Apparatus and method for packet forwarding in layer 2 network

A packet forwarding system comprising:

• a first layer 2 gateway and a second layer 2 gateway each located in a transit network and being connected to a plurality of user terminals via at least one layer 2 switch in an access network;
• a first layer 2 switch and second layer 2 switch in the transit network, each of the first and second layer 2 switches being connected to said first and second layer 2 gateways and to a communication node apparatus on the Internet side;
• an authentication server connected to said first layer 2 switch;
• and
• a DHCP server connected to said second layer 2 switch;
• each of said first and second layer 2 gateways including:
• a protocol processor for carrying out communication control procedures with each user terminal during a Point to Point Protocol over Ethernet (PPPoE) connection phase, a Link Control Protocol (LCP) connection phase, and an authentication phase;
• and
• a user management table indicating packet forwarding control information for each user terminal, the packet forwarding control information including a user terminal MAC address, a session identifier and an authentication result of the user terminal,
• said protocol processor being configured to add to said user management table a new table entry indicating the relation between the user terminal MAC address and the session ID during execution of the PPPoE phase communication procedure with each user terminal, register an affirmative user terminal authentication result into the new table entry and notify the user terminal of the authentication result when the user terminal has succeeded in authentication during the authentication phase, and disconnect an LCP session after notifying the user terminal of the authentication result and delete the new table entry from said user management table if the user terminal has failed in the authentication, and
• wherein when an Ethernet frame having neither a PPPoE header nor a Point to Point Protocol (PPP) header is received, said protocol processor performs forwarding control of the received frame between said layer 2 switches in the access network and one of said first and second layer 2 switches in the transit network according to said user management table so as to forward the received Ethernet frame when the user management table includes a specific table entry indicating the affirmative authentication result in association with the user terminal MAC address which is specified by a source MAC address or a unicast destination MAC address of the Ethernet frame and to discard the Ethernet frame when the specific table entry does not exist in the user management table.

A method for packet forwarding comprising the steps of:

• carrying out a communication control procedure in a Point to Point over Ethernet (PPPoE) connection phase between a user terminal and packet forwarding apparatus to which the user terminal is connected through an access network, using PPPoE frames each having a PPPoE header and notifying the user terminal of a session ID from the packet forwarding apparatus;
• carrying out communication control procedures in a Link Control Protocol (ILCP) connection phase and an authentication phase between said user terminal and said packet forwarding apparatus, using PPPoE frames each having the PPPoE header and a PPP header;
• and
• communicating packets in a Dynamic Host Configuration Protocol (DHCP) phase and an Internet Protocol (IP) forwarding phase among said user terminal, said packet forwarding apparatus, and one of communication node apparatuses on the Internet side, using Ethernet frames having neither the PPPoE header nor the PPP header;
• and
• adding a new table entry indicating the relation between a user terminal MAC address and a session ID to a user management table by said packet forwarding apparatus during execution of the PPPoE phase communication procedure;
• and
• registering an affirmative authentication result into said new table entry by said packet forwarding apparatus and notifying said user terminal of the authentication result from the packet forwarding apparatus when the user terminal has succeeded in authentication during the authentication phase;
• and
• disconnecting an LCP session after notifying the user terminal of the authentication result and deleting the new table entry from said user management table by said packet forwarding apparatus when the user terminal has failed in the authentication during the authentication phase,
• wherein said packet forwarding apparatus controls forwarding of said Ethernet frames received during the DHCP phase and the IP forwarding phase, according to said user management table, and
• wherein said packet forwarding apparatus discards a received Ethernet frame in the case where a unicast destination MAC address or a source MAC address of the received Ethernet frame is not registered as said user terminal MAC address in said user management table or the affirmative authentication result is not registered in association with the user terminal MAC address in said user management table, during the DHCP phase and the IP forwarding phase.

A user terminal connectable to a packet forwarding apparatus in a Layer 2 transit network through an access network to access the Internet via the packet forwarding apparatus, the user terminal comprising:

• a line interface connected to said access network;
• a protocol processor connected to said line interface;
• a main processor connected to said protocol processor;
• and
• a memory for storing a management table and programs to be executed by said main processor,
• said management table indicating routing information items and status information which indicates a current communication phase of the user terminal, said routing information items including a MAC address of said packet forwarding apparatus, a session ID, and an IP address assigned to the user terminal,
• wherein said main processor starts a communication procedure of a Point to Point over Ethernet (PPPoE) connection phase in response to a specific user operation, and subsequently performs communication procedures of a Link Control Protocol (LCP) connection phase, an authentication phase, a Dynamic Host Configuration Protocol (DHCP) phase and an Internet Protocol (IP) forwarding phase after completing the PPPoE connection phase, while updating said routing information items and said status information of the management table in accordance with progress of the communication procedures, and
• wherein said protocol processor transmits control packets of the PPPoE connection phase in the form of PPPoE frame having a PPPoE header, control packets of the LCP connection phase and the authentication phase in the form of PPPoE frame having the PPPoE header and a PPP header, and control packets of the DHCP phase and IP packets of the IP forwarding phase in the form of Ethernet frame having neither the PPPoE header nor the PPP header.