Controlled Multicast System Using AAA Authentication

The patent introduces a multicast router as an intermediary between hosts and multicast groups. The router acts as a mediator that receives join requests from hosts, authenticates them against authorized receiver lists, and selectively forwards multicast data only to authenticated hosts. This resolves the contradiction by maintaining easy host operation while implementing security control through the intermediary router.

The patent implements preliminary authentication and authorization before hosts can receive multicast data. The system pre-establishes authorized receiver lists at the router, and hosts must present valid credentials before being added to the distribution tree. This preliminary action ensures security is enforced before data transmission begins, resolving the contradiction between ease of operation and security control.

The patent merges multiple authentication functions into the multicast router itself. Rather than requiring separate authentication servers and complex protocol implementations at each host, the router consolidates authentication, authorization, and account management capabilities. This merging reduces overall system complexity while maintaining security, as the router becomes a single point of control for all multicast access decisions.

The multicast router is designed with multi-functionality, serving both as a traditional multicast forwarding device and as an authentication/authorization server. By making the router universal - capable of handling both data forwarding and security management - the system avoids adding separate specialized devices, thereby improving security without proportionally increasing device complexity.

The patent implements local quality control by maintaining separate authorized receiver lists at the multicast router for different network segments or VLANs. The router selectively forwards multicast data only to hosts that are both authenticated and appropriate for receiving that specific data stream. This local quality filtering prevents unnecessary data transmission to unauthorized or inappropriate hosts, reducing energy waste while maintaining efficient delivery to authorized receivers.

The system dynamically manages multicast distribution trees based on authenticated receiver lists. As hosts authenticate and deauthenticate, the router dynamically adjusts the distribution tree to include or exclude specific hosts. This dynamic adaptation ensures multicast data is delivered efficiently only to currently authorized hosts, preventing energy waste on inactive or unauthorized receivers while maintaining high productivity for authorized groups.