Distribution of multicast information in a routing system

Patent metadata

Field	Value
Publication number	US-11070465-B2
Application number	US-201916410128-A
Country	US
Kind code	B2
Filing date	May 13, 2019
Priority date	May 13, 2019
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

A routing system for distributing multicast routing information for a multicast service includes a plurality of routers including a multicast source router and a plurality of multicast receiver routers, the plurality of routers providing a multicast service, wherein the routers are configured to exchange multicast information associated with the multicast service including identification of multicast sources and the multicast receivers.

First claim

What is claimed is:

1. A routing system for providing multicast access control, the routing system comprising:
a plurality of routers comprising:
a multicast source router; and
a plurality of multicast receiver routers,

wherein the plurality of routers are configured to provide a multicast service,
wherein the plurality of routers are configured to enforce multicast access control policies for the multicast service, and
wherein the multicast access control policies comprise:
a tenant-based receiver access policy that specifies at least one receiver tenant allowed to receive packets from the multicast service, wherein the plurality of routers are further configured to accept multicast join requests for joining a multicast group for the multicast service only from interfaces of the plurality of multicast receiver routers that are associated with the at least one receiver tenant specified by the tenant-based receiver policy; and
a sender access policy that specifies the multicast source router as allowed to send packets to the multicast service for distribution to the specified at least one receiver tenant.

2. The system of claim 1 ,
wherein the sender access policy comprises a tenant-based sender access policy that specifies at least one source tenant allowed to send packets to the multicast service,
wherein the plurality of routers are further configured to accept packets sent to the multicast service only from interfaces of the multicast source router that are associated with the at least one source tenant specified by the tenant-based sender policy.

3. The system of claim 1 ,
wherein the plurality of routers are configured to receive a configuration overriding the tenant-based receiver access policy, and
wherein, in response to receiving the configuration overriding the tenant-based receiver access policy, the plurality of routers are configured to accept a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver policy.

4. The system of claim 1 ,
wherein the plurality of routers are configured to receive a configuration overriding the tenant-based receiver access policy, and
wherein, in response to receiving the configuration overriding the tenant-based receiver access policy, the plurality of routers are configured to reject a multicast group join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is associated with the at least one receiver tenant specified by the tenant-based receiver policy.

5. The system of claim 1 , wherein the plurality of routers are configured to transmit membership query messages on interfaces associated with the at least one receiver tenant specified by the tenant-based receiver policy.

6. The system of claim 1 , wherein the plurality of routers are configured to drop membership report messages received from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

7. The system of claim 1 , wherein the multicast source router is configured to replicate the packets for the multicast service by transmitting the packets as unicast packets for the multicast service to each multicast receiver router associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

8. The system of claim 1 , wherein the multicast source router is configured to:
join a multicast tree for the multicast service; and
transmit a multicast packet as a unicast packet to each multicast receiver router of the plurality of multicast receiver routers.

9. The system of claim 1 , wherein each of the at least one receiver tenant and the source tenant comprise a first sub-network and a second sub-network of a plurality of sub-networks, wherein each sub-network of the plurality of sub-networks is segregated and separated from each other sub-network of the plurality of sub-networks.

10. The system of claim 1 , wherein each of the at least one receiver tenant and the source tenant comprise a Virtual Local Area Network (VLAN) instance, a Virtual eXtensible LAN (VXLAN) instance, or a Virtual Routing and Forwarding (VRF) instance.

11. A router for providing multicast access control, the router comprising:
a datastore configured to store multicast access control policies for a multicast service comprising:
a tenant-based receiver access policy that specifies at least one receiver tenant allowed to receive packets from the multicast service; and
a sender access policy that controls specifies a multicast source router as allowed to send packets to the multicast service for distribution to the specified at least one receiver tenant; and

a controller configured to enforce the multicast access control policies for the multicast service by:
accepting multicast join requests for joining a multicast group for the multicast service only from interfaces of a plurality of multicast receiver routers that are associated with the at least one receiver tenant specified by the tenant-based receiver policy; and
accepting only packets to the multicast service that are sent by the specified multicast source router.

12. The router of claim 11 ,
wherein the sender access policy comprises a tenant-based sender access policy that specifies at least one source tenant allowed to send packets to the multicast service, and
wherein the controller is further configured to accept packets sent to the multicast service only from interfaces of the multicast source router that are associated with the at least one source tenant specified by the tenant-based sender policy.

13. The router of claim 11 , wherein the controller is configured to:
receive a configuration overriding the tenant-based receiver access policy; and
in response to receiving the configuration overriding the tenant-based receiver, accept a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver policy.

14. The router of claim 11 , wherein the controller is configured to:
receive a configuration overriding the tenant-based receiver access policy; and
in response to receiving the configuration overriding the tenant-based receiver access policy, reject a multicast join request for joining the multicast group for the multicast service from an interface of the plurality of multicast receiver routers that is associated with the at least one receiver tenant specified by the tenant-based receiver policy.

15. The router of claim 11 , wherein the controller is configured to transmit membership query messages on interfaces associated with the at least one receiver tenant specified by the tenant-based receiver policy.

16. The router of claim 11 , wherein the controller is configured to drop membership report messages received from an interface of the plurality of multicast receiver routers that is not associated with the at least one receiver tenant specified by the tenant-based receiver access policy.

17. The router of claim 11 , wherein the controller is configured to replicate the packets for the multicast service by transmitting the packets as unicast packets for the multicast service to each multicast receiver router as

Assignees

• 128 Tech Inc

Inventors

• Kaplan Hadriel S
• Menon Abilash
• Timmons Patrick
• Baj Michael
• Penfield Robert
• Melampy Patrick

Classifications

• H04L45/02

  Topology update or discovery · CPC title

• H04L45/48

  Routing tree calculation · CPC title

• H04L45/033

  by updating distance vector protocols · CPC title

• H04L45/16 Primary

  Multipoint routing · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title