The communications industry is rapidly changing to adjust to emerging technologies and ever increasing customer demand. This customer demand for new applications and increased performance of existing applications is driving communications network and system providers to employ networks and systems having greater speed and capacity (e.g., greater bandwidth). In trying to achieve these goals, a common approach taken by many communications providers is to use packet switching technology. Increasingly, public and private communications networks are being built and expanded using various packet technologies, such as Internet Protocol (IP). Note, nothing described or referenced in this document is admitted as prior art to this application unless explicitly so stated.
Multicast Routing protocols like Protocol Independent Multicast-Sparse Mode (PIM-SM) and Bi-directional PIM achieve multicast forwarding by building a shared distribution tree rooted at Rendezvous Point (RP). In each of the routers (or switches), a single (*, G) entry is used to forward traffic down the shared tree. In Bi-directional, the same entry is used for forwarding traffic upstream towards the Rendezvous point, as well. In such shared tree based forwarding models, source-control is one of the biggest problems. Because traffic forwarding is achieved using a (*, G) entry, any unwanted malicious host can send multicast traffic at very high rates. This at least results in a waste of valuable network bandwidth, and lends itself to denial of service (DOS) attacks (e.g., attacks on a network by flooding it with useless traffic designed to consume the network resources).
In PIM-SM, data traffic from a source is encapsulated within a register message by the first hop router and sent via unicast packets to the Rendezvous Point (RP). Depending on the IP address of the source, the RP can decide to either forward the traffic down the shared tree or ignore the traffic. In either case, the RP sends back a register-stop message instructing the first hop router to stop sending register messages. Thus, traffic from an invalid source is encapsulated and forwarded by a first hop router (consuming its resources), and it is not dropped until it reaches the RP (consuming network and RP resources, and providing an opportunity DOS attacks). In Bi-directional PIM, these problems are even more aggravated by the fact that a common (*, G) forwarding entry is used to forward traffic in both directions (i.e., upstream towards the RP, and downstream away from the RP and towards the receivers). Although there is no protection is available to protect against malicious or unwanted sources, there is protection from unwanted receivers joining a multicast group through admission-control mechanisms that are available.
One approach to limit the problem is to use security Access Control Lists (ACLs) manually maintained by an administrator to limit the hosts which can send multicast traffic, such as by denying all but an explicit list of hosts. Clearly such a solution is not scalable.