System, device, and method for receiver access control in a multicast communication network

• US 7,454,518 B1
• Filed: 09/12/2000
• Issued: 11/18/2008
• Est. Priority Date: 09/12/2000
• Status: Expired due to Fees

• Current Assignee: Avaya Incorporated
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Hardjono, Thomas P., Cain, Bradley
• Primary Examiner(s): Cardone, Jason
• Assistant Examiner(s): CHOUDHURY, AZIZUL Q
• Application Number:
  US09/660,110
• Time in Patent Office: 2,989 Days
• Field of Search: 709/249, 709/250, 709/251, 709/252, 709/253, 709/229, 709/238, 709/225
• US Class Current: 709/238
• CPC Class Codes: H04L 12/185 with management of multicast group membership
• CPC Class Codes: H04L 12/1854 with non-centralised forwarding system, e.g. chaincast
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A system, device, and method for receiver access control in a multicast communication network treats each subscriber location as a separate subnetwork having one and only one multicast receiver. An access device is situated at each subscriber location. Each access device connects to a separate port of a multicast distribution device. Each subscriber device accesses the multicast network through the access device that is situated at its subscriber location. Each access device acts as a proxy for its respective subscriber devices by joining and leaving multicast groups on behalf of the subscriber devices and acting as the sole multicast receiver for the subscriber location. The access devices run a multicast group management protocol for joining and leaving various multicast groups, and therefore the access devices appear to the multicast distribution device as the ultimate multicast receivers for multicast information. The access devices maintain group membership information their respective subscriber devices and distribute multicast information to their respective subscriber devices accordingly.

Claims

1. A multicast communication system comprising a plurality of subscriber locations, each subscriber location having an access device through which a plurality of subscriber devices access multicast information sent by a multicast distribution device, wherein each access device acts as a sole multicast receiver for its respective subscriber location and distributes multicast information received from the multicast distribution device to the subscriber devices at its respective subscriber location, wherein each said access device operates by joining and leaving at least one multicast group as a substitute for the subscriber devices at its respective subscriber location, and wherein each said access device processes a first join request received from one of said subscriber devices by determining whether said access device is already joined to a multicast group indicated by said first join request, and, in the event that said access device is not already joined to said multicast group indicated by said first join request, sending a second join request to said multicast distribution device, wherein said second join request is a request for said access device to join said multicast group, wherein said access device does not forward said first join request to said multicast distribution service, wherein said joining said multicast group by said access device on behalf of said first subscriber device includes authenticating, in response to said second join request, said access device by said multicast distribution device, and wherein said multicast distribution device does not authenticate said subscriber devices at said subscriber location for said access device prior to said access device distributing to each of said subscriber devices at said subscriber location for said access device multicast information sent to said access device by said multicast distribution device over multicast routes established to said access device from said multicast distribution device in response to said multicast distribution device successfully authenticating said access device and said access device having joined said multicast group as a result of said successful authentication.

2. The multicast communication system of claim 1, wherein the multicast distribution device distributes multicast information for a number of multicast groups, and wherein each access device uses a predetermined multicast group management protocol to join the multicast groups on behalf of the subscriber devices at its respective subscriber location.

3. The multicast communication system of claim 2, wherein the predetermined multicast group management protocol is an Internet Group Management Protocol (IGMP).

5. The multicast communication system of claim 1, wherein each access device is coupled to a separate interface of the multicast distribution device.

6. The multicast communication system of claim 5, wherein the multicast distribution device identifies each access device based upon the interface to which the access device is coupled.

7. The multicast communication system of claim 5, wherein each access device joins multicast groups maintained by the multicast distribution device on behalf of its respective subscriber devices using a multicast group management protocol.

8. The multicast communication system of claim 7, wherein the multicast distribution device sends multicast information to the access devices based upon multicast group memberships of the access devices.

9. The multicast communication system of claim 7, wherein each access device distributes multicast information received from the multicast distribution device to its respective subscriber devices.

4. A multicast communication system comprising a multicast distribution device coupled to a plurality of subscriber locations, wherein each subscriber location is a separate subnetwork of the multicast distribution device, wherein each subscriber location comprises one and only one access device through which a plurality of subscriber devices at the subscriber location access multicast information distributed by the multicast distribution device, wherein each access device acts as a sole multicast receiver for its respective subscriber location and distributes multicast information received from the multicast distribution device to the subscriber devices at its respective subscriber location, and wherein each said access device operates by joining and leaving at least one multicast group as a substitute for the subscriber devices at its respective subscriber location, and wherein said access device processes a first join request received from one of said subscriber devices by determining whether said access device is already joined to a multicast group indicated by said join request, and, in the event that said access device is not already joined to said multicast group indicated by said join request, sending a second join request to said multicast distribution device, wherein said second join request is a request for said access device to join said multicast group, wherein said access device does not forward said first join request to said multicast distribution service, wherein said joining said multicast group by said access device as a substitute for the subscriber devices includes authenticating, in response to said second join request, said access device by said multicast distribution device, and wherein said multicast distribution device does not authenticate said subscriber devices at said subscriber location for said access device prior to said access device distributing to each of said subscriber devices at said subscriber location for said access device multicast information sent to said access device by said multicast distribution device over multicast routes established to said access device from said multicast distribution device in response to said multicast distribution device successfully authenticating said access device and said access device having joined said multicast group as a result of said successful authentication.

10. The multicast communication system of claim 4, wherein the multicast distribution device maintains accounting information for each subnetwork.

11. The multicast communication system of claim 10, wherein the accounting information comprises multicast group memberships for each subnetwork.

12. The multicast communication system of claim 11, wherein the accounting information comprises a duration for each multicast group membership for each subnetwork.

13. The multicast communication system of claim 11, wherein the accounting information comprises a volume of multicast information for each multicast group membership for each subnetwork.

14. In a communication system having a multicast distribution device coupled to a plurality of subscriber locations, each subscriber location having an access device and a plurality of subscriber devices, wherein each access device acts as a sole multicast receiver for its respective subscriber location and distributes multicast information received from the multicast distribution device to the subscriber devices at its respective subscriber location, and wherein each said access device acts to join and leave at least one multicast group on behalf of the subscriber devices at its respective subscriber location, an access control method comprising:

maintaining a number of multicast groups by the multicast distribution device; and

joining one of said number of multicast groups by a first subscriber device, wherein joining one of said number of multicast groups by the first subscriber device comprises;

sending a first join request by the first subscriber device to an access device using a first multicast group management protocol;

determining, by said access device, whether said access device is already joined to a multicast group indicated by said join request;

in the event that said access device is not already joined to said multicast group indicated by said join request, joining the multicast group by the access device as a substitute for the first subscriber device by sending a second join request to said multicast distribution device, wherein said second join request is a request for said access device to join said multicast group, wherein said access device does not forward said first join request to said multicast distribution service, and authenticating, in response to said second join request, said access device by said multicast distribution device, and wherein said multicast distribution device does not authenticate said subscriber devices at said subscriber location for said access device prior to said access device distributing to each of said subscriber devices at said subscriber location for said access device multicast information sent to said access device by said multicast distribution device over multicast routes established to said access device from said multicast distribution device in response to said multicast distribution device successfully authenticating said access device and said access device having joined said multicast group as a result of said successful authentication; and

associating, in response to said first join request, the first subscriber device with the multicast group by the access device.

15. The access control method of claim 14, wherein authenticating the access device by the multicast distribution device comprises:

identifying the access device by the multicast distribution device.

16. The access control method of claim 15, wherein the access device is coupled to an interface of the multicast distribution device, and wherein identifying the access device by the multicast distribution device comprises:

identifying the access device based upon the interface over which the second join request is received by the multicast distribution device.

17. The access control method of claim 14, wherein authenticating the access device by the multicast distribution device comprises:

authenticating the access device using a predetermined authentication scheme.

18. The access control method of claim 17, wherein the predetermined authentication scheme comprises IPsec AH.

19. The access control method of claim 14, further comprising:

determining by the multicast distribution device that the access device is authentic; and

establishing a multicast group membership for the access device by the multicast distribution device.

20. The access control method of claim 14, further comprising:

determining by the multicast distribution device that the access device is not authentic; and

denying a multicast group membership for the access device by the multicast distribution device.

21. The access control method of claim 14, wherein associating the first subscriber device with the multicast group by the access device comprises:

maintaining by the access device a list of subscriber devices associated with the multicast group; and

adding the first subscriber device to the list of subscriber devices associated with the multicast group.

22. The access control method of claim 14, further comprising:

leaving the multicast group by the first subscriber device;

leaving the multicast group by the access device on behalf of the first subscriber device; and

disassociating the first subscriber device from the multicast group by the access device.

23. The access control method of claim 14, further comprising:

joining the multicast group by a second subscriber device, wherein joining the multicast group by the second subscriber device comprises;

sending a third join request by the second subscriber device to the access device using a third multicast group management protocol; and

associating, in response to the third join request, the second subscriber device with the multicast group by the access device.

24. The access control method of claim 23, further comprising:

leaving the multicast group by one of the first subscriber device and the second subscriber device;

remaining joined to the multicast group by the access device on behalf of the remaining subscriber device; and

disassociating said one of the first subscriber device and the second subscriber device from the multicast group by the access device.

25. The access control method of claim 14, further comprising:

maintaining accounting information by the multicast distribution device for each multicast group for each subscriber location.

26. An apparatus for operating as a sole multicast receiver on behalf of a plurality of subscriber devices at a subscriber location in a multicast communication network, the apparatus comprising:

a network interface couplable to a multicast distribution device;

a subscriber interface couplable to the number of subscriber devices at the subscriber location; and

switching logic interposed between the network interface and the subscriber interface, wherein the switching logic is operably coupled to join and leave multicast groups maintained by the multicast distribution device as a substitute for the plurality of subscriber devices at the subscriber location and forward multicast information to the subscriber devices at the subscriber location, and wherein said switching logic processes a first join request received from a first one of said subscriber devices by determining whether said apparatus is already joined to a multicast group indicated by said join request, and, in the event that said apparatus is not already joined to said multicast group indicated by said join request, sending a second join request to said multicast distribution device, wherein said second join request is a request for said apparatus to join said multicast group, wherein said switching logic does not forward said first join request to said multicast distribution device, and wherein said joining said multicast group by said access device as a substitute for the subscriber devices includes authenticating, in response to said second join request, said access device by said multicast distribution device, and wherein said multicast distribution device does not authenticate said subscriber devices at said subscriber location for said access device prior to said access device distributing to each of said subscriber devices at said subscriber location for said access device multicast information sent to said access device by said multicast distribution device over multicast routes established to said access device from said multicast distribution device in response to said multicast distribution device successfully authenticating said access device and said access device having joined said multicast group as a result of said successful authentication.

27. The apparatus of claim 26, wherein the switching logic comprises:

first multicast group management logic operably coupled to control first multicast group memberships between the apparatus and the subscriber devices;

second multicast group management logic operably coupled to control second multicast group memberships between the apparatus and the multicast distribution device; and

membership logic operably coupled to maintain said first and second multicast group memberships.

28. The apparatus of claim 27, wherein the first multicast group management logic comprises Internet Group Management Protocol (IGMP) logic for exchanging multicast group membership information with the subscriber devices.

29. The apparatus of claim 27, wherein the second multicast group management logic comprises Internet Group Management Protocol (IGMP) logic for exchanging multicast group membership information with the multicast distribution device.

30. The apparatus of claim 27, wherein the membership logic is operably coupled to associate the first multicast group memberships with the second multicast group memberships.

31. The apparatus of claim 27, wherein the membership logic is operably coupled to maintain a list of subscriber devices for each of said second multicast group memberships.

32. The apparatus of claim 27, wherein the first multicast group management logic is operably coupled to receive the first join request.

33. The apparatus of claim 32, wherein the second multicast group management logic is operably coupled to join the multicast group instead of the first one of said subscriber devices.

34. The apparatus of claim 32, wherein the membership logic is operably coupled to associate the first one of the subscriber devices with the multicast group in response to the first join request.

35. The apparatus of claim 27, wherein the first multicast group management logic is operably coupled to determine that a subscriber device has left a multicast group.

36. The apparatus of claim 35, wherein the membership logic is operably coupled to disassociate the subscriber device from the multicast group.

37. The apparatus of claim 36, wherein the second multicast group management logic is operably coupled to determine whether there are any remaining subscriber devices associated with the multicast group based upon the membership information maintained by the membership logic.

38. The apparatus of claim 37, wherein the second multicast group management logic is operably coupled to remain a member of the multicast group upon determining that there is at least one remaining subscriber device associated with the multicast group.

39. The apparatus of claim 37, wherein the second multicast group management logic is operably coupled to leave the multicast group upon determining that there are no remaining subscriber devices associated with the multicast group.

40. A computer readable storage medium having stored thereon a computer program for, when executed on a microprocessor, controlling a computer system, the computer program comprising:

network interface logic for communicating with a multicast distribution device;

subscriber interface logic for communicating with a plurality of subscriber devices at a subscriber location; and

switching logic logically interposed between the network interface logic and the subscriber interface logic, wherein the switching logic is programmed to join and leave multicast groups maintained by the multicast distribution device as a substitute for the plurality of subscriber devices and forward multicast information to the plurality of subscriber devices, and wherein said switching logic processes a first join request received from one of said subscriber devices by determining whether said switching logic is already joined to a multicast group indicated by said first join request, and, in the event that said switching logic is not already joined to said multicast group indicated by said first join request, sending a second join request to said multicast distribution device, wherein said second join request is a request for an access device including said switching logic to join said multicast group, wherein said switching logic does not forward said first join request to said multicast distribution device, and wherein said joining said multicast group as a substitute for the subscriber devices includes authenticating, in response to said second join request, an access device including said switching logic, said network interface logic, and said subscriber interface logic, by said multicast distribution device, and wherein said multicast distribution device does not authenticate said subscriber devices at said subscriber location for said access device prior to said access device distributing to each of said subscriber devices at said subscriber location for said access device multicast information sent to said access device by said multicast distribution device over multicast routes established to said access device from said multicast distribution device in response to said multicast distribution device successfully authenticating said access device and said access device having joined said multicast group as a result of said successful authentication.

41. The computer readable storage medium of claim 40, wherein the switching logic comprises:

first multicast group management logic programmed to control first multicast group memberships between the computer system and the subscriber devices;

second multicast group management logic programmed to control second multicast group memberships between the computer system and the multicast distribution device; and

membership logic programmed to maintain said first and second multicast group memberships.

42. The computer readable storage medium of claim 41, wherein the first multicast group management logic comprises Internet Group Management Protocol (IGMP) logic for exchanging multicast group membership information with the subscriber devices.

43. The computer readable storage medium of claim 41, wherein the second multicast group management logic comprises Internet Group Management Protocol (IGMP) logic for exchanging multicast group membership information with the multicast distribution device.

44. The computer readable storage medium of claim 41, wherein the membership logic is programmed to associate the first multicast group memberships with the second multicast group memberships.

45. The computer readable storage medium of claim 41, wherein the membership logic is programmed to maintain a list of subscriber devices for each of said second multicast group memberships.

46. The computer readable storage medium of claim 41, wherein the first multicast group management logic is programmed to receive the first join request.

47. The computer readable storage medium of claim 46, wherein the second multicast group management logic is programmed to join the multicast group instead of said one of said subscriber devices.

48. The computer readable storage medium of claim 41, wherein the membership logic is programmed to associate said one of said subscriber devices with the multicast group in response to said first join request.

49. The computer readable storage medium of claim 41, wherein the first multicast group management logic is programmed to determine that a subscriber device has left a multicast group.

50. The computer readable storage medium of claim 49, wherein the membership logic is programmed to disassociate the subscriber device from the multicast group.

51. The computer readable storage medium of claim 50, wherein the second multicast group management logic is programmed to determine whether there are any remaining subscriber devices associated with the multicast group based upon the membership information maintained by the membership logic.

52. The computer readable storage medium of claim 51, wherein the second multicast group management logic is programmed to remain a member of the multicast group upon determining that there is at least one remaining subscriber device associated with the multicast group.

53. The computer readable storage medium of claim 51, wherein the second multicast group management logic is programmed to leave the multicast group upon determining that there are no remaining subscriber devices associated with the multicast group.