KR100781017B1 - How to Realize Safety Isolation of Ethernet Services - Google Patents

Abstract

The present invention relates to a method for realizing the safety isolation of Ethernet services and can meet the demand for telecom operators to establish a virtual private network (VPN) of Layer 2 Ethernet services. First, a customer identifier is distributed to a physical port connecting to a customer service, a customer identifier is assigned to a service that has entered a physical port, and the service is switched or routed before the service is performed on one physical port. It determines whether the customer identifier matches the customer identifier in the port and passes only the matching service. This approach overcomes the shortcomings of VLAN technology simply for one independent enterprise, and addresses the safety isolation challenges that telecom operators face when providing Ethernet / VLAN services to multiple enterprise users. By providing the bridge function, the transparent transmission of services eliminates the need to pay attention to VLAN information during customer service, reduces the complexity of management, and enhances the independence of the facility to adapt telecom companies to manage Ethernet services. Improved operational capability and verifiability of services.

Description

A METHOD FOR ETHERNET NETWORK SERVICE SAFETY ISOLATION}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for realizing the safety isolation of Ethernet services. In particular, when telecom operators in the telecommunications field provide Ethernet services, a private network (VPN) of a second layer (Datalink layer) Ethernet service is provided. It is about how to realize.

Initially, Ethernet technology was used in local area networks (LANs) and targeted users in the enterprise, with very few users. If there are many users and management is inconvenient, more advanced facilities can be used to interconnect multiple Ethernets.

As Ethernet technology matures and is widely used, metropolitan area networks are also being adopted with Ethernet technology. To meet ever-increasing demands, VLAN technology has been added to Ethernet technology to securely isolate services and limit the broadcast range of services (see IEEE 802.1Q).

However, the added VLAN technology is also targeted at enterprises, and setting up VLANs within an enterprise is effective and efficient. However, if you want to provide services to multiple companies, the following problems will exist when the telecom operator realizes secure isolation of Ethernet services using VLAN technology.

-The VLAN setting is set by the operator, which may conflict with the company's existing VLAN setting.

Enterprises have a large number of VLAN services, some of which do not have valid IDs in advance,

-Installation of a large number of VLANs can be cumbersome or even unmanageable.

The amount of VLAN IDs is limited. Theoretically, a facility can support up to 4096 VLANs simultaneously when shared to all users, so the amount of VLANs cannot meet demand.

-The L2 layer switching technology of the commonly used VLAN technology has completed service isolation, but cannot truly realize full bridge in the MAC address list.

The two ports of a traditional L2 floor installation are difficult to loop back and difficult to measure.

The present invention solves the problem that the current VLAN technology is for only one independent enterprise, solves the safety isolation problem that telecom operators face when providing Ethernet / VLAN service, and realizes VPN of L2 layer Ethernet service. The present invention can provide a complete bridged function, complete the transparent transmission of the service, and improve the operability and verifiability of the Ethernet service.

The present invention is realized through the following contents.

In the method of realizing safety isolation of Ethernet service,

1) extend one field in the Ethernet frame format to distinguish different customer services, the field consisting of n bytes and a specific value of n relates to the field format;

2) add the customer identifier to the extended field of the Ethernet frame format after a user service enters an operator's data network;

3) proceed with the conversion / routing process;

4) if the customer service leaves the operator's data network, removing the customer identifier and recovering to the existing frame format.

In the second step, the ID is assigned to the customer service entering the physical port according to a predetermined format based on the customer identifier distributed by the physical port for connecting the customer service.

When the service is performed on one physical port, the fourth procedure determines whether the customer identifier in the customer service matches the customer identifier of the physical port, and passes only the matched customer service.

In step 3), a single MAC address list is maintained for every customer identifier and a spanning tree is independent at the physical port included in every customer identifier through the method of securing and inquiring the MAC address under the condition of the customer identifier. The protocol proceeds to form a true bridge, where the MAC addresses of different customer identifiers may have the same MAC address.

Step 3) avoids broadcasting storms by running a single spanning tree protocol for each customer identifier.

In the above procedure 3, the use of VLAN ID among different customer identifiers is completely isolated, and the customer can select and use VLAN ID to complete internal service isolation.

At the port receiving the customer service in step 3), internal service isolation is established depending on whether the VLAN ID is used or not by selecting schemes using the VLAN ID through network management.

In the above procedure 3), an independent multicast service scheme can be provided based on each customer identifier, and the multicast scheme includes a dynamic multicast protocol or a static multicast setup scheme;

The dynamic multicast protocol indicates that the service port correlated with the multicast service is determined by the dynamic multicast protocol during operation. The dynamic multicast protocol includes the IGMP protocol and the GMRP protocol (see RFC 2236 and IEEE 802.1q). ;

The static multicast configuration format determines the service port correlated with the multicast service by the user performing manual configuration through network management.

In step 3), each customer identifier sets a multicast service scheme through a network management interface, and the option includes a dynamic multicast protocol or a static multicast format.

In the procedure 2), one customer identifier is installed in each physical port, and when the service enters the port, the ID is first given, and the customer identifier does not change all the time until the service outputs from the port and arrives at the user equipment. And when the service leaves the port and arrives at the user facility, the customer identifier is removed and finally arrives at the user facility to realize transparent transmission of the service.

The format used by the field extended to the Ethernet frame format may include a compatible MPLS format, a stacked VLAN format, or a user-defined format to realize service interchange between various facilities.

Install options set by network management on the physical port to provide extended fields to the Ethernet format support of compatible MPLS format, stacked VLAN format or custom format.

Compared with the conventional VLAN technology (IEEE 802.1Q), the service isolation method of the present invention eliminates the need to pay attention to the VLAN information in the customer service, realizes the true virtual bridge, and improves the complexity of management. It is lowered and facility independence is applied to telecom companies to manage Ethernet service.

1 is a diagram showing a service test conducted using the present invention;

2 is a flow diagram of a specific embodiment of the present invention;

3 illustrates support for customer VLAN services using the present invention;

4 is an illustration of implementing service isolation using a customer identifier;

5 illustrates an Ethernet VLAN frame format;

6 is a diagram showing a stacked (stack) VLAN frame format;

7 shows the format of an MPLS frame header.

The isolation method of the Ethernet service according to the present invention includes the following parts.

One field is extended in the Ethernet frame structure, and the data contained in the field is called a customer identifier, and is composed of n bytes to distinguish a service of a customer. This change occurs in the Ethernet frame format after the user's service enters the operator's data network, and when the user's service is out of the operator's network range, it returns to the existing frame format.

First, if a customer identifier is assigned to a service that enters a physical port by distributing one customer identifier to a physical port connecting with customer service, and then a service is to be performed on one physical port, the customer identifier of the service matches the customer identifier of the port. Only the matching service can pass.

Through customer identifiers, one Ethernet facility is made up of multiple virtual Ethernet facilities, which work independently of each other and do not interfere with each other.

Due to the existence of the customer identifier, it maintains a single list of MAC addresses for each customer through the method of obtaining and retrieving the customer identifier + MAC address, and the independent spanning tree protocol on the physical port included in each customer identifier. Can operate a single multicast control on each customer identifier and form a single true virtual bridge, including dynamic multicast protocols or static multicast settings, wherein different customers are the same MAC addresses can be used and each can use different dynamic multicast protocols or static multicast settings.

In Fig. 1, the loop-back test was performed on two equipment to be measured. Where (a, b) is used to indicate the port, where a represents the number of the equipment under test and b represents the port number. (1,1), (1,2), (2,1), (2,2) belong to the customer identifier N, (1,3), (1,4), (2,3), (2, 4) belongs to the customer identifier M and N ≠ M. The service sent from the equipment under measurement first enters (1,1), where it is given a customer identifier N, is sent out from (1,2), enters (2,1), and then again from (2,2). At this time, the customer identifier N is removed. The service sent in (2,2) enters (2,4) again, is given the customer identifier M, again from (2,3), enters (1,4) and then tested in (1,3) again. Sent to the facility. At this time, the customer identifier M is removed. Equivalent function can be completed in the opposite direction.

In Fig. 2, the service first receives the customer identifier at the entrance and then performs the conversion / routing process, and simultaneously takes over and inquires the customer identifier + MAC address, and when the service that has undergone the conversion / routing process arrives at the exit. If the customer identifier in the field does not match with the customer identifier in the field, it is abandoned.

In Fig. 3, the customer service network is confirmed with one customer identifier. VLAN n service flows from field 2 and 3 to field 1, VLAN m flows from field 1 to field 2 and 3 while VLAN function separates between fields 2 and 3 and the same service exists between them. Can't.

Figure 4 shows a typical connection of an urban area network, in which different lines represent different services isolated by customer identifiers and services of different customer identifiers are not interchangeable and each customer identifier is independent. Run Spanning Tree Protocol to avoid broadcasting storms. Among the different customer identifiers, the use of VLAN IDs is completely isolated from each other, and customers can choose to use VLAN IDs to achieve internal service isolation, and may choose not to use them.

Hereinafter, a method of concretely implementing the present invention will be described.

Procedure 1: Assign a customer identifier to the service.

You can install one customer identifier on each physical port, which is given the above notation first when the service enters the port, and the customer identifier remains constant throughout the entire network until the service leaves the port and arrives at the user equipment. Upon arrival at the user facility with me, the customer identifier is removed and finally arrives at the user facility. This makes the transmission of services transparent.

Procedure 2: Segregation of Services

Each physical port owns one customer identifier and is set by the user. When the service outputs from the port, it is first determined whether the customer identifier in the service matches the customer identifier of the port, and if it does not match, it is abandoned.

3) Procedure: Realize the virtual bridge in the true sense.

If the facility is a switched bridge, the customer identifier can be subscribing to MAC addresses and lookups to create a single MAC address list for each customer identifier and run a set of spanning tree protocols for each customer identifier. And at the same time, each customer identifier can run a single, multicast control, including dynamic multicast protocols or static multicast settings. As a result, the interface to each customer identifier functions as a real virtual bridge. .

Refer to FIG. 2 for the basic flow chart of the method.

Step 4: Realize service isolation inside the customer through VLAN ID.

The configuration allows the customer to provide the necessary VLAN functionality within the facility, and because of the behavior of the customer identifier, one customer's VLAN function is limited to the port range of the facility contained by one customer identifier and does not affect the service of other customers. Of course, one customer chooses not to use the VLAN function to realize only transparent transmission of the VLAN function.

A description of the method is made with reference to FIG. 3.

According to the technical design described above, as shown in FIG. 4, elastic isolation of various services can be completed.

Step 5: Realize the Frame Format

Because of the issues of compatibility and interoperability, it is necessary to consider making modifications to the Ethernet frame format in accordance with international standards. Otherwise, services will not be interoperable between facilities of different manufacturers. If international standards have not yet been established, consideration should be given to issues involving MPLS format compatibility and stacking of VLAN formats. If an installation can interoperate with multiple installations, configuration options can be installed from the interface to provide support in different formats. Options for setting customer identifiers include not using, using the compatible MPLS format, using the stacked VLAN format, and using a custom format.

The selection format of the frame format will be described with reference to FIGS. 5, 6, and 7.

5 is a VLAN frame format defined by IEEE 802.1q, of which 0x8100 is a label of a VLAN frame, 0xXXXX is the contents of a VLAN ID, P, C and V are included in it, P is a priority, and numbers from 0 to 7. You can select C, the type of local area network, 0 for Ethernet, 1 for Token Ring, V for VLAN ID, and a value from 0 to 4095.

Fig. 6 shows stacking of frame formats suggested by the VLAN method, where 0x9100 is a label for stacking VLAN frames, and 0xXXXX is a stack of VLAN IDs. This definition has the same VLAN ID definition, and all other configurations have the same IEEE 802.1q.

Figure 7 shows the MPLS frame format defined by RFC 2236. The notation is MPLS notation, Exp is preserved and provided for use in experiments, EOS represents the bottom of the MPLS stack and TTL represents the timeout value.

Specific technical effects of the present invention are as follows.

1 、 Operators do not need to care about the customer's VLAN and do not need to change the VLAN originally installed by the customer.

2 、 Customers can freely change their VLAN installation, and modification and addition of services do not need to go through the operator, and even customer service does not need to include VLAN identification.

3 、 The operator only patches the customer identifier to the customer, the patch is simple.

If 4, n above customer identifiers are used, 2n customers can be stored, and each customer can use 4096 VLANs independently.

5 、 Making a complete virtual bridge in the MAC address list can be realized by using the method of MAC address + customer identification.

6 、 Multicast service of different means can be set up according to customer demand.

7. Since the virtual bridge is realized and the virtual bridge is realized, the test of the facility can be completed by establishing a service test path between the virtual bridges.

Claims (13)

In the method of realizing safety isolation of Ethernet service, 1) extend one field in an Ethernet frame format to distinguish different customer services, the field consisting of n bytes and a specific value of n relates to the format of the field; 2) add a customer identifier to the extended field of the Ethernet frame format when customer service enters the operator's data network; 3) proceed with the conversion / routing process; 4) A method for realizing safety isolation of an Ethernet service, comprising procedures for removing the customer identifier and restoring to an existing frame format when customer service leaves the operator's data network. The method of claim 1, In the second step, a method of realizing the safety isolation of the Ethernet service, wherein the customer service entering the physical port is indicated in a predetermined format by a customer identifier assigned to the physical port for connecting the customer service. . The method according to claim 1 or 2, In step 4), when the customer service is processed on a given physical port, the customer identifier of the customer service is compared with the customer identifier of the physical port, and if the two customer identifiers match, the customer service will proceed or the customer service will be A method for realizing safety isolation of an Ethernet service, characterized in that it is blocked. The method according to claim 1 or 2, In the third process, a single MAC address list is maintained for each customer identifier through a method of securing and inquiring a MAC address based on the customer identifier, and at a physical port included in each customer identifier. A method of realizing safety isolation of Ethernet services, wherein a single spanning tree protocol is generated to form a complete virtual bridge, wherein the same MAC address can be used in the MAC address list of different customer identifiers in the virtual bridge. The method of claim 3, In the third step, a single MAC address list is maintained for each customer identifier through a method of securing and inquiring a MAC address based on the customer identifier, and the only one in the physical port included in each customer identifier is maintained. A spanning tree protocol is generated to form a complete virtual bridge, wherein the same MAC address can be used in the MAC address list of different customer identifiers in the virtual bridge. The method of claim 1, In step 3), a single spanning tree protocol is generated for each customer identifier, so as to avoid broadcasting storms. The method of claim 1, In the above procedure 3, the use of VLAN IDs for different customer identifiers is completely isolated from each other, and the customer can implement internal network isolation using the VLAN ID to realize safety isolation of the Ethernet service. How to. The method of claim 7, wherein In step 3), the internal service isolation is set according to whether the VLAN ID is used by selecting a method using the VLAN ID through network management in the physical port receiving the customer service. How to realize safety isolation. The method of claim 1, In step 3), one unique multicast service scheme is provided for each customer identifier, and the multicast scheme includes a dynamic multicast protocol scheme and a static multicast setup scheme; The dynamic multicast protocol method means that a service port of a multicast service is determined by a dynamic multicast protocol during operation. The dynamic multicast protocol includes an IGMP protocol and a GMRP protocol (see RFC 2236 and IEEE 802.1q). ）; The static multicast setting method is a method for realizing safety isolation of an Ethernet service, characterized in that a user determines a service port of a multicast service by performing manual setting through network management. The method of claim 9, In step 3), each customer identifier sets a multicast service method through network management, and the security service of the Ethernet service is characterized in that there are a dynamic multicast protocol method and a static multicast method in an option of a service method that can be selected. How to realize isolation. The method of claim 1, In the procedure 2), one customer identifier is assigned to each physical port, and when the service enters the port, the service is displayed as the customer identifier, and the customer identifier is used in the entire network until the service leaves the port and reaches the customer equipment. Remains unchanged, then the customer identifier is removed, and finally the service reaches the customer's facility, whereby the service realizes transparent transport. The method of claim 1, The format used by the extended field among the Ethernet frame formats includes compatible MPLS formats, stacked VLAN formats, or user-defined formats, enabling secure isolation of Ethernet services, which enables the interconnection of services between facilities. How to. The method of claim 12, A method of realizing the safety isolation of Ethernet services by installing configuration options through network management on a physical port, providing extended fields of the Ethernet format with support of compatible MPLS formats, stacked VLAN formats, or custom formats.

Images