Ethernet Switching Forwarding via Service Connection Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Ethernet technical framework faces challenges in telecommunication networks, particularly in access and aggregation networks, due to issues like MAC address spoofing, scalability problems, network security, and limitations in VLAN identifiers, which affect service isolation and transparency.
Innovation Solution
An Ethernet switching and forwarding method that allocates a uniform VLAN tag to incoming messages, determines forwarding modes based on the tag, and encapsulates messages with egress port attributes, supporting various forwarding modes such as standard, multiplex, layer-3 routing, and transparent point-to-point VLAN forwarding to enhance security, scalability, and service isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If MAC address auto-learning and flooding forwarding are used, then Ethernet switching can be implemented without specific management and configuration, but MAC address spoofing and network security issues occur
Solution Approach 1:
The patent introduces a service connection identifier as an intermediary between the MAC address layer and the forwarding decision layer. This identifier acts as a mediator that enables forwarding control without relying solely on MAC address learning, thereby preventing MAC address spoofing while maintaining ease of operation. The service connection identifier is allocated by the network side and bound to specific user service connections, creating a trusted forwarding mechanism.
Solution Approach 2:
The patent changes the forwarding parameter from MAC address to service connection identifier. By allocating service connection identifiers uniformly from the network side and using them as the basis for forwarding decisions, the system transforms the unreliable MAC address-based forwarding into a reliable network-controlled forwarding mechanism, resolving the security issue while maintaining operational simplicity.
2Object-affected harmful factors
If VLAN identifier is used for service isolation, then inter-domain traffic isolation can be implemented, but the VLAN identifier space is limited and scalability is affected
Solution Approach 1:
The patent transitions from using VLAN identifiers (2-byte, 4096 possibilities) to service connection identifiers (extended space, potentially 128-bit or more). This dimensional expansion in the identifier space allows for vastly increased scalability while maintaining the traffic isolation functionality. The service connection identifier can uniquely identify each user service connection, enabling fine-grained isolation beyond traditional VLAN capabilities.
Solution Approach 2:
The service connection identifier serves multiple functions: it acts as a VLAN identifier for traffic isolation, as a user identification for location and service capabilities, and as a forwarding parameter for packet routing. This multi-functionality replaces the limited VLAN identifier and enables both traffic isolation and enhanced scalability simultaneously.
3Device complexity
If flooding forwarding mode is used, then simple forwarding can be achieved, but network security and service transparency are compromised
Solution Approach 1:
The patent implements dynamic forwarding mode selection based on service connection identifiers. Different forwarding modes (standard Ethernet forwarding, multiplex Ethernet forwarding, layer-3 routing and forwarding, point-to-point VLAN forwarding, transparent point-to-point VLAN forwarding) are dynamically selected according to the service connection identifier and message type. This dynamic approach maintains simplicity where applicable while ensuring security and transparency where required.
Solution Approach 2:
The patent applies different forwarding qualities to different service connections and message types. For example, transparent point-to-point VLAN forwarding is applied to dedicated line services requiring strict transparency, while standard Ethernet forwarding is applied to regular traffic. This local differentiation ensures service transparency and security without unnecessarily complicating the overall forwarding mechanism.
4Reliability
If tree-like topology is maintained for flooding forwarding, then topology protection can be provided, but network control and management become complex
Solution Approach 1:
The service connection identifier acts as an intermediary that simplifies topology management. Instead of relying on complex STP/RSTP protocols to maintain tree-like topology for flooding, the network side allocates service connection identifiers that inherently encode the forwarding path information. This mediator approach maintains topology protection while reducing management complexity by shifting control to the network side.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
An Ethernet switching and forwarding method, and at least one Ethernet forwarding mode of standard Ethernet forwarding, multiplex Ethernet forwarding, layer-3 routing and forwarding, across-VLAN multicast forwarding plane, point-to-point VLAN forwarding or point-to-point double VLAN forwarding. The method includes: an Ethernet message entering a user side port or a network side port; processing, by the port, the message to provide the message with a VLAN tag allocated uniformly by the port; determining, by the port, a forwarding mode for the message and sending the message to a corresponding forwarding plane; determining, by the forwarding plane, an egress port of the message and processing the specific Ethernet control message in accordance with a control message capturing policy table; and forwarding the message to the egress port and encapsulating the message in accordance with an attribute table of the egress port.