A data forwarding processing method and system of a campus network

Abstract

The application discloses a kind of data forwarding processing method and system of campus network, method includes: according to access control terminal trigger event, control multiple independent camera generates multicast video stream carrying authority mark;According to the first video stream data packet received by multicast source side specified router source DR, (S, G) table item with authority mark and (*, G) table item that never expire are created on path multicast router simultaneously;According to the IGMP join message sent by receiver carrying authority mark, whether data stream is forwarded along shared tree (RPT) by the matching result of RP comparison (*, G) table item exit interface authority and multicast data authority mark is decided;According to the matching result of the authority mark of new receiver and the authority of (S, G) stream that is pruned, activate the pruning state on multicast path and restore data stream forwarding.Utilize the embodiment of the application, can reduce the occupation of invalid data stream to campus network bandwidth, improve overall utilization of network resources.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, specifically a data forwarding and processing method and system for campus networks. Background Technology

[0002] Existing campus network video surveillance systems typically use unicast or traditional multicast technologies for data forwarding, which suffers from problems such as rudimentary access control and low efficiency in multicast tree maintenance. In multi-camera collaborative scenarios triggered by access control events, traditional methods struggle to dynamically bind device permissions to data streams, leading to unauthorized access risks. Furthermore, multicast entries rely on periodic refresh mechanisms, and frequent path reconstruction increases network load. In addition, existing technologies lack the ability to quickly activate pruned streams when receiver permissions change, impacting real-time performance. Summary of the Invention

[0003] The purpose of this invention is to provide a data forwarding and processing method and system for campus networks to overcome the shortcomings of existing technologies, reduce the occupation of campus network bandwidth by invalid data streams, and improve the overall utilization rate of network resources.

[0004] One embodiment of this application provides a data forwarding processing method for a campus network, the method comprising: Permission binding and video stream triggering: Based on the access control terminal trigger event, control multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and shares the same multicast group address. Permanent entry collaborative establishment: Based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. Permission-based multicast forwarding control: Based on the IGMP join message carrying permission identifiers sent by the receiver, the system compares the outgoing interface permissions of the (*,G) table entries with the multicast data permission identifiers to determine whether to forward the data stream along the shared tree (RPT). Smart activation of pruned streams: Based on the matching result between the permission identifier of the new receiver and the permissions of the pruned (S,G) streams, a Graft passable command carrying the permission identifier is sent through the RP to activate the pruning state on the multicast path and restore data stream forwarding.

[0005] Optionally, the permission binding is triggered by the video stream, including: Permission ID assignment: Bind administrator permission ID, security permission ID, and auditor permission ID to the face recognition camera, wide-angle camera, and inner camera respectively; Multicast stream generation: When the door lock is triggered, the three cameras send video streams in multicast form and embed the corresponding permission identifier in the data packet; Source DR initial processing: When the source DR receives a video stream, if there is no corresponding multicast forwarding table entry, it will encapsulate the first (S1,G) data packet into a unicast Register message and send it to the RP.

[0006] Optionally, the collaborative creation of the permanent entries includes: RP tag injection: After receiving the Register message, the RP constructs a (S1,G)PIM join message carrying the RP tag and sends it along the source path; Dual-entry collaborative creation: Multicast routers parse the RP tag in the PIM join message and execute it in parallel: Extract permission identifiers from video stream data and create (S1,G) forwarding entries with permission tags; (*,G) entries that never expire, whose outgoing interfaces point to RP and are marked as non-timeout, can only be manually cleared by the administrator and restored from persistent storage when the device restarts.

[0007] Optionally, the permission-based multicast forwarding control includes: Permission verification and forwarding: After the RP receives the (*,G) PIM join message, it performs the following: extracts the receiver's permission identifier and associates it with the corresponding outgoing interface of the (*,G) table entry; when multicast data arrives, it compares the data permission identifier with the outgoing interface permission identifier. Forwarding decision: If the permission identifier matches, forward the data along the RPT tree to the receiver DR; otherwise, discard the data packet. SPT switching trigger: After receiving the data stream, the receiver DR sends a (S,G)PIM join message to the source DR to establish the source tree SPT path.

[0008] Optionally, the intelligent activation of the pruned flow includes: Pruning state setting: When the RP detects a (S2,G) data stream without permission matching, it sends a pruning message carrying the permission identifier and discards the corresponding multicast message. The path multicast router then sets the (S2,G) entry to a never-expiring pruning state with an empty outgoing interface list. Pruned Stream Activation: When the new receiver permission identifier matches the permissions of the pruned (S2,G) stream, the RP constructs a Graft passable instruction carrying the permission identifier and sends it to the source DR. Path restoration: After receiving the Graft command, the multicast router verifies the permission matching, clears the pruning state of the (S2,G) table entries, and restores the outgoing interface to point to RP.

[0009] Optionally, the method further includes: Dual-path update trigger: Based on the receiver permission change event, the receiver DR executes in parallel: Send a PIM permission update message carrying the old and new permission identifiers to the source DR along the SPT tree; send a (*,G) PIM join message carrying the new permission identifier to the RP along the RPT tree. Source-side intelligent flow switching: After receiving the update message, the source DR executes: If other (Sx,G) entries with matching permissions exist, the physical path is reused to forward the (Sx,G) stream to the receiver; the outgoing interface list of the (Sx,G) entries and their corresponding Sx addresses are updated and new permission identifiers are added; RP Coordination Update: The RP refreshes the permission bitmap of the (*,G) table entries based on the new permissions, and updates the output interface in conjunction with the existing (S,G) table entries.

[0010] Another embodiment of this application provides a data forwarding and processing system for a campus network, the system comprising: The binding module is used for permission binding and video stream triggering: based on the access control terminal trigger event, it controls multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and they share the same multicast group address. The module is used for the collaborative creation of permanent entries: based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered, and based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. The forwarding module is used for permission-based multicast forwarding control: based on the IGMP join message carrying permission identifier sent by the receiver, it compares the outgoing interface permission of the (*,G) table entry with the multicast data permission identifier through RP, and decides whether to forward the data stream along the shared tree (RPT); The activation module is used for intelligent activation of pruned streams: based on the matching result of the new receiver's permission identifier and the permissions of the pruned (S,G) streams, it sends a Graft passable command carrying the permission identifier through the RP to activate the pruning state on the multicast path and restore data stream forwarding.

[0011] Another embodiment of this application provides a storage medium storing a computer program, wherein the computer program is configured to execute the method described in any of the preceding claims when running.

[0012] Another embodiment of this application provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the method described in any of the preceding claims.

[0013] Compared with existing technologies, the present invention provides a data forwarding processing method for campus networks. Based on access control terminal trigger events, it controls multiple independent cameras to generate multicast video streams carrying permission identifiers. Based on the first video stream data packet received by the source router (DR) on the multicast source side, it synchronously creates (S,G) entries with permission tags and (*,G) entries that never expire on the path multicast routers. Based on the IGMP join message carrying permission identifiers sent by the receiver, it compares the outgoing interface permissions of the (*,G) entries with the multicast data permission identifiers through the RP (Reference Provider Link) to decide whether to forward the data stream along the shared tree (RPT). Based on the matching result of the new receiver's permission identifier and the permissions of the pruned (S,G) streams, it activates the pruning state on the multicast path and restores data stream forwarding. This reduces the bandwidth consumption of invalid data streams on the campus network and improves the overall utilization rate of network resources. Attached Figure Description

[0014] Figure 1 A hardware structure block diagram of a computer terminal for a data forwarding and processing method for a campus network provided in an embodiment of the present invention; Figure 2 A flowchart illustrating a data forwarding processing method for a campus network provided in an embodiment of the present invention; Figure 3 A schematic diagram illustrating the concept of a data forwarding and processing method for a campus network provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a data forwarding and processing system for a campus network provided in an embodiment of the present invention. Detailed Implementation

[0015] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0016] In campus networks, the source-side designated router (source DR) faces a performance bottleneck: when there are no receivers or the source tree (SPT) has not yet been established, the source DR must continuously encapsulate multicast packets (such as high-definition video streams) into unicast Register packets and send them to the aggregation point (RP). This puts enormous pressure on the source DR's CPU, especially during peak campus hours (such as get out of class breaks and events), when multiple access control points simultaneously trigger multiple high-definition cameras (such as 4K@30fps) to concurrently generate video streams, causing a sharp increase in the source DR's CPU load, leading to performance degradation or even packet loss.

[0017] Meanwhile, campus access control scenarios have strict requirements on the access permissions for video streams (for example, data from facial recognition cameras can only be viewed by lab administrators, and data from wide-angle cameras can only be viewed by security guards). Traditional multicast protocols lack role-based access control capabilities at the transport layer and can only perform permission verification at the application layer, which adds extra latency and affects real-time performance.

[0018] The technical problem to be solved by this invention: Eliminating invalid Register encapsulation operations of the source DR when there is no receiver significantly reduces its CPU load; Implement fine-grained access control at the network multicast forwarding layer (rather than the application layer) to ensure that only receivers with the corresponding permissions can receive the corresponding data stream, thus avoiding invalid forwarding of unauthorized data. Reduce the consumption of invalid data streams on campus network bandwidth and improve the overall utilization rate of network resources.

[0019] This invention first provides a data forwarding and processing method for a campus network, which can be applied to electronic devices, such as computer terminals, specifically ordinary computers.

[0020] The following detailed explanation uses a computer terminal as an example. Figure 1 This is a hardware structure block diagram of a computer terminal for a data forwarding and processing method in a campus network, provided as an embodiment of the present invention. Figure 1 As shown, the computer device includes a processor, memory, and network interface connected via a system bus, wherein the memory may include non-volatile storage media and internal memory.

[0021] Non-volatile storage media can store operating systems and computer programs. These computer programs include program instructions that, when executed, cause the processor to perform any data forwarding processing method used in the campus network.

[0022] The processor provides computing and control capabilities, supporting the operation of the entire computer device.

[0023] Internal memory provides an environment for the execution of computer programs stored on non-volatile storage media. When these computer programs are executed by the processor, the processor can perform any data forwarding processing method for the campus network.

[0024] This network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0025] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0026] See Figure 2 and Figure 3 The present invention provides a data forwarding processing method for a campus network, which may include the following steps: S201, Permission Binding and Video Stream Triggering: Based on the access control terminal trigger event, control multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, sharing the same multicast group address. Specifically, the permission binding and video stream triggering includes: Permission ID assignment: Bind administrator permission ID, security permission ID, and auditor permission ID to the face recognition camera, wide-angle camera, and inner camera respectively; Multicast stream generation: When the door lock is triggered, the three cameras send video streams in multicast form and embed the corresponding permission identifier in the data packet; Source DR initial processing: When the source DR receives a video stream, if there is no corresponding multicast forwarding table entry, it will encapsulate the first (S1,G) data packet into a unicast Register message and send it to the RP.

[0027] S202, Permanent Entry Collaborative Establishment: Based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. Specifically, the permanent entry collaborative establishment includes: RP tag injection: After receiving the Register message, the RP constructs a (S1,G)PIM join message carrying the RP tag and sends it along the source path; Dual-entry collaborative creation: Multicast routers parse the RP tag in the PIM join message and execute it in parallel: Extract permission identifiers from video stream data and create (S1,G) forwarding entries with permission tags; (*,G) entries that never expire, whose outgoing interfaces point to RP and are marked as non-timeout, can only be manually cleared by the administrator and restored from persistent storage when the device restarts.

[0028] S203, Permission-based multicast forwarding control: Based on the IGMP join message carrying permission identifiers sent by the receiver, the system compares the outgoing interface permissions of the (*,G) table entries with the multicast data permission identifiers using the RP (Reference Pointer) method to determine whether to forward the data stream along the shared tree (RPT); specifically, the permission-based multicast forwarding control includes: Permission verification and forwarding: After the RP receives the (*,G) PIM join message, it performs the following: extracts the receiver's permission identifier and associates it with the corresponding outgoing interface of the (*,G) table entry; when multicast data arrives, it compares the data permission identifier with the outgoing interface permission identifier. Forwarding decision: If the permission identifier matches, forward the data along the RPT tree to the receiver DR; otherwise, discard the data packet. SPT switching trigger: After receiving the data stream, the receiver DR sends a (S,G)PIM join message to the source DR to establish the source tree SPT path.

[0029] S204, Smart Activation of Pruned Stream: Based on the matching result between the new receiver's permission identifier and the permissions of the pruned (S,G) streams, a Graft passability command carrying the permission identifier is sent via RP to activate the pruning state on the multicast path and restore data stream forwarding. Specifically, the smart activation of pruned stream includes: Pruning state setting: When the RP detects a (S2,G) data stream without permission matching, it sends a pruning message carrying the permission identifier and discards the corresponding multicast message. The path multicast router then sets the (S2,G) entry to a never-expiring pruning state with an empty outgoing interface list. Pruned Stream Activation: When the new receiver permission identifier matches the permissions of the pruned (S2,G) stream, the RP constructs a Graft passable instruction carrying the permission identifier and sends it to the source DR. Path restoration: After receiving the Graft command, the multicast router verifies the permission matching, clears the pruning state of the (S2,G) table entries, and restores the outgoing interface to point to RP.

[0030] Furthermore, the method also includes: Dual-path update trigger: Based on the receiver permission change event, the receiver DR executes in parallel: Send a PIM permission update message carrying the old and new permission identifiers to the source DR along the SPT tree; send a (*,G) PIM join message carrying the new permission identifier to the RP along the RPT tree. Source-side intelligent flow switching: After receiving the update message, the source DR executes: If other (Sx,G) entries with matching permissions exist, the physical path is reused to forward the (Sx,G) stream to the receiver; the outgoing interface list of the (Sx,G) entries and their corresponding Sx addresses are updated and new permission identifiers are added; The source DR sends a PIM update message from the interface of the (Sx,G) entry to the downstream multicast router. This message contains the original (S2,G) multicast entry and its corresponding permissions, as well as the new (S1,G) multicast entry and its corresponding permissions. Upon receiving the update message, the downstream multicast router refreshes its multicast entry and continues sending update messages to downstream multicast routers until it reaches the receiver-side DR.

[0031] RP Coordination Update: The RP refreshes the permission bitmap of the (*,G) table entries based on the new permissions, and updates the output interface in conjunction with the existing (S,G) table entries.

[0032] In practical applications, the overall concept of this invention includes: 1. Each door lock has three cameras, each using a separate source IP address, sharing a single multicast group. Video data sent from different source IP addresses carries different access permissions. For example (e.g., a lab administrator's access corresponds to a facial recognition camera, while a security guard's access corresponds to a wide-angle camera, etc.). 2. When the door lock is triggered to unlock, three video streams will be generated, each carrying its own permission information. These streams will be sent to the multicast source DR via multicast. When the multicast source DR receives the first (S1,G) data transmission, the DR's CPU will receive it. If there is no multicast forwarding table entry, the source will register the data, encapsulate it as a unicast, and send it to the RP. 3. The RP sends a PIM join message (S1,G) carrying the RP tag. This PIM join message will be sent in the direction of the multicast source (the door lock IP address, i.e., S1). 4. After receiving the PIM join message, the multicast router finds the RP mark and generates a (S1,G) entry as well as a permanent (*,G) entry. Both entries generate an outgoing interface pointing to the RP. After receiving the message, the multicast source DR finds the RP mark and generates a (S1,G) entry as well as a permanent (*,G) entry, with the outgoing interface pointing to the RP.

[0033] 5. PC-A sends the patented enhanced IGMP join message, carrying permissions, to the DR on the PC-A (the requester) side. Upon receiving the message, the DR on PC-A sends a (*,G)PIM join message, carrying permissions, to the RP. The RP multicast router establishes a (*,G) forwarding table entry, associating the corresponding permission information with different outgoing interfaces; that is, registering the corresponding permission information on that outgoing interface. 6. The RP compares the permission information of different outgoing interfaces (*, G) with the permission information carried in the corresponding multicast data. If the permission information matches, the multicast data with the corresponding permission is sent out from the corresponding outgoing interface. If the permissions do not match, no forwarding is performed. The multicast router sends the multicast video data to the DR on the PC-A (player-on-demand) side along the RPT tree. After receiving the data, the DR on the PC-A (player-on-demand) side initiates an SPT switch and sends a PIM (S, G) join message to the DR on the multicast source side, thus sending the (S1, G) data packet.

[0034] 7. When the door lock sends a (S2, G) data packet, the DR receives it, matches the (*, G) entry, forwards it, and it reaches the RP after passing through the multicast router; - this process avoids the source registration process of the traditional multicast protocol and avoids the impact of multicast streams on the DR's CPU.

[0035] 8. Upon receiving the message, if the RP finds that (*,G) has no outgoing interface or the permissions corresponding to the outgoing interface are inconsistent, indicating that there is no receiver, it sends a PIM pruning message for (S2,G). This message continues until it reaches the DR on the multicast source side. Routers have a pruning entry for (S2,G) in their tables, and the outgoing interface is empty. In this scheme, the pruning entry for (S2,G) does not age out. Through the above method, the RP records the information for (S2,G) and the permission information for the multicast stream (S2,G).

[0036] 9. The PC-B sends an IGMP (*, G) join message carrying permission information, and the multicast router sends a PIM (*, G) join message carrying permission information, which is then sent upstream to the RP. The RP determines the permissions of the (S, G) multicast flow based on the permissions carried in the PIM and the permission information in the (S, G) table entry. For example, if it is a (S2, G) flow, the RP sends a (S2, G) PIM grant command to the DR on the S2 side. Upon receiving this, the upstream multicast router restores the pruned outgoing interface of its (S2, G) table entry to normal. The RP receives the (S2, G) data from the multicast source side and forwards it to the DR on the PC-B side according to the RPT tree.

[0037] 10. Therefore, the (S2,G) data will be forwarded to the DR of PC-B, and the DR will perform SPT switching.

[0038] 11. Ultimately, the DR on the multicast source side no longer needs to continuously encapsulate multicast data into unicast and send it to the RP, reducing the CPU pressure on the DR.

[0039] The detailed plan includes: The core of this invention lies in deeply binding permission identifiers with a permanent multicast entry mechanism and designing a permission-based intelligent pruning-activation control chain. The system is deployed in a campus network environment and includes an access control terminal equipped with three independent cameras (face recognition, wide-angle, and inner view), a source DR, a campus multicast router supporting the enhanced PIM-SM protocol, an RP, a receiver DR, and terminal devices with different permissions (such as PC-A for administrators and PC-B for security guards).

[0040] 1. Permission binding and initial triggering: Each access control terminal has three cameras assigned independent source IP addresses (e.g., face recognition: S1=192.168.1.10, wide-angle: S2=192.168.1.11, inner: S3=192.168.1.12), but they share the same multicast group address (G=239.1.1.1).

[0041] Each camera type is associated with a unique permission identifier (e.g., face recognition = 0x01 - administrator, wide-angle = 0x02 - security guard, inner = 0x03 - auditor). The camera embeds its permission identifier in the data packet when sending the video stream.

[0042] When someone triggers the door lock to open the door, the three cameras each begin to generate a video stream carrying their respective permission identifiers, and send it to the directly connected source DR in multicast form.

[0043] 2. Initial Flow Trigger and Permanent Entry Creation: When the source DR receives the first video stream (e.g., a face recognition stream (S1, G) from S1), if there is no corresponding multicast forwarding table entry locally, the source DR's CPU will encapsulate the (S1, G) multicast data into a unicast Register message and send it to the RP for initial registration.

[0044] Upon receiving the Register message, the RP immediately constructs and sends a special (S1, G)PIM join message. The key feature of this message is that it carries a special RP tag.

[0045] When the multicast routers along the route (including the source DR) receive this PIM join message carrying the RP tag, they perform two operations in parallel: Generate a regular (S1, G) source multicast forwarding table entry, extract permissions from the video stream data, and register the permission flags on the (S1, G) forwarding table entry.

[0046] Create a persistent (*, G) multicast forwarding entry with its outgoing interface pointing to the RP. This (*, G) entry is marked as "permanent," is unaffected by the regular timeout mechanism, can only be manually cleared by an administrator, and will attempt to be persistently restored upon device reboot. The same persistent (*, G) entry is also created locally on the source DR.

[0047] 3. Recipient addition and permission verification forwarding: When a recipient with the necessary permissions (such as administrator PC-A, permission 0x01) needs to view the video, PC-A proactively sends an IGMP join message (*, G) and carries its permission identifier 0x01 in the extended field.

[0048] After receiving this IGMP message, the receiver DR1 on the PC-A direct connection constructs and sends a (*, G)PIM join message, encapsulating the permission identifier 0x01 in the extended field, and sends it to the RP along the RPT tree path.

[0049] After receiving this PIM join message, the RP performs an authorization check: Extract the recipient permissions (0x01) carried in the message.

[0050] Add the interface that received the PIM join message to the (*, G) table entry and add the permission flag (0x01).

[0051] Precise comparison: Check if the permissions of the (*,G) outgoing interface exactly match those of the multicast data source to be forwarded (e.g., the permissions 0x01 carried by the (S1, G) stream).

[0052] If the permissions match (e.g., 0x01 == 0x01), RP allows the (S1, G) video stream to be forwarded down the RPT tree to receiver DR1, and eventually to PC-A.

[0053] DR1 on the PC-A side then initiates an SPT handover, directly sending a (S1, G)PIM join message to the source DR to establish the optimal source tree path.

[0054] 4. Smart pruning for receiverless streams: When the access control terminal sends an unsubscribed stream (such as a wide-angle camera stream (S2, G)), the source DR no longer performs Register encapsulation, but instead directly uses the established permanent (*, G) table entry to forward the (S2, G) multicast data to the RP along the multicast path.

[0055] Upon receiving the (S2, G) data packet, RP immediately checks: Extract the source permission identifier (0x02) from the data packet.

[0056] Check the permissions associated with all outgoing interfaces under the (*, G) table entries.

[0057] It was found that no outgoing interface was associated with the matching permission 0x02 (i.e., no valid receiver).

[0058] The RP constructs and sends a (S2, G) pruning message and discards the multicast message containing the permission flag 0x02, which propagates upstream (towards the source) along the multicast tree.

[0059] Upon receiving this pruning message, all multicast routers along the route (including the source DR) immediately set their (S2, G) entries to pruned state: the outgoing interface list is set to empty. This pruning state is marked as never expiring (it requires an explicit activation command to deactivate). The RP records information about (S2, G) and its permission 0x02.

[0060] 5. New receiver activates pruned flow: When a new authorized receiver (such as security PC-B, with permission 0x02) appears, PC-B sends an IGMP join message (*, G) carrying permission 0x02.

[0061] After receiving the message, the receiver DR2 sends a (*, G)PIM join message carrying permission 0x02 to RP.

[0062] Upon receiving this join message, the RP immediately retrieves the pruned (S, G) entries in its stored table: it finds a pruned (S2, G) stream with permissions (0x02) that match the receiver's permissions (0x02).

[0063] The RP immediately constructs and sends a (S2, G) clear instruction (Graft message) with permission 0x02, which is sent directly to the source DR in the form of a PIM protocol message.

[0064] After the multicast routers along the route receive the Graft message: Verify that the message permissions match the pruning permissions stored locally (S2, G).

[0065] If a match is found, the pruning state of the (S2, G) entry is cleared, and its normal outgoing interface pointing (towards RP) is restored.

[0066] The source DR resumes forwarding the (S2, G) flow to the RP.

[0067] RP immediately forwards the (S2, G) video stream to DR2 and PC-B along the RPT tree path established for PC-B.

[0068] PC-B side DR2 then initiated SPT handover.

[0069] 6. Handling exceptions related to dynamic permission changes: When a terminal device (such as PC-B upgraded from Security 0x02 to Administrator 0x01) detects a permission change, PC-B generates an enhanced IGMPv2 permission update message (type Auth_Update), encapsulates the old permission (0x02), the new permission (0x01) and the target source IP (S1), and sends it to the directly connected receiver DR2.

[0070] After the receiver DR2 parses the packet, it triggers a dual-path update in parallel: To the source DR: Construct a special PIM permission update message (type 0x0D) containing (S2, G), old permissions (0x02), and new permissions (0x01), and send it directly to the source DR along the existing SPT tree path.

[0071] To the RP: Construct a standard PIM join message (*, G) carrying the new permission 0x01 and setting Refresh_Flag=1, and send it to the RP along the RPT tree path.

[0072] Source-side DR intelligent response (key optimization): Upon receiving the (S2, G) update message, check the current permissions of the local (S2, G) table entry (e.g., 0x02).

[0073] If the new permission (0x01) is different from the current permission (e.g., 0x01 ≠ 0x02?): Perform logical pruning immediately on the existing (S2, G) SPT tree: stop forwarding old permission (0x02) data streams, but preserve the physical path.

[0074] Initiate cross-source permission retrieval: Query whether there are other (Sx, G) entries whose permissions match the new permission 0x01 (e.g., (S1, G) permission is 0x01).

[0075] If a matching entry is found (e.g., the (S1, G) permission 0x01 exists): Reuse the existing physical path: Inject control commands into the (S2, G) SPT tree, update the (S2.G) forwarding table entry to the (S1,G) forwarding table entry, add a new permission identifier (0x01) metadata tag to the corresponding outgoing interface, and start forwarding the (S1, G) stream (carrying permission 0x01) to the receiver DR2. At the same time, if the original (S2, G) SPT tree has no outgoing interface, perform a pruning operation. The source DR sends a PIM update message from the interface of the (Sx,G) entry to the downstream multicast router. This message includes the original (S2,G) multicast entry and its corresponding permissions, as well as the new (S1,G) multicast entry and its corresponding permissions. Upon receiving the update message, the downstream multicast router refreshes its multicast entry and continues sending update messages to downstream multicast routers until the corresponding multicast entry on the receiver-side DR is updated.

[0076] Refresh entry: Add receiver DR2 to the outgoing interface list of the (S1, G) entry.

[0077] If no matching entry is found, the regular (S2, G) permission update process is triggered to perform a pruning operation.

[0078] RP Coordination Update: Upon receiving the (*, G) refresh join message (new permission 0x01), the RP updates the associated permission of the receiver's DR2 interface in the (*, G) table entry to 0x01.

[0079] RP retrieves all (S, G) entries: If a table entry (S, G) is found to have permissions that match the new permission 0x01 (e.g., (S1, G)@0x01): Add receiver DR2 directly to the outgoing interface list of this (S, G) entry (if it has not been added yet).

[0080] Reset the aging time of this entry.

[0081] If permissions do not match (e.g., (S2, G)@0x02), maintain its pruned state.

[0082] Beneficial effects include: Reduced source DR load: By using permanent (*, G) entries and intelligent pruning mechanisms, the continuous unicast register encapsulation operation when there is no receiver is completely eliminated, resulting in a significant reduction in source DR CPU utilization, especially during peak periods of multiple concurrent high-definition video streams.

[0083] Network layer access control implementation: Access verification and filtering are performed at the multicast router level, which prevents unauthorized recipients from accessing the data stream. At the same time, it eliminates the additional latency caused by application layer access verification and improves the real-time performance of video viewing.

[0084] Efficient use of network bandwidth: Invalid multicast data streams (without permissions or receivers) are pruned in time, no longer occupying network bandwidth, thus improving the overall utilization rate of valuable campus network resources.

[0085] Efficient handling of dynamic permission changes: The innovative dual-path update and source-side intelligent flow switching mechanism can quickly and smoothly switch data flow paths when user permissions change, ensuring business continuity.

[0086] The innovations include: Multicast source-permission identifier binding mechanism: A permission identifier is bound to the multicast data source (camera) and carried during the network layer forwarding process, enabling network devices (RP, router) to have native permission awareness capabilities, laying the foundation for network layer permission control.

[0087] Persistent (*, G) multicast entry system: Defines and implements a perpetual (*, G) multicast forwarding entry type. This entry is not affected by a timeout mechanism after its initial creation, but requires manual clearing by the administrator. It includes a permission bitmap field to associate permission information with downstream interfaces, which is crucial for avoiding repeated initial encapsulation.

[0088] Permission-based intelligent pruning-activation control chain: Permission-aware pruning: The RP actively sends pruning messages carrying permission identifiers and discards the corresponding multicast packets based on the permission matching of downstream interfaces in the (*, G) table entries. The path router sets a pruning state that never expires accordingly.

[0089] Graft on Demand: When a new receiver joins and its permissions match, the RP sends a Graft clear command carrying the permission identifier to precisely activate the specific permission stream that was previously pruned, restoring its forwarding path.

[0090] The efficient processing flow for dynamic permission changes is as follows: The receiver-side DR triggers bidirectional updates of the source tree path (SPT) and the shared tree path (RPT) in parallel; the source-side DR performs intelligent cross-source flow retrieval and reuse of existing physical paths; the RP coordinates the update of the permission bitmap and links it with existing (S, G) entries to achieve fast and seamless switching of data streams when permissions change.

[0091] As can be seen, based on the access control terminal trigger event, multiple independent cameras are controlled to generate multicast video streams carrying permission identifiers; based on the first video stream data packet received by the source DR of the designated router on the multicast source side, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers; based on the IGMP join message carrying permission identifiers sent by the receiver, the matching result of the outgoing interface permission of (*,G) entries with the multicast data permission identifier is compared by the RP to decide whether to forward the data stream along the shared tree (RPT); based on the matching result of the permission identifier of the new receiver with the permission of the pruned (S,G) stream, the pruning state on the multicast path is activated and the data stream forwarding is restored, thereby reducing the occupation of campus network bandwidth by invalid data streams and improving the overall utilization of network resources.

[0092] Another embodiment of the present invention provides a data forwarding and processing system for a campus network, see [link to relevant documentation]. Figure 4 The system may include: Binding module 401 is used for permission binding and video stream triggering: based on the access control terminal trigger event, it controls multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and shares the same multicast group address. Establishment module 402 is used for the collaborative establishment of permanent entries: based on the first video stream data packet received by the source router DR on the multicast source side, a unicast registration process to the aggregation point RP is triggered, and based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. Forwarding module 403 is used for permission-based multicast forwarding control: based on the IGMP join message carrying permission identifier sent by the receiver, it compares the outgoing interface permission of the (*,G) table entry with the multicast data permission identifier through RP, and decides whether to forward the data stream along the shared tree (RPT); Activation module 404 is used for intelligent activation of pruned streams: based on the matching result of the new receiver's permission identifier and the permissions of the pruned (S,G) streams, it sends a Graft passable command carrying the permission identifier through RP to activate the pruning state on the multicast path and restore data stream forwarding.

[0093] This invention also provides a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0094] Specifically, in this embodiment, the storage medium can be configured to store a computer program for performing the following steps: S201, Permission Binding and Video Stream Triggering: Based on the access control terminal triggering event, control multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and shares the same multicast group address. S202, Permanent entry collaborative establishment: Based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. S203, Permission-based multicast forwarding control: Based on the IGMP join message carrying permission identifier sent by the receiver, the system compares the outgoing interface permission of the (*,G) table entry with the multicast data permission identifier through RP, and decides whether to forward the data stream along the shared tree (RPT). S204, Smart Activation of Pruned Stream: Based on the matching result between the new receiver's permission identifier and the permissions of the pruned (S,G) streams, a Graft passable command carrying the permission identifier is sent via RP to activate the pruning state on the multicast path and restore data stream forwarding.

[0095] This invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0096] Specifically, the aforementioned electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the aforementioned processor, and the input / output device is connected to the aforementioned processor.

[0097] Specifically, in this embodiment, the processor can be configured to perform the following steps via a computer program: S201, Permission Binding and Video Stream Triggering: Based on the access control terminal triggering event, control multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and shares the same multicast group address. S202, Permanent entry collaborative establishment: Based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. S203, Permission-based multicast forwarding control: Based on the IGMP join message carrying permission identifier sent by the receiver, the system compares the outgoing interface permission of the (*,G) table entry with the multicast data permission identifier through RP, and decides whether to forward the data stream along the shared tree (RPT). S204, Smart Activation of Pruned Stream: Based on the matching result between the new receiver's permission identifier and the permissions of the pruned (S,G) streams, a Graft passable command carrying the permission identifier is sent via RP to activate the pruning state on the multicast path and restore data stream forwarding.

[0098] The above description, based on the embodiments shown in the figures, details the structure, features, and effects of the present invention. The above description is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the figures. Any changes made in accordance with the concept of the present invention, or equivalent embodiments modified to have equivalent changes, that do not exceed the spirit covered by the specification and figures, should be within the protection scope of the present invention.

Claims

1. A data forwarding and processing method for a campus network, characterized in that, The method includes: Permission binding and video stream triggering: Based on the access control terminal triggering event, control multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and shares the same multicast group address. Permanent entry collaborative establishment: Based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. Among them, the (*,G) entries that never expire have their outgoing interfaces pointing to the RP and are marked as non-timeout. The (*,G) entries can only be manually cleared by the administrator and are restored from persistent storage when the device restarts. Permission-based multicast forwarding control: Based on the IGMP join message carrying permission identifiers sent by the receiver, the system compares the outgoing interface permissions of the (*,G) table entries with the multicast data permission identifiers to determine whether to forward the data stream along the shared tree (RPT). Smart activation of pruned streams: Based on the matching result between the permission identifier of the new receiver and the permissions of the pruned (S,G) streams, a Graft passable command carrying the permission identifier is sent through the RP to activate the pruning state on the multicast path and restore data stream forwarding.

2. The method according to claim 1, characterized in that, The permission binding and video stream triggering include: Permission ID assignment: Bind administrator permission ID, security permission ID, and auditor permission ID to the face recognition camera, wide-angle camera, and inner camera respectively; Multicast stream generation: When the door lock is triggered, the three cameras send video streams in multicast form and embed the corresponding permission identifier in the data packet; Source DR initial processing: When the source DR receives a video stream, if there is no corresponding multicast forwarding table entry, it will encapsulate the first (S1,G) data packet into a unicast Register message and send it to the RP.

3. The method according to claim 2, characterized in that, The collaborative creation of the permanent entries includes: RP tag injection: After receiving the Register message, the RP constructs a (S1,G)PIM join message carrying the RP tag and sends it along the source path; Dual-entry collaborative creation: Multicast routers parse the RP tag in the PIM join message and execute it in parallel: Extract permission identifiers from video stream data and create (S1,G) forwarding entries with permission tags; (*,G) entries that never expire, whose outgoing interfaces point to RP and are marked as non-timeout, can only be manually cleared by the administrator and restored from persistent storage when the device restarts.

4. The method according to claim 3, characterized in that, The permission-based multicast forwarding control includes: Permission verification and forwarding: After the RP receives the (*,G) PIM join message, it performs the following: extracts the receiver's permission identifier and associates it with the corresponding outgoing interface of the (*,G) table entry; when multicast data arrives, it compares the data permission identifier with the outgoing interface permission identifier. Forwarding decision: If the permission identifier matches, forward the data along the RPT tree to the receiver DR; otherwise, discard the data packet. SPT switching trigger: After receiving the data stream, the receiver DR sends a (S,G)PIM join message to the source DR to establish the source tree SPT path.

5. The method according to claim 4, characterized in that, The intelligent activation of the pruned flow includes: Pruning state setting: When the RP detects a (S2,G) data stream without permission matching, it sends a pruning message carrying the permission identifier and discards the corresponding multicast message. The path multicast router then sets the (S2,G) entry to a never-expiring pruning state with an empty outgoing interface list. Pruned Stream Activation: When the new receiver permission identifier matches the permissions of the pruned (S2,G) stream, the RP constructs a Graft passable instruction carrying the permission identifier and sends it to the source DR. Path restoration: After receiving the Graft command, the multicast router verifies the permission matching, clears the pruning state of the (S2,G) table entries, and restores the outgoing interface to point to RP.

6. The method according to claim 5, characterized in that, The method further includes: Dual-path update trigger: Based on the receiver permission change event, the receiver DR executes in parallel: Send a PIM permission update message carrying the old and new permission identifiers to the source DR along the SPT tree; send a (*,G) PIM join message carrying the new permission identifier to the RP along the RPT tree. Source-side intelligent flow switching: After receiving the update message, the source DR executes: If other (Sx,G) entries with matching permissions exist, the physical path is reused to forward the (Sx,G) stream to the receiver; the outgoing interface list of the (Sx,G) entries and their corresponding Sx addresses are updated and new permission identifiers are added; RP Coordination Update: The RP refreshes the permission bitmap of the (*,G) table entries based on the new permissions, and updates the output interface in conjunction with the existing (S,G) table entries.

7. A data forwarding and processing system for a campus network, characterized in that, The system includes: The binding module is used for permission binding and video stream triggering: based on the access control terminal trigger event, it controls multiple independent cameras to generate multicast video streams carrying permission identifiers. Each camera is assigned an independent source IP address and bound with a unique permission identifier, and they share the same multicast group address. A module is established for the collaborative establishment of permanent entries: based on the first video stream data packet received by the source router (DR) on the multicast source side, a unicast registration process to the aggregation point (RP) is triggered. Based on the PIM join message carrying the RP tag returned by the RP, (S,G) entries with permission tags and (*,G) entries that never expire are synchronously created on the path multicast routers. Among them, the (*,G) entries that never expire have their outgoing interfaces pointing to the RP and are marked as non-timeout. The (*,G) entries can only be manually cleared by the administrator and are restored from persistent storage when the device restarts. The forwarding module is used for permission-based multicast forwarding control: based on the IGMP join message carrying permission identifier sent by the receiver, it compares the outgoing interface permission of the (*,G) table entry with the multicast data permission identifier through RP, and decides whether to forward the data stream along the shared tree (RPT); The activation module is used for intelligent activation of pruned streams: based on the matching result of the new receiver's permission identifier and the permissions of the pruned (S,G) streams, it sends a Graft passable command carrying the permission identifier through the RP to activate the pruning state on the multicast path and restore data stream forwarding.

8. The system according to claim 7, characterized in that, The binding module is specifically used for: Permission ID assignment: Bind administrator permission ID, security permission ID, and auditor permission ID to the face recognition camera, wide-angle camera, and inner camera respectively; Multicast stream generation: When the door lock is triggered, the three cameras send video streams in multicast form and embed the corresponding permission identifier in the data packet; Source DR initial processing: When the source DR receives a video stream, if there is no corresponding multicast forwarding table entry, it will encapsulate the first (S1,G) data packet into a unicast Register message and send it to the RP.

9. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method of any one of claims 1-6 when it is run.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method of any one of claims 1-6.

Images