JP4069013B2 - COMMUNICATION DEVICE, COMMUNICATION SYSTEM, AND COMMUNICATION METHOD - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to identification of a communication device that performs a time division multiple access method, and detects “spoofing” that behaves as if a communication device is another communication device by using the address and serial number of the communication device. The present invention relates to a communication device, a communication system, and a communication method that improve the security of a communication system by preventing.
[0002]
[Prior art]
In order for a plurality of devices to communicate with each other using a single communication medium, it is necessary that a signal transmitted from one device can be distinguished from a signal transmitted from another device. This method is generally called a multiple access method, and one of them is a time division multiple access method.
[0003]
The time division multiple access method is a method that enables distinction by changing the transmission time of each device. In the time division multiple access system, the number of devices that transmit signals to a communication medium at a certain time is always 1 or less, and control is performed so that signal collision does not occur. Therefore, a device that receives a signal from the communication medium can read all data from other devices.
[0004]
The time division multiple access system is roughly divided into two types: one in which all devices control multiple access in the same procedure, and the other in which a certain device controls multiple access in a unified manner. Here, the former is defined as an “autonomous” time division multiple access method, and the latter is defined as a “centralized control” time division multiple access method. Examples of “autonomous” time division multiple access methods include Ethernet (registered trademark) and token ring. Examples of “centralized control” time division multiple access systems include SCM-PDS (Subcarrier Multiplex-Passive Double Star) system, ATM-PDS (Asynchronous Transfer Mode-Passive) via FTTH (Fiber to the Home) type communication medium. Double star) method.
[0005]
Communication realized by a typical centralized control time division multiple access method (hereinafter referred to as “time division multiple access method”) is, for example, a device on the side of a communication business station that provides information as shown in FIG. And “one-to-many” communication with a group of devices on the subscriber side of a service requesting provision of information. The communication business station side device and the service subscriber side device group are connected to each other via a downlink communication medium and an upstream communication medium, and signals transmitted by the communication business station side device are all transmitted via the downlink communication medium. The subscriber side device is reached. Signals transmitted by all the service subscriber side devices reach the communication business station side device via the upstream communication medium. A time division multiple access scheme is used for the uplink communication scheme.
[0006]
The communication business station side device transmits a signal for starting the uplink transmission of the subscriber side device via the downlink communication medium. This signal includes information for specifying one subscriber-side device to be transmitted, and includes information for specifying the transmission timing and transmission period of the subscriber-side device. When the signal identifies this device, the subscriber-side device that has received this signal starts and finishes uplink transmission according to the signal instruction. The communication business station side device centrally controls time division multiple access, that is, uplink communication, of the subscriber side device group by appropriately transmitting a signal for starting the uplink transmission of the subscriber side device.
[0007]
Next, in the time division multiple access method, a mechanism for identifying a subscriber home side device for specifying a single subscriber home side device from the subscriber home side device group will be described. In normal identification, at least in a subscriber premises apparatus group connected to the same communication medium, an identifier such as a number or a character string different from other subscriber premises apparatuses is given to each subscriber premises apparatus. The communication business station side device identifies the subscriber home device by including the identifier in the signal to the subscriber home device. The subscriber premises apparatus that receives the signal from the communication business station side apparatus including the identifier of the own apparatus understands that the signal is addressed to the own apparatus. In addition, the signal from the subscriber's home side device to the communication business station side device also includes the identifier of the subscriber home side device, and if the communication business station side device receives the signal, read the identifier included in the signal, It is determined from which subscriber premises equipment the reception is.
[0008]
Thus, it is necessary to give the above identifier to the subscriber premises apparatus. Each subscriber premises device must operate after recognizing the identifier value of its own device, and the value is stored in the subscriber premises device in a form that can be recognized by the electronic circuit constituting the subscriber premises device. Retained. There are several kinds of methods for assigning identifiers. The most typical examples are an address type identifier assigning method and a production number type identifier assigning method. The address type identifier assigning method is a type of identifier assigning method in which a value desired by the subscriber of the subscriber premises apparatus is set when starting to use the subscriber premises apparatus. The subscriber and the subscriber home installer set an address type identifier (hereinafter referred to as “address”) in the subscriber home side device using an input device such as a switch. In the following, the identifier used for this will be referred to as an “address identifier” for convenience. In the address type identifier, the user sets the address type identifier in the subscriber premises apparatus using a switch or other input device. The manufacturing number type identifier assigning method is an identifier assigning method in which a person who manufactures a subscriber premises apparatus presets a unique identifier in the subscriber premises apparatus. Hereinafter, the identifier used for this is referred to as a “manufacturing number type identifier” for convenience.
[0009]
In the above-described time division multiple access communication system, communication is realized by identifying a subscriber premises apparatus by performing identification only by an address. The identifier of the subscriber premises apparatus is often used not only for establishing communication between the communication business station side apparatus subscriber premises apparatuses but also for management for each subscriber.
[0010]
For example, when a new subscriber premises device (and a user connected to the subscriber premises device) is added to a certain time division multiple access communication system, it is about to be added to the communication business station side device. It is necessary to set several items regarding communication services to be provided to the subscriber premises apparatus (or user) such as enabling communication with a subscriber premises apparatus. In this case, a person who operates and manages the communication business station side device sets these items in the communication business station side device using the identifier of the subscriber home side device.
[0011]
At this time, there are a large number of network monitoring methods and devices (see, for example, Patent Document 1) for finding and taking measures against impersonation of each device using the address or serial number of each device.
[0012]
[Patent Document 1]
JP 2002-164899 A
[0013]
[Problems to be solved by the invention]
However, in a conventional time division multiple access communication system, communication is realized by specifying an address type identifier or a serial number type identifier as a unique source and a subscriber premises apparatus.
[0014]
In the case of an address type identifier, if an identifier having a value different from the value that should originally be assigned is assigned, the subscriber home device operates as if it is a subscriber home device with a different identifier. . Various values can be set for the address type identifier by operating an input device such as a switch of the subscriber premises apparatus. As a result, for example, a malicious user intentionally changes the value of the address type identifier to impersonate another user, peep at another user's information, or other communication that should be charged to himself. There is a risk of charging someone.
[0015]
On the other hand, for those who operate and manage the communication system, the address type identifier has a great advantage. The administrator can determine the identifier of the subscriber premises device to be added according to the identifier system planned by the administrator, and can make necessary settings in advance on the communication business station side device side. Also, even when the subscriber's home side device is replaced with another individual during operation, it is not necessary to change the setting if an identifier that has been conventionally used is assigned to the new individual.
[0016]
The manufacturing number type identifier is programmed by the manufacturer into the subscriber premises apparatus in the manufacturing process. In many cases, the serial number identifier cannot be rewritten by the user. Therefore, the serial number type identifier has the advantage that the possibility of impersonation is low.
[0017]
On the other hand, the serial number type identifier is inconvenient from the viewpoint of the administrator's setting work. For example, in order to set the communication business station side device before the installation and operation of the subscriber home side device, the value of the identifier of the subscriber home side device used by the user to be added in advance is required. That is, the administrator must first determine the individual subscriber-side device used by the user to be added, obtain the value of the serial number type identifier, and install it for the user who adds the individual without making a mistake. . In addition, when the subscriber's home side device is replaced with another individual during operation, it is necessary to change the setting of the communication business station side device.
[0018]
The present invention has been made in order to solve the above-described problems. When identifying a communication apparatus that performs a time division multiple access scheme, the present invention detects and prevents spoofing of the communication apparatus, thereby improving the security of the communication system. The present invention relates to a communication device, a communication system, and a communication method that improve the performance.
[0019]
[Means for Solving the Problems]
In view of the above problems, the first feature of the present invention is (a) a server-side communication device that provides information to a client side that requests information, and a serial number for the client side. Manufacturing number inquiry means for inquiring, (b) inquiry response receiving means for receiving a manufacturing number as a response to the inquiry from the client side, and (c) a connection state of a manufacturing number type identifier generated from the received manufacturing number, and Manufacturing number type identifier storage device for storing information for specifying connection prohibition state, and (d) Address type identifier storage device for storing information for specifying connection state of address type identifier generated from source address of manufacturing number And (e) notification means for notifying the client side of the combination of the corresponding address type identifier and serial number type identifier, and (f) notification of the combination A detection result receiving means for receiving a detection result transmitted when a contradiction is found in the combination on the receiving client side, and (g) transmission of data to the client side that is the transmission source based on the received detection result The gist of the present invention is that the communication apparatus includes a determination unit that determines whether or not to interrupt the transmission and notifies the transmission source of the determination result. Further, the first feature of the present invention is further provided with identifier updating means for updating information stored in the address type identifier storage device and the production number type identifier storage device based on the determination result, The information in the type identifier storage device and the serial number type identifier storage device may be stored in association with each device arranged on the client side.
[0020]
The second feature of the present invention is: (a) a communication device on the client side that requests information from the server side that provides information, and a serial number recognition unit that recognizes the serial number of the device itself; (B) Production number notification means for notifying the server side of the production number when the server side asks for the production number; (c) Address number type relating to the production number type identifier and address relating to the production number of the own device from the server side A notification receiving means for receiving a combination of identifiers; (d) a detecting means for detecting whether or not there is a contradiction between the received combination, a manufacturing number and an address recognized by itself; and (e) when a contradiction is detected. Further, the gist of the present invention is a communication device including a detection result notifying unit for notifying a server side of a detection result. Furthermore, the second feature of the present invention is that (f) further comprising interruption means for interrupting transmission of data to the server side when a contradiction is detected in the combination, and (g) from the server side answering the detection result According to the instruction, it may be possible to add further communication control means for controlling data transmission with the server side.
[0021]
A third feature of the present invention is (a) a communication system comprising a communication device provided on the client side requesting information and the server side providing information, and inquiring the serial number of the client side. Manufacturing number inquiry means, inquiry response receiving means for receiving a manufacturing number which is a reply to the inquiry from the client side, manufacturing for storing information defining the connection state and connection prohibition state of the manufacturing number type identifier generated from the received manufacturing number Number type identifier storage device, address type identifier storage device for storing information defining the connection state of the address type identifier generated from the transmission source address of the production number, address type identifier and serial number type identifier corresponding to the client side Notification means to notify the combination, combination on the client side that received the combination notification Detection result receiving means for receiving a detection result transmitted when a contradiction is found in the data, and determining whether or not to interrupt the transmission of data to the client side that is the transmission source based on the received detection result (B) manufacturing number recognizing means for recognizing the manufacturing number of the own device, manufacturing to the server side when the server asks for the manufacturing number Serial number notification means for notifying the number, notification receiving means for receiving a combination of serial number type identifier and address type identifier from the server side, whether the received combination and the serial number and address recognized by itself are inconsistent or not A communication system comprising: a detecting means for detecting; and a detection result notifying means for notifying the server side of a detection result when a contradiction is detected. And summarized in that a Temu.
[0022]
The fourth feature of the present invention is that (a) a step of inquiring a manufacturing number with respect to a client side requesting information, (b) a step of receiving a manufacturing number as a response to the inquiry from the client side, and (c) A step of storing in the manufacturing number type identifier storage device information defining the connection state and connection prohibition state of the manufacturing number type identifier generated from the received manufacturing number, and (d) generated from the source address of the manufacturing number. (E) storing information defining the connection state of the address type identifier in the address type identifier storage device; (e) notifying the client side of the combination of the corresponding address type identifier and serial number type identifier; Receiving the detection result sent when the client receiving the notification of the combination finds a contradiction in the combination A communication method comprising: a detection result receiving step; and (g) a step of determining whether or not to interrupt the transmission of data to the client that is the transmission source based on the received detection result and notifying the transmission source of the determination result. It is a summary.
[0023]
DETAILED DESCRIPTION OF THE INVENTION
(Outline of communication system)
First, an outline of a communication system according to an embodiment of the present invention will be described with reference to FIG. As a time-division multiple access method for connecting between the telecommunications carrier side and the subscriber side described below, it is assumed that an access method for Internet connection using a PON (passive optical network) is used as an example that exhibits a particularly effective effect. explain.
[0024]
The communication system using this access method is a server side, an optical subscriber line terminal station device 10 (OLT: Optical Line Terminal; hereinafter referred to as “OLT”) in a communication business station side device, and a client side subscriber. Optical subscriber line terminating devices 20a, 20b, 20c... (ONU: optical network unit; hereinafter referred to as “ONU”) in the home side device.
[0025]
In PON, an optical fiber cable 1 is used as a network. Generally, the optical fiber cable 1 is branched radially. Time division multiple access is suitable for realizing communication from a carrier station to a plurality of service subscribers using this network. The OLT 10 is installed in a facility of a service provider such as a telephone company exchange center or a cable television company relay station (head end) which is a telecommunications carrier. On the other hand, the ONUs 20a, 20b, 20c,... Are installed in a fiber-to-the-curve distributed hub arranged in the vicinity of a house, a condominium, and an office building. The signal propagates between the OLT 10 and the ONUs 20a, 20b, 20c... Via the optical fiber cable 1. At this time, communication from one OLT 10 to 32 fixed ONUs is possible.
[0026]
It is possible to connect to the Internet up and down by 100 Mbps using 1.3 μm for upstream communication from ONU 20 a, 20 b, 20 c... To OLT 10 and 1.49 μm for downstream communication from OLT 10 to ONU 20 a, 20 b, 20 c. To. In addition, it is also possible to superimpose a cable television broadcast on a wavelength of 1.55 μm.
[0027]
In the communication system according to the embodiment of the present invention, as shown in FIG. 1, the communication business station side arranges the OLT 10, the optical splitter 2, the exchange 3, the distribution server 4, and the like, and the subscriber premises side is the ONU 20 a, 20b, 20c... And household devices such as personal computers, telephones, and videos connected thereto.
[0028]
The OLT 10 converts the signal flowing through the optical fiber cable 1 so that it can be used in its own device. The exchange 3 performs telephone connection between extensions within the company and connection with a public line. Specifically, it refers to PBX (private branch exchange). The distribution server 4 is a server that searches information such as moving images such as videos requested by subscribers, still images such as photos, text data such as characters, and distributes them to requesting subscribers. The optical splitter 2 merges the optical signal transmitted to the subscriber network with the optical signal of the communication system, branches it, and transmits it to the ONUs 20a, 20b, 20c.
[0029]
In the ONUs 20a, 20b, 20c..., The optical signal is terminated and converted into an electrical signal. Thereafter, the electrical signals are output from the ONUs 20a, 20b, 20c,... Via the LANs 5a, 5b, 5c to personal computers, telephones, videos, etc. in the subscriber company's houses, and input into each device through STBs (set top boxes).
[0030]
The OLT 10 according to the embodiment of the present invention assigns a unique identification number to each ONU 20a, 20b, 20c... To prevent the ONUs 20a, 20b, 20c. .
[0031]
A process of “connection” when actual communication is performed between the OLT 10 and the ONUs 20a, 20b, 20c. The OLT 10 and the ONUs 20a, 20b, 20c,... Generate control messages (hereinafter referred to as “control messages”) in their own devices and exchange them between the OLT 10 and the ONUs 20a, 20b, 20c,. After the above connection, data such as a request from the user is transmitted between the OLT 10 and the ONUs 20a, 20b, 20c.
[0032]
In the embodiment of the present invention, the OLT 10 generates an address type identifier generated based on the address of each ONU 20a, 20b, 20c... And a manufacturing number type generated based on the serial number unique to each ONU 20a, 20b, 20c. The identifiers are stored in advance in appropriate combinations. The OLT 10 transmits the combination of the address type identifier and the serial number identifier to each ONU 20a, 20b, 20c,... At a predetermined interval. Each of the ONUs 20a, 20b, 20c... That has received this determines whether there is any contradiction or error in this combination, that is, whether or not it has been modified for the purpose of impersonating a malicious third party. If there is a contradiction, error, or the like in the combination, the data transmission between the OLTs 10 is temporarily suspended, an appropriate address is newly set, etc., because it may be altered. Details of the apparatus related to the communication system will be described below.
[0033]
(Optical subscriber line terminal equipment)
As shown in FIG. 2, the OLT 10 according to the embodiment of the present invention includes an input device 11, an output device 12, a communication control device 13, a main storage device 14, a processing control device (CPU) 15, and an address type identifier storage device 16. The serial number identifier storage device 17 and the program storage device 18 are provided. The CPU 15 includes a manufacturing number inquiry unit 15a, an inquiry response reception unit 15b, a notification unit 15c, a detection result reception unit 15d, a determination unit 15e, a determination result notification unit 15f, an identifier update unit 15g, and the like.
[0034]
The address type identifier storage device 16 stores information for defining the connection state of the address type identifier. Specifically, as shown in FIG. 4, the combination of the address type identifier value and the connection state between the OLT 10 and the ONUs 20a, 20b, 20c,. The serial number identifier storage device 17 stores information for defining the connection state and connection prohibition state of the serial number identifier. Specifically, for the connection state definition, as shown in FIG. 5, the combination of the serial number type identifier, the connection state between the OLT 10 and the ONUs 20a, 20b, 20c,. To do. As for the regulation of the connection prohibition state, as shown in FIG. 6, the value of the serial number type identifier, the time limit of prohibition, etc. are stored. The program storage device 18 stores a program for the CPU 15 to perform arithmetic processing.
[0035]
The production number inquiry means 15a is a module for making an inquiry about the unique production number of each ONU 20a, 20b, 20c,. The inquiry response receiving means 15b is a module that receives an answer to the inquiry about the serial number from each ONU 20a, 20b, 20c.
[0036]
The notification means 15c is a module that notifies the ONUs 20a, 20b, 20c,... Using the control message, the combination of the address type identifier and the serial number identifier of each ONU 20a, 20b, 20c,.
[0037]
The detection result receiving unit 15d is a module for receiving a detection result transmitted when the ONUs 20a, 20b, 20c,... Find a contradiction, error, etc. in the combination of the address type identifier and the manufacturing number identifier. The determination unit 15e is a module that determines whether to continue or interrupt data transmission to the transmission source ONU based on the received detection result.
[0038]
The determination result notifying unit 15f is a module for notifying the transmission source ONU of the determination result of the determining unit 15e. The identifier update unit 15g is a module that updates the data stored in the address type identifier storage device 16 and the production number type identifier storage device 17 based on the determination result of the determination unit 15e.
[0039]
The input device 11 is an interface that receives an input signal from the subscriber premises device. The output device 12 is an interface that transmits an output signal to the subscriber premises device. The communication control device 13 generates a control signal for transmitting and receiving data via a wireless or wired network and the optical fiber cable 1. The main storage device 14 temporarily stores a program describing processing procedures and data to be processed, and delivers a machine instruction and data of the program according to a request from the CPU 15. Data processed by the CPU 15 is written to the main storage device 14. The main storage device 14 and the CPU 15 are connected by an address bus, a data bus, a control signal, and the like.
[0040]
(Optical subscriber line termination equipment)
As shown in FIG. 3, the ONUs 20a, 20b, 20c... According to the embodiment of the present invention include an input device 21, an output device 22, a communication control device 23, a main storage device 24, a processing control device (CPU) 25, and a transmission. A data storage device 26 and a program storage device 27 are provided. The CPU 25 includes a manufacturing number recognition unit 25a, a manufacturing number notification unit 25b, a notification reception unit 25c, a manufacturing number inquiry reception unit 25d, a detection unit 25e, an interruption unit 25f, a detection result notification unit 25g, a communication control unit 25h, and the like. .
[0041]
The production number recognition means 25a is a module for each ONU 20a, 20b, 20c... To recognize a unique production number programmed in its own device. The production number notification means 25b is a module for each ONU 20a, 20b, 20c,... To notify the OLT 10 of a production number unique to the own device to the OLT 10 using a control message.
[0042]
The notification receiving unit 25c is a module for receiving a combination of address type identifiers and serial number type identifiers of the ONUs 20a, 20b, 20c... Transmitted from the OLT 10. The manufacturing number inquiry receiving unit 25d is a module that receives an inquiry about the manufacturing number of each ONU 20a, 20b, 20c,... Transmitted from the OLT 10.
[0043]
The detecting means 25e is a module that detects whether there is a contradiction, error, or the like in the combination of the received address type identifier and serial number type identifier. The interruption means 25f is a module that autonomously interrupts the transmission of data to the OLT 10 when an inconsistency, an error, or the like is detected in the combination of the address type identifier and the serial number identifier.
[0044]
The detection result notifying means 25g is a module that notifies the OLT 10 that a contradiction, error, etc. have been detected in the combination of the address type identifier and the serial number type identifier. The communication control unit 25h is a module that controls the continuation and interruption of data transmission between the OLT 10 and the own apparatus ONU according to the notification from the OLT 10 with respect to the detection result.
[0045]
The input device 21 is an interface that receives an input signal from the communication business station side device direction. The output device 22 is an interface that transmits an output signal toward the communication business station side device. The communication control device 23 generates a control signal for transmitting and receiving data via a wireless or wired network and the optical fiber cable 1. Since other devices are the same as those of the OLT 10, description thereof is omitted.
[0046]
(Communication method using optical subscriber line terminal equipment)
First, the operation in which the OLT 10 acquires and stores the serial numbers and addresses of the ONUs 20a, 20b, 20c,... Will be described with reference to FIG.
[0047]
(A) First, in step S101, upon confirmation of connection before starting transmission of user data, the serial number inquiry means 15a in FIG. 2 transmits a control message for acquiring serial numbers to the ONUs 20a, 20b, 20c. To do.
[0048]
(B) In step S102, the inquiry response receiving means 15b receives the production number from the ONUs 20a, 20b, 20c,... And creates a production number type identifier. At the same time, an address type identifier is created from the source addresses of the ONUs 20a, 20b, 20c.
[0049]
(C) In step S103, the address type identifier is stored in the address type identifier storage device 16 as shown in FIG. The production number type identifier is stored in the production number type identifier storage device 17 as shown in FIG. The address type identifier and the production number type identifier are stored in a state of being linked one-on-one.
[0050]
Next, an operation for preventing spoofing by the OLT 10 periodically transmitting a combination of a serial number type identifier and an address type identifier to the ONUs 20a, 20b, 20c... Will be described with reference to FIG.
[0051]
(A) First, in step S201, the notification unit 15c in FIG. 2 acquires a combination of an address type identifier in the address type identifier storage device 16 and a production number type identifier in the production number type identifier storage device 17, A list of combinations is periodically notified to the ONUs 20a, 20b, 20c... As control messages.
[0052]
(B) In step S202, the detection result receiving unit 15d in FIG. 2 receives a control message for replying to the combination control message from the ONUs 20a, 20b, 20c. In step S203, the determination unit 15e determines whether or not the received control message is a detection result for notifying a combination contradiction. If it is a detection result notifying the combination contradiction, the process proceeds to step S204. If it is a detection result that is not a notification of combination contradiction, the process proceeds to step S207, and communication is continued as usual.
[0053]
(C) In step S204, the determination unit 15e in FIG. 2 receives the received address type identifier and serial number type identifier, and the address type identifier stored in the address type identifier storage device 16 and serial number type identifier storage device 17. And the combination of the serial number type identifier is collated. Furthermore, in step S205, the appropriateness of the collation result is determined, and it is determined whether there is a possibility that it has been altered by a third party for the purpose of impersonation. In accordance with this determination, the identifier updating unit 15g updates the connection state specification in FIG. 5 and the connection prohibition state specification in FIG.
[0054]
(D) Lastly, in step S206, the determination result notifying unit 15f transmits to the ONUs 20a, 20b, 20c,.
[0055]
According to the above, impersonation can be detected and prevented by using the addresses and serial numbers of the ONUs 20a, 20b, 20c.
[0056]
(Communication method using optical subscriber termination equipment)
Next, an operation in which the ONUs 20a, 20b, 20c,... Are requested for a serial number from the OLT 10 and respond to the request will be described with reference to FIG.
[0057]
(A) In step S301, the serial number inquiry receiving unit 25d of the ONUs 20a, 20b, and 20c in FIG. 2 receives a serial number inquiry control message from the OLT 10. In step S302, the production number recognition unit 25a detects a unique production number of the own device ONU. Note that the identifiers of the ONUs 20a, 20b, 20c... Are address type identifiers. Further, the ONUs 20a, 20b, 20c,... Are programmed with information corresponding to the production number type identifiers in the same manner as the production number type identifiers, and the electronic circuits constituting the ONUs 20a, 20b, 20c,. It is possible to recognize both number type identifiers.
[0058]
(B) In step S303, the serial number notifying unit 25b notifies the OLT 10 of the serial number as an answer to the inquiry.
[0059]
Next, an operation of detecting spoofing by the ONUs 20a, 20b, 20c,... By periodically receiving a combination of a production number type identifier and an address type identifier from the OLT 10 will be described with reference to FIG.
[0060]
(A) First, in step S401, the notification receiving means 25c of the ONUs 20a, 20b, 20c... In FIG. 3 periodically receives a combination of a manufacturing number type identifier and an address type identifier from the OLT 10. In step S402, the detection unit 25e detects whether or not the received identifier of the combination is an identifier that matches the own apparatus ONU.
[0061]
(B) If a contradiction in combination is detected in step S403, the process proceeds to step S404. If no combination contradiction is detected, the process proceeds to step S407, and communication is continued as usual. The combination contradiction means that the value of the address type identifier indicating the own device corresponding to the serial number in the combination list notified from the OLT 10 is different from the value of the address type identifier set in the own device ONU. And / or indicates that the value of the serial number type identifier indicating the own device corresponding to the serial number in the combination list is different from the value of the serial number type identifier unique to the own device ONU.
[0062]
(C) If it is recognized in step S404 that the address type identifier or the serial number type identifier does not match, the address or the like may have been altered by a malicious third party for the purpose of impersonation. Therefore, the interruption means 25f in FIG. 3 autonomously interrupts transmission of user data. In S405, the detection result notifying unit 25g notifies the OLT 10 that the address type identifier has been changed using a control message. In this case, it is necessary to decide whether to use the pre-change value or the post-change value as the address type identifier used in communication between the OLT 10 and the ONUs 20a, 20b, 20c... It may be acceptable.
[0063]
(D) Thereafter, when receiving an instruction from the OLT 10 in step S406, the communication control means 25h in FIG. 2 obeys the occurrence of impersonation by stopping the transmission of user data in accordance with this instruction. Or prevent at an early stage.
[0064]
According to the above, impersonation can be detected and prevented by using the addresses and serial numbers of the ONUs 20a, 20b, 20c.
[0065]
Since the basic procedure of the time division multiple access method is not changed, it is only necessary to modify the program and it is easy to implement. Since an address type identifier is used as an identifier, operation management is convenient. Furthermore, since each ONU 20a, 20b, 20c,... Unique manufacturing number is used in combination, impersonation by a malicious third party can be reliably detected, and the security of the entire system can be improved.
[0066]
In the embodiment of the present invention, for the sake of convenience, the arrangement relationship of “OLT on the telecommunications business station side” and “ONU on the subscriber premises side” is used, but there are no restrictions on the physical form and the installation location. Instead, they may be one functional part of a physical device. These devices may be physically a single device.
[0067]
Further, in the embodiment of the present invention, the OLT and the ONU are used for the termination device in order to use the optical fiber technology. Of course, it can also be applied to communication network cables.
[0068]
【The invention's effect】
In order to improve the security of a communication system by detecting and preventing spoofing of a communication apparatus using the address and serial number of the communication apparatus when identifying the communication apparatus by the time division multiple access method according to the present invention. Communication apparatus, communication system, and communication method can be provided.
[Brief description of the drawings]
FIG. 1 is a schematic diagram of a communication system using a communication apparatus according to an embodiment of the present invention.
FIG. 2 is an internal block diagram of an optical subscriber line terminal station apparatus according to an embodiment of the present invention.
FIG. 3 is an internal configuration diagram of an optical subscriber line terminating apparatus according to an embodiment of the present invention.
FIG. 4 is a data configuration diagram in an address type identifier storage device;
FIG. 5 is a data configuration diagram in a serial number type identifier storage device;
FIG. 6 is a data configuration diagram in a serial number type identifier storage device;
FIG. 7 is a flowchart showing a serial number inquiry operation of the optical subscriber line terminal equipment.
FIG. 8 is a flowchart showing an operation of detecting impersonation of an optical subscriber line terminal device.
FIG. 9 is a flowchart showing a serial number inquiry operation of the optical subscriber line terminating device.
FIG. 10 is a flowchart showing an operation of detecting impersonation of an optical subscriber line terminating device.
[Explanation of symbols]
1 ... Optical fiber cable
2 ... Optical splitter
3 ... switch
4 ... Distribution server
5a, 5b, 5c ... LAN
10. Optical subscriber line terminal equipment (OLT)
11 ... Input device
12 ... Output device
13. Communication control device
14 ... Main memory
15 ... CPU
15a ... Manufacturing number inquiry means
15b: Inquiry answer receiving means
15c: Notification means
15d: Detection result receiving means
15e ... Judgment means
15f ... Judgment result notification means
15g ... identifier update means
16: Address type identifier storage device
17 ... Manufacturing number type identifier storage device
18 ... Program storage device
20a, 20b, 20c ... Optical subscriber line termination unit (ONU)
21 ... Input device
22 ... Output device
23. Communication control device
24. Main memory device
25 ... CPU
25a ... Manufacturing number recognition means
25b ... Manufacturing number notification means
25c: Notification receiving means
25d. Receiving means
25e ... detection means
25f ... Interruption means
25g ... Detection result notification means
25h: Communication control means
26: Transmission data storage device
27. Program storage device

Claims (8)

A server-side communication device that provides the information to a client that requests information,
A serial number inquiry means for inquiring a serial number from the client side;
Inquiry answer receiving means for receiving the manufacturing number which is an answer to the inquiry from the client side,
A production number type identifier storage device for storing information defining the connection state and connection prohibition state of the production number type identifier generated from the received production number;
An address type identifier storage device for storing information defining a connection state of an address type identifier generated from an address of a transmission source of the manufacturing number;
Notifying means for notifying the client side of the combination of the corresponding address type identifier and the serial number type identifier;
A detection result receiving means for receiving a detection result transmitted when a contradiction is found in the combination on the client side that has received the notification of the combination;
And determining means for determining whether to interrupt transmission of data to the client that is the transmission source based on the received detection result, and notifying the transmission source of the determination result. Communication device. 2. The communication apparatus according to claim 1, further comprising identifier updating means for updating information stored in the address type identifier storage device and the serial number identifier storage device based on the determination result. 2. The communication apparatus according to claim 1, wherein information in the address type identifier storage device and the serial number type identifier storage device is stored in association with each device arranged on the client side. . A client side communication device that requests the information from the server side that provides the information,
Serial number recognition means for recognizing the serial number of the device itself;
A manufacturing number notification means for notifying the manufacturing number to the server side when the server receives an inquiry about the manufacturing number;
A notification receiving means for receiving a combination of a serial number type identifier relating to the serial number of the own device and an address type identifier relating to an address from the server side;
Detecting means for detecting whether or not there is a contradiction between the received combination and the serial number and the address recognized by the device;
A communication apparatus comprising: a detection result notifying unit that notifies the server side of the detection result when the contradiction is detected. 5. The communication apparatus according to claim 4, further comprising interruption means for interrupting transmission of data to the server side when a contradiction is detected in the combination. 5. The communication apparatus according to claim 4, further comprising communication control means for controlling data transmission with the server side in accordance with an instruction from the server side that answers the detection result. A communication system comprising a communication device provided on a client side that requests information and a server side that provides the information,
A manufacturing number inquiry means for inquiring a manufacturing number with respect to the client side, an inquiry response receiving means for receiving the manufacturing number as a response to the inquiry from the client side, and a manufacturing number type identifier generated from the received manufacturing number Manufacturing number type identifier storage device for storing information for specifying connection state and connection prohibition state, and address type identifier storage device for storing information for specifying connection state of address type identifier generated from address of transmission source of manufacturing number A notification means for notifying the combination of the address type identifier and the serial number identifier corresponding to the client side, and a detection transmitted when an inconsistency is found in the combination on the client side that has received the notification of the combination Detection result receiving means for receiving a result, the received detection Said server side communication device and a determination unit for notifying the determination result on whether the determined the source to interrupt transmission of data to the client-side which is a transmission source based on fruit,
Manufacturing number recognizing means for recognizing the manufacturing number of the device itself, manufacturing number notifying means for notifying the manufacturing number to the server side when the server asks for the manufacturing number, and the manufacturing number type from the server side A notification receiving means for receiving a combination of an identifier and the address type identifier; a detecting means for detecting whether or not there is a contradiction between the received serial number and the address recognized by the combination; and when the contradiction is detected And a communication device on the client side provided with detection result notification means for notifying the detection result to the server side. Inquiring the serial number from the client requesting information;
Receiving the serial number which is an answer to the inquiry from the client side;
Storing information defining the connection state and connection prohibition state of the production number type identifier generated from the received production number in the production number type identifier storage device;
Storing in the address type identifier storage device information defining the connection state of the address type identifier generated from the address of the transmission source of the manufacturing number;
Notifying the client side of the combination of the corresponding address type identifier and the serial number type identifier;
A detection result receiving step of receiving a detection result transmitted when a contradiction is found in the combination on the client side that has received the notification of the combination;
And determining whether to interrupt the transmission of data to the client, which is the transmission source, based on the received detection result, and notifying the transmission source of the determination result.

Images