

Step 201: NAS starts Layer 2 interworking and records the feature information of the local specific service message, the MAC address of user 1 and the MAC address of user 2 corresponding to the local specific service message, and the MAC addresses of AN1 and AN2.

Feature information can be five-tuple information, including IP address of user 1, IP address of user 2, transport layer port number of user 1, transport layer port number and transport layer type of user 2; feature information can also be a six-tuple Information, including the IP address of user 1, the IP address of user 2, the transport layer port number of user 1, the transport layer port number of user 2, the transport layer type, and the service type field; or the feature information is simplified to the transport layer port of user 1 or the feature information is simplified to the transport layer port number of user 2; or the feature information is simplified to the service type field; or the transport layer port number of user 1 and the transport layer port number of user 2; or the transport layer port number of user 1 number, the transport layer port number of user 2, and the service type field.

For example only, the local specific service in this embodiment is an IPTV service message, and the feature information of the IPTV service message is quintuple information, that is, the IP address of user 1 and the IP address of user 2 carried in the IPTV message. Address, transport layer port number of user 1, transport layer port number and transport layer type of user 2.

The NAS can initiate Layer 2 intercommunication of a specific service between user 1 and user 2 through notification from other external service devices or through self-awareness. Other external service devices here may be policy control servers, or devices capable of policy control.

Step 202: NAS notifies AN1 to create and store a feature information table, and store the recorded feature information in the feature information table to match the local specific service message between user 1 and user 2, so that the message matching this feature passes through the VLAN Forward to the corresponding AN.

For example, the specific form of the feature information table in this embodiment is an ACL table. By adding the ACL function on AN1, when AN1 receives a message, if a matching entry can be found in the ACL table, the message The five-tuple information of the text is the same as the five-tuple information of the IPTV service message, indicating that the message is an IPTV service message, and the message will not be forwarded through the NAS. If no matching entry is found in the ACL table, that is The quintuple information of the message is different from the quintuple information of the IPTV service message, indicating that the message is not an IPTV service message, and the message is forwarded through the NAS according to the forwarding method in the prior art.

Step 203: Create a Layer 2 channel between AN1 and AN2 in the same VLAN where AN1 and AN2 are located.

The specific process of creating a Layer 2 channel is as follows:

AN1 and AN2 open a Layer 2 channel by sending broadcast frames, single frames carrying each other's MAC address, or messages to each other; or enable the ACL function first, and create a Layer 2 channel through local specific service messages.

At the same time, record the corresponding relationship between the MAC address and IP address of user 1 on AN1, and record the corresponding relationship between the MAC address and IP address of user 2 on AN2;

After AN1 learns the MAC address of AN2 and AN2 learns the MAC address of AN1, AN1 enables the packet differentiation function, that is, distinguishes IPTV service packets through the ACL function.

Step 204: After receiving the message, AN1 extracts the feature information of the message, and judges whether the extracted feature information is the same as the feature information of the local specific service message, that is, checks in the ACL whether there is a match with the feature information of the message entries, if they are the same, go to step 205; otherwise, go to step 207.

For example, what this embodiment specifically extracts is the quintuple information of the message, and it is judged whether the extracted quintuple information is the same as the quintuple information of the IPTV service message, that is, whether there is a quintuple information corresponding to the message in the ACL The entry that matches the five-tuple information.

Step 205: AN1 modifies the destination MAC address of the packet to the MAC address of AN2, modifies the source MAC address to the MAC address of AN1, and forwards the packet to AN2 through the VLAN.

Step 206: After AN2 receives the message, search for the MAC address corresponding to the destination IP address of the message. The MAC address found in this embodiment is the MAC address of user 2. At this time, the original destination MAC address in the message is modified is the MAC address of user 2, the source MAC address is changed to the MAC address of the NAS, and then the packet is sent to user 2.

Step 207: Send the packet to the NAS through the convergence layer, and the NAS forwards the packet to User 2.

Example 2

Referring to Fig. 6, Fig. 6 is a system structure diagram for implementing Layer 2 intercommunication of local specific services provided by Embodiment 2 of the present invention. This embodiment provides a system for realizing Layer 2 intercommunication of local specific services. The system includes: network access A server, a source access device, and a destination access device; the local specific service in this embodiment may be an IPTV, FTP or SMTP service message.

Wherein, the network access server is used to notify the source access device to record the characteristic information of the specific service message;

The source access device and the destination access device are in the same VLAN, and there is a Layer 2 channel between the source access device and the destination access device;

The source access device is used to receive the message, extract the feature information of the message, judge whether the extracted feature information is the same as the feature information of the specific service message, and if they are the same, pass the message through the two The layer channel is sent to the destination access device;

The destination access device is used to receive the packet sent by the source access device and send it to the destination device.

The feature information of the specific service message is pre-stored on the above-mentioned source access device as a basis for judging whether the received message is forwarded through the layer-2 channel in the virtual local area network.

Example 3

Referring to FIG. 7, FIG. 7 is a structural diagram of an access device provided in Embodiment 3 of the present invention. This embodiment provides an access device, which includes:

A receiving module, configured to receive messages;

A judging module, configured to judge whether the message received in the receiving module is a specific service message;

The sending module is used to forward the message through the layer-2 channel in the virtual local area network when the judging result of the judging module is that the message is a specific service message, otherwise, forward the message through the network access server.

Wherein, the judging module judges whether the message received in the receiving module is a specific service message by judging whether the feature information of the message is the same as the feature information of the specific service message, if the feature information of the message is the same as the feature information of the specific service message If the information is the same, the message is a specific service message.

Adopting the technical solution provided by the embodiment of the present invention adds the function of distinguishing business messages and forwards specific service messages through a virtual local area network, which reduces the burden on the NAS; at the same time, the source device and the destination device do not know the MAC address of the other party, thereby ensuring security of the access network.

The technical solutions provided by the above embodiments can be implemented by hardware and software, and the software is stored on a readable storage medium, such as a computer floppy disk, hard disk or optical disk.

The above-described embodiments are only preferred specific implementations of the present invention, and ordinary changes and replacements performed by those skilled in the art within the scope of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims (10)

1. a method that realizes intercommunication of two layers of local specific service is characterized in that, described method comprises:

The source access node of the source device correspondence of selection local specific service and the purpose access node of destination device correspondence are created double layer channel between described source access node and described purpose access node in same VLAN;

After described source access node receives message, judge whether described message is the specific transactions message, if described message is sent to described purpose access node by described double layer channel;

After described purpose access node is received described message, described message is sent to described destination device.

2. the method for realization intercommunication of two layers of local specific service as claimed in claim 1 is characterized in that, after described source access node receives message, judges that whether described message is the specific transactions message, comprising:

After described source access node receives message, extract the characteristic information of described message;

Whether the characteristic information of judging described message is identical with the characteristic information of specific transactions message.

3. the method for realization intercommunication of two layers of local specific service as claimed in claim 2 is characterized in that, the characteristic information of described specific transactions message is specially:

The transport layer source port number;

Or, transport layer destination slogan;

Or, the type of service territory;

Or, transport layer source port number and transport layer destination slogan;

Or, transport layer source port number, transport layer destination slogan and type of service territory;

Or, source IP address, purpose IP address, transport layer source port number, transport layer destination slogan and transport layer type;

Or, source IP address, purpose IP address, transport layer source port number, transport layer destination slogan, transport layer type and type of service territory.

4. the method for realization intercommunication of two layers of local specific service as claimed in claim 2 is characterized in that, describedly judges whether the characteristic information of described message is identical with the characteristic information of specific transactions message, comprising:

Search the list item that the characteristic information with described message is complementary in the characteristic information table of described source access node, if find, then the characteristic information of described message is identical with the characteristic information of specific transactions message, otherwise, inequality.

5. the method for realization intercommunication of two layers of local specific service as claimed in claim 4 is characterized in that, described characteristic information table specifically is access control list.

6. the method for realization intercommunication of two layers of local specific service as claimed in claim 1 is characterized in that, describedly creates double layer channel between described source access node and described purpose access node, comprising:

Described source access node and described purpose access node are sent out broadcast frame mutually or are sent out mutually and carry the single frames of side mac address or the literary composition of transmitting messages mutually;

The characteristic information of record specific transactions message, MAC Address and the corresponding relation of IP address and the MAC Address of described purpose access node of described source device on the access node of described source;

Write down MAC Address and the corresponding relation of IP address and the MAC Address of described source access node of described destination device at described purpose access node;

On the access node of described source, described specific transactions message is enabled message and distinguish function.

7. as the method for the described realization intercommunication of two layers of local specific service of arbitrary claim in the claim 1 to 6, it is characterized in that, described described message sent to described purpose access node by described double layer channel, comprising:

The target MAC (Media Access Control) address that described source access node is revised in the described message is the MAC Address of described purpose access node, and source MAC is the MAC Address of described source access node;

Described message is sent to described purpose access node by described double layer channel;

Correspondingly, after described purpose access node is received described message, described message is sent to described destination device, comprising:

After described purpose access node is received described message, search the MAC Address of the purpose IP address correspondence of described message, with the MAC Address found MAC Address as destination device, the target MAC (Media Access Control) address of revising described message is the MAC Address of described destination device, and source MAC is the MAC Address of network access server;

Described message is sent to described destination device.

8. a system that realizes intercommunication of two layers of local specific service is characterized in that, described system comprises: network access server, source access device and purpose access device;

Described network access server is used to notify the characteristic information of described source access device record specific transactions message;

Described source access device and purpose access device and have double layer channel between described source access device and purpose access device in same VLAN;

Described source access device is used to receive message, and extract the characteristic information of described message, whether the characteristic information of judging described message is identical with the characteristic information of described specific transactions message, if identical, described message sent to described purpose access device by described double layer channel;

Described purpose access device is used to receive the message that described source access device sends, and described message is sent to destination device.

9. an access device is characterized in that, described equipment comprises:

Receiver module is used to receive message;

Judge module is used for judging whether the message that described receiver module receives is the specific transactions message;

Sending module when being used for judged result when described judge module and being described message and being the specific transactions message, is transmitted described message by the double layer channel in the VLAN, otherwise, transmit described message by network access server.

10. access device as claimed in claim 9, it is characterized in that, whether the characteristic information of described judge module by judging described message be identical with the characteristic information of specific transactions message judges whether the message that receives in the described receiver module is the specific transactions message, if the characteristic information of described message is identical with the characteristic information of specific transactions message, then described message is the specific transactions message.

Images