Multicast source and receiver access control
A routing system for providing multicast access control includes a plurality of routers including a multicast source router and a plurality of multicast receiver routers, the plurality of routers providing a multicast service, wherein the routers are configured to enforce multicast access control policies for the multicast service including a receiver access policy that controls which multicast receivers are allowed to receive packets from the multicast service and a sender access policy that controls which multicast sources are allowed to send packets to the multicast service for distribution to the multicast receivers.
1. A routing system for distributing multicast routing information for a multicast service, the routing system comprising:
a plurality of routers including a multicast source router associated with a multicast source for the multicast service and a plurality of multicast receiver routers, each multicast receiver router associated with at least one multicast receiver that subscribes to the multicast service, wherein the routers are configured to exchange multicast information associated with the multicast service including identification of the multicast source and the multicast receivers, wherein:
the exchanged multicast information is used by the plurality of routers to establish a separate unicast communication session from the multicast source router to each of the multicast receiver routers for distribution of multicast packets from the multicast source to the at least one multicast receiver associated with the multicast receiver router;
the routers are configured to enforce multicast access control policies for the multicast service including a receiver access policy that defines a class of multicast receivers that are allowed to receive packets from the multicast service and a sender access policy that defines a class of multicast sources that are allowed to send packets to the multicast service for distribution to the multicast receivers;
the multicast source router is configured to accept and distribute multicast packets only from a multicast source associated with the class of multicast sources that are allowed to send packets to the multicast service; and
the multicast receiver routers are configured to accept multicast join request only from interfaces associated with the class of multicast receivers that are allowed to receive packets from the multicast service.
2. The system of claim 1 , wherein each router is configured to transmit, using a service and topology exchange protocol (STEP), the router's multicast information to a STEP repository and to receive from the STEP repository multicast information for the other routers.
3. The system of claim 2 , wherein the central repository is managed by a primary STEP server.
4. The system of claim 3 , wherein the primary STEP server is in one of the routers.
5. The system of claim 3 , wherein the primary STEP server is in a device separate from the routers.
6. The system of claim 2 , wherein the multicast information is transmitted to the STEP server in STEP documents.
7. The system of claim 6 , wherein the STEP documents are JSON documents.
8. The system of claim 6 , wherein the information in the STEP repository is organized as a path tree database and wherein each STEP document includes a path definition identifying the router for storage of the router's multicast information in the path tree database.
9. The system of claim 1 , wherein:
the class of multicast receivers that are allowed to receive packets from the multicast service and the class of multicast sources that are allowed to send packets to the multicast service are defined by tenants.
10. The system of claim 1 , wherein the routers are configured to determine, based on the exchanged multicast information, an optimal rendezvous point router for distributing the packets associated with the multicast service.
11. A router for distributing multicast routing information for a multicast service, the router comprising:
a datastore storing multicast information associated with the multicast service including identification of multicast sources and multicast receivers; and
a controller configured to exchange multicast information associated with the multicast service including identification of multicast sources and multicast receivers, wherein the exchanged multicast information is used by the router to establish a unicast communication session for distribution of multicast packets from a multicast source associated with the multicast service to at least one multicast receiver that subscribes to the multicast service, the controller further configured to enforce multicast access control policies for the multicast service including at least one of a receiver access policy that defines a class of multicast receivers that are allowed to receive packets from the multicast service or a sender access policy that defines a class of multicast sources that are allowed to send packets to the multicast service for distribution to the multicast receivers, wherein enforcing the receiver access policy comprises accepting multicast join request only from interfaces associated with the class of multicast receivers that are allowed to receive packets from the multicast service and wherein enforcing the sender access control policy comprises accepting and distributing multicast packets only from a multicast source associated with the class of multicast sources that are allowed to send packets to the multicast service.
12. The router of claim 11 , wherein the router is configured to transmit, using a service and topology exchange protocol (STEP), the router's multicast information to a STEP repository and to receive from the STEP repository multicast information for the other routers.
13. The router of claim 12 , wherein the central repository is managed by a primary STEP server.
14. The router of claim 13 , wherein the router includes the primary STEP server.
15. The router of claim 13 , wherein the primary STEP server is in a device separate from the router.
16. The router of claim 12 , wherein the multicast information is transmitted to the STEP server in STEP documents.
17. The router of claim 16 , wherein the STEP documents are JSON documents.
18. The router of claim 16 , wherein:
wherein the information in the STEP repository is organized as a path tree database and wherein each STEP document includes a path definition identifying the router for storage of the router's multicast information in the path tree database.
19. The router of claim 11 , wherein:
the class of multicast receivers that are allowed to receive packets from the multicast service and the class of multicast sources that are allowed to send packets to the multicast service are defined by tenants.
20. The router of claim 11 , wherein the router is configured to determine, based on the exchanged multicast information, an optimal rendezvous point router for distributing the packets associated with the multicast service.