JP5269641B2 - User authentication system and user authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid installation of a plurality of expensive BRAS (Broadband Remote Access Server) apparatuses. <P>SOLUTION: An ONU includes a transparent filter section for filtering a frame sent from a terminal, a regular frame transmitting section for regularly transmitting a frame including a MAC address to an OLT, an ONU side monitoring section for monitoring a DHCP packet, and an ONU control section for performing filtering control of the transparent filter section. The OLT includes a registered ONU table previously storing the MAC addresses of all the ONUs subordinate thereto, a regular frame receiving section for receiving the frame from the ONU, an authenticated ONU table registering section for determining whether or not the MAC address of the received frame matches the registered ONU table, and if it matches, registering the ONU and the MAC address to the authenticated ONU table, a filter section for filtering the frame from the ONU, an OLT side monitoring section for monitoring the DHCP packet, and an OLT control section for performing filtering control. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a user authentication technique in a network.

In recent years, broadband access services have become widespread. As a broadband access system, media converters were conventionally used as subscriber accommodation devices installed in communication stations by telecommunications carriers, but broadband subscribers can be accommodated at a lower cost as broadband spreads and prices are reduced. As a method for this, an Ethernet (registered trademark) -PON (Passive Optical Network) system using the Ethernet (registered trademark) standard has become mainstream.

  In addition, if there is no user authentication mechanism in the broadband access service provided by the telecommunications carrier, problems such as using the network without permission or using a service outside the contract may occur. An authentication system to perform is essential.

  Therefore, in a broadband access service by a domestic telecommunications carrier, when a user connects to the Internet, for example, a protocol called PPPoE (Point-to-Point Protocol over Ethernet) standardized by RFC2516 of IETF is used to connect to the Internet backbone. It is connected to a BRAS (Broadband Remote Access Server) installed at a regional access point that is the entrance of the network and receives user authentication (see, for example, Patent Document 1).

  However, BRAS devices that perform user authentication using the PPPoE protocol have a limited number of users that can be authenticated. In addition, since all user data is transferred to an upper network through BRAS, there is a problem that access to BRAS is concentrated and BRAS becomes a network bottleneck. Therefore, a plurality of BRAS is installed to distribute the load. However, a plurality of expensive BRAS must be installed, which is a burden on the telecommunications carrier in terms of cost or space of the station building. There is a problem of being heavy.

  An object of the present invention is to provide a user authentication system and a user authentication method capable of realizing user authentication with a simple system without requiring a BRAS as a user authentication device.

The user authentication system of the present invention wavelength-multiplexes an OLT for connecting an access from a wavelength multiplexing PON system formed thereunder to an upper network, a plurality of ONUs for connecting user terminals to the OLT, and the plurality of ONUs. In a user authentication system in a wavelength division multiplexing PON system including an optical coupler connected to the OLT and a DHCP server that issues an IP address to the user terminal, the ONU performs filtering of frames transmitted from the user terminal A transmission filter unit that performs transmission, a periodic frame transmission unit that periodically transmits a periodic frame including its own MAC address to the OLT, and the MAC address and IP of the packet of the user terminal that allows the ONU to pass through the transmission filter unit Transparent filter table that memorizes address correspondence If the monitored MAC address of the user terminal by snooping DHCPrequest frames transmitted to and received from the user terminal and the DHCP server, monitors the further IP address assigned to the user terminal by snooping DHCPack frame, the user It consists of an ONU side monitor unit that registers the correspondence between the MAC address and IP address of the terminal in the transparent filter table, and an ONU control unit that performs filtering control of the transparent filter unit, and the OLT is under its own OLT. and all of the ONU registered ONU table MAC address is stored in advance in the installation has been, and authenticated ONU table storing the ONU and the MAC address is authenticated from among the registered ONU table, from the ONU And regular frame receiving unit that receives the periodic frame issued, matching the regular frame receiving unit is MAC address of the ONU stored in the regular frame received is stored in the registered ONU table MAC address An ONU table registration unit that registers the ONU and the MAC address in the authenticated ONU table if they match, a packet filter unit that filters frames sent from the ONU, The MAC address of the user terminal is monitored by snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server, and the IP address assigned to the user terminal is monitored by snooping of the DHCPPack frame. An OLT-side monitor unit that registers the MAC address and IP address of the terminal in the authenticated terminal table and an OLT control unit that performs filtering control of the packet filter unit . A first state in which the user terminal does not pass through, a second state in which a broadcast packet transmitted from the user terminal passes through the upper network, and a third state in which all frames transmitted from the user terminal pass through the upper network. In the first state, the OLT control unit stores the ONU MAC address stored in the periodic frame received from the ONU after the ONU is powered on and the registered ONU table and the If not registered in the authenticated ONU table, blanking received from the ONU Was over de cast packets to a state impervious to the upper network, the ONU control unit, in a state passing broadcast packets transmitted from the user terminal to the OLT, and in the second state, the OLT control unit, When the MAC address of the ONU stored in the periodic frame received from the ONU is registered in the authenticated ONU table, the broadcast packet received from the ONU is put into a higher network, and the ONU control unit Puts the broadcast packet transmitted from the user terminal through the OLT, and in the third state, the OLT control unit determines that the MAC address of the ONU stored in the periodic frame received from the ONU is Registered in the authenticated ONU table If, and, with the MAC address and the IP address of the MAC address and the IP address of the user terminal stored in the frame received from the user terminal is registered in the authenticated terminal table via the ONU matches In this case, all frames received from the user terminal are put through a higher-level network, and the ONU control unit is configured so that the MAC address and the IP address of the user terminal stored in the frame received from the user terminal are When registered in the transmission filter table, all frames received from the user terminal are put into a state of passing through the OLT .

  More preferably, the periodic frame is an Ethernet-OAM CC frame.

The user authentication method according to the present invention includes an OLT that connects an access from a wavelength division multiplexing PON system formed thereunder to an upper network, a plurality of ONUs that connect user terminals to the OLT, and a wavelength multiplexing of the plurality of ONUs. In a user authentication method in a wavelength division multiplexing PON system including an optical coupler connected to the OLT and a DHCP server that issues an IP address to the user terminal, the ONU performs filtering of frames transmitted from the user terminal The transmission filter procedure for performing a periodic frame transmission procedure for periodically transmitting a periodic frame including its own MAC address to the OLT, and snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server. The MAC address of the device Nitashi further monitors the IP address assigned to the user terminal by snooping DHCPack frame, the ONU-side monitoring procedure for registering the correspondence between the MAC address and IP address of the user terminal to the transmission filter table, the transmission filter Procedure run the ONU control procedure for filtering control, the OLT, and periodic frame receiving step of receiving said periodic frame sent from the ONU, stored in the regular frame received by the regular frame reception procedure wherein When the MAC addresses of ONUs match with the MAC addresses stored in the registered ONU table stored in advance, the MAC addresses of all the ONUs installed under the own OLT are determined. Recognize the ONU and the MAC address Authenticated ONU table registration procedure for registering in the completed ONU table, packet filter procedure for filtering frames transmitted from the ONU, and snooping of DHCP request frames transmitted and received between the user terminal and the DHCP server OLT-side monitoring procedure for monitoring the MAC address of the terminal, further monitoring the IP address assigned to the user terminal by snooping the DHCPPack frame , and registering the MAC address and IP address of the user terminal in the authenticated terminal table; run the OLT control procedure for filtering control of the packet filtering procedure, the first state impervious to all frames on top of the network to be transmitted from the user terminal, it is transmitted from the user terminal A second state in which broadcast packets to be transmitted are passed through the upper network, and a third state in which all frames transmitted from the user terminal are passed through the upper network. In the first state, the OLT control is performed. procedure, when the MAC address of the ONU stored in said periodic frame after power received from the ONU of the ONU is not registered in the registered ONU table and the authenticated ONU table is received from the ONU The broadcast packet transmitted from the user terminal is passed through the OLT, the broadcast packet transmitted from the user terminal is passed through the OLT, and in the second state, the OLT control procedure includes the ONU control procedure. the ONU which has been stored in the periodic frame received from If the MAC address is registered in the authenticated ONU table, in a state passing broadcast packets received from the ONU to the upper network, the ONU control procedure, a broadcast packet transmitted from the user terminal to the OLT If the pass into a state, the third state, the OLT control procedure, the MAC address of the ONU stored in the regular frame received from the ONU is registered in the authenticated ONU table, and, the If the MAC address and the IP address of the user terminal stored in the frame received from the user terminal via the ONU match the MAC address and the IP address registered in the authenticated terminal table, the ONU Via the user terminal A state through all frames received on top of the network, the ONU control procedure, the MAC address and the IP address of the user terminal stored in the frame received from the user terminal is registered in the transmission filter table If so, all frames received from the user terminal are put into a state of passing through the OLT .

  More preferably, the periodic frame is an Ethernet-OAM CC frame.

  The user authentication system and the user authentication method of the present invention do not require BRAS as a user authentication device, and can realize user authentication with a simple system.

It is a block diagram which shows the structural example of the Ethernet-PON system using the user authentication system 100 which concerns on this embodiment. It is a block diagram which shows the structural example of the conventional Ethernet-PON system. It is a block diagram which shows the structural example of the user authentication system 100 which concerns on this embodiment. It is explanatory drawing which shows a DHCP process procedure. It is explanatory drawing which shows an example of the permeation | transmission filter table. It is explanatory drawing which shows an example of the registered ONU table. It is explanatory drawing which shows an example of the authenticated ONU table. It is a flowchart which shows the user authentication procedure of the user authentication system 100 which concerns on this embodiment. It is explanatory drawing which shows the transition of the filter state of the user authentication system 100 which concerns on this embodiment.

  Embodiments of a user authentication system and a user authentication method according to the present invention will be described. In the present embodiment, it is assumed that the communication carrier configures an access system using the Ethernet-PON system. In addition, it is assumed that the MAC address information of the ONU (optical subscriber unit) installed at the user's home side is registered in advance in the station side OLT (optical line termination unit) when the PON system is installed. Then, a user who has contracted with a telecommunications carrier connects a user terminal such as a personal computer to an ONU installed in his home and accesses the Internet.

  Here, the MAC (Media Access Control) address is a serial number unique to a network terminal such as a network interface card or a router of the user terminal. When installing the ONU in the user's home, the communication carrier can know the MAC address of the ONU installed together with the user's address and name.

  In the present embodiment, IEEE-OAM Ethernet-OAM is used. The Ethernet-OAM is used for maintenance of network devices in the layer 2 network and for fault diagnosis of the network. Further, the OLT authenticates the ONU by transmitting and receiving an Ethernet-OAM standard CC frame (connectivity confirmation frame) between the OLT and the ONU.

  Hereinafter, the configuration of the user authentication system according to the present embodiment will be described in detail.

  FIG. 1 is a block diagram illustrating a configuration example of an Ethernet-PON system including three ONUs of an ONU 101, an ONU 102, and an ONU 103. In FIG. 1, an ONU 101, an ONU 102, and an ONU 103 each convert a packet transmitted from a PC (PC 112, ONU 103, and PC 113) connected under the ONU from an electric signal to an optical signal or reverse conversion. Packets converted into optical signals by each ONU are multiplexed by the optical coupler 104 and input to the OLT 105. The signal transmission timing of each ONU is automatically controlled by the OLT 105 so that the upstream optical signal from each ONU to the OLT 105 does not collide. In addition, the downstream optical signal from the OLT 105 to each ONU and the upstream optical signal are wavelength-multiplexed so as not to collide, and the wavelength λ1 is used for the upstream signal and the wavelength λ2 is used for the downstream signal.

  Conversely, packets sent from the DHCP server 106 or backbone to the OLT 105 are sent to all ONUs, but the MAC address of the PC is learned from the data sent from each PC connected to the ONU to each ONU. Each ONU sends only a packet having a destination MAC address that matches the learned MAC address to the PC connected to each ONU.

  Here, conventional user authentication of a network using BRAS will be described with reference to FIG. As shown in FIG. 2, it is conventionally connected to the backbone via the BRAS 210. In FIG. 2, as in FIG. 1 of the present embodiment, the ONU 201, the ONU 202, and the ONU 203 constitute an Ethernet-PON system with the optical coupler 204 and the OLT 205. Further, the personal computers PC111, PC112, PC113 and DHCP server 106 of the user terminal are the same as those in FIG. Note that the BRAS 210 may integrate the functions of the DHCP server 106 depending on the product. Here, each user terminal accesses the BRAS by the PPPoE protocol and performs user authentication. Then, after user authentication is performed in the BRAS 210, an IP address is assigned from the DHCP server 106 to the authenticated user terminal. However, the number of user terminals that can be connected under the BRAS per unit is limited, and if the number of user terminals that use the Ethernet-PON system increases, it becomes impossible to deal with only one BRAS. For this reason, the communication carrier has to install a plurality of expensive BRAS, and there is a problem that the equipment cost becomes high.

  On the other hand, in this embodiment, since expensive BRAS is not required, it becomes possible for a communication carrier to introduce an Ethernet-PON system at a low cost. In this embodiment, user authentication is performed using the ONU 101, ONU 102, ONU 103, and OLT 105, and an IP address is assigned from the DHCP server 106 to each user terminal after user authentication. This eliminates the need for BRAS, which conventionally performed user authentication.

  Next, the configuration of the user authentication system 100 in the present embodiment will be described. FIG. 3 is a block diagram depicting mainly the configurations of the OLT 105 and the ONU 101 which are main parts for performing user authentication in the user authentication system 100. 3 shows only the ONU 101, the ONU 102 and the ONU 103 in FIG. 1 have the same configuration as the ONU 101 in FIG.

  3, the ONU 101 includes a transmission filter unit 121, an ONU control unit 122, a CC frame transmission unit 123, a DHCP monitor unit 124, and a transmission filter table storage unit 125. The OLT 105 includes a packet filter unit 131, an OLT control unit 132, a CC frame reception unit 133, a DHCP monitor unit 134, a registered ONU table storage unit 135, an authenticated ONU table storage unit 136, and an authenticated unit. And a terminal table storage unit 137. In FIG. 3, the packet flow is mainly illustrated, and the optical modulation / demodulation units of the ONU 101 and the OLT 105 are omitted.

  First, the operation of the ONU 101 will be described. The transmission filter unit 121 filters packets transmitted from the user terminal 111. Filtering is performed according to a command from the ONU control unit 122, and includes, for example, a setting that does not pass all packets, a setting that allows only broadcast packets such as DHCP packets to pass through, or a setting that passes all packets. In this embodiment, it is assumed that the transmission filter unit 121 when the ONU 101 is turned on is set to transmit only broadcast packets such as DHCP packets.

  Here, the DHCP packet will be described. The DHCP packet is a control packet that is transmitted and received between the DHCP server 106 and the user terminal, and is used for receiving an IP address assignment from the DHCP server 106. FIG. 4 is a diagram illustrating a procedure in which the PC 111 of the user terminal receives an IP address from the DHCP server 106. In FIG. 4, reference numeral 301 denotes a DHCP discover frame, 302 denotes a DHCP offer frame, 303 denotes a DHCP request frame, and 304 denotes a DHCP Pack frame. Initially, since the location of the DHCP server is unknown, the PC 111 transmits a DHCP discover frame 301 in the IEEE 802.3 standard broadcast format to search for the DHCP server. Then, the DHCP server in the network that has received the DHCPdiscover frame 301 returns a DHCPoffer frame 302 to the transmission source PC 111. If there are a plurality of DHCP servers in the network, the PC 111 receives a plurality of DHCPoffer frames 302. Normally, when a plurality of DHCPoffer frames 302 are received, the one received first is selected. As a result, the PC 111 can know the location of the DHCP server. Then, the PC 111 obtains an assignable IP address from the DHCPoffer frame 302 received from the DHCP server 106 shown in FIG. Next, the PC 111 returns a DHCP request frame 303 to the DHCP server 106 and requests the use of the IP address. The DHCP server 106 that has received the DHCP request frame 303 returns the DHCPPack frame 304 in which the permitted IP address is described to the PC 111 when permitting, and is not permitted if not permitted. A DHCPnack frame indicating this is returned to the PC 111. When a DHCPnack frame is sent from the DHCP server 106, the PC 111 cannot receive an IP address assignment and cannot use the network, so the DHCP process is performed again.

  In addition, the series of DHCP processes described above uses the frame structure of the data link layer of layer 2, and the IP packet that is the network layer is the data portion and the transport layer is above the IP packet. A TCP (Transmission Control Protocol) packet or a UDP (User Datagram Protocol) packet is mounted. The DHCP process is performed in a UDP packet, and when sending in the broadcast format, the MAC address of the PC 111 of the user terminal is described in the source MAC address, and the destination MAC address is FF-FF-FF-FF-FF- Set to FF. Each device on the network can recognize whether the packet is a broadcast format by looking at the destination MAC address.

  Here, the ONU 101, ONU 102, ONU 103, and OLT 105 in FIG. 1 can know the MAC address of the PC 111 by monitoring the DHCP request frame 303 transmitted from the PC 111 to the DHCP server 106. Similarly, the ONU 101, ONU 102, ONU 103, and OLT 105 in FIG. 1 can know the IP address assigned to the PC 111 by monitoring the DHCPPack frame 304 transmitted from the DHCP server 106 to the PC 111. Such a function is called a snooping function.

  The DHCP monitor unit 124 of the ONU 101 in FIG. 3 and the DHCP monitor unit 134 of the OLT 105 have the snooping function described above.

  The DHCP monitor unit 124 outputs the MAC address and IP address of the PC 111 obtained by the snooping function to the ONU control unit 122. Then, the ONU control unit 122 stores the correspondence between the MAC address of the PC 111 and the IP address in the transmission filter table storage unit 125. FIG. 5 shows an example of the transmission filter table. In FIG. 5, the IP address assigned to the PC 111 of the user terminal is (192, 168, 0, 20), and the MAC address is 55-44-33-22-11-00. If there are a plurality of user terminals under the ONU 101, they are additionally registered as in the PC 112 in FIG. The IP address assigned to the PC 112 is (192, 168, 0, 21), and the MAC address is 66-55-44-33-22-11.

  The CC frame transmission unit 123 transmits an Ethernet-OAM CC frame (connectivity confirmation frame) of the IEEE 802.1ag standard. Note that Ethernet-OAM is a function that is installed for maintenance management of the PON system and is not originally a user authentication function. In this embodiment, the ONU 101, the ONU 102, the ONU 103, and the OLT 105 Used for user authentication. The CC frame transmission unit 123 periodically transmits a CC frame to the OLT 105 at a preset interval (for example, every second) according to a command from the ONU control unit 122.

  Next, the operation of the OLT 105 will be described. The packet filter unit 131 filters packets of each user terminal sent via the optical coupler 104. Filtering is performed for each MAC address and IP address of the user terminal set from the OLT control unit 132. For example, settings that do not pass all packets, settings that allow only broadcast packets such as DHCP packets to pass through, or settings that pass all packets. Have

  The CC frame reception unit 133 receives a CC frame periodically transmitted by the CC frame transmission unit 123 of the ONU 101 and outputs the CC frame to the OLT control unit 132. The OLT control unit 132 can know the MAC address on the ONU side by receiving the CC frame in which the MAC address on the ONU side is described. Then, the OLT control unit 132 determines whether or not the MAC address described in the CC frame matches the MAC address of the ONU registered in the registered ONU table storage unit 135 in advance. FIG. 6 shows an example of a registered ONU table. In FIG. 6, the MAC address of the ONU 101 is 00-11-22-33-44-55, the MAC address of the ONU 102 is 00-22-33-44-55-66, and the MAC address of the ONU 103 is 00-33-44. It turns out that it is -55-66-77. Here, for example, when the MAC address sent from the ONU 101 in FIG. 3 is 00-11-22-33-44-55, the MAC address of the ONU 101 registered in advance in the registered ONU table storage unit 135 is set. Since they match, the ONU 101 is determined to be a valid ONU, and the ONU name and its MAC address are stored in the authenticated ONU table storage unit 136. FIG. 7 shows an example of the authenticated ONU table. In FIG. 7, when the MAC address of the ONU 101 is authenticated, the MAC address: 00-11-22-33-44-55 is stored in the ONU 101 column. At this time, the MAC address fields of the unauthenticated ONU 102 and ONU 103 are blank. Then, the OLT control unit 132 instructs the packet filter unit 131 to pass only the broadcast packet transmitted via the authenticated ONU stored in the authenticated ONU table storage unit 136 to the upper network. In this way, the PC 111 of the user terminal can send and receive DHCP packets to and from the DHCP server 106 via the ONU 101 and the OLT 105. Note that the packet filter unit 131 does not pass all input ONU packets that are not user-authenticated to the upper network until authentication of the MAC address of the ONU is completed.

  The DHCP monitor unit 134 outputs the obtained MAC address and IP address of the PC 111 to the OLT control unit 132 by the snooping function described above, and registers it in the authenticated terminal table storage unit 137. As a result, the OLT control unit 132 knows that the DHCPPack frame 304 has been transmitted from the DHCP server 106 to the PC 111, and detects the completion of a series of DHCP controls. Then, the OLT control unit 132 associates the MAC address of the PC 111 with the IP address and registers them in the authenticated terminal table storage unit 137. The packet filter unit 131 is instructed to pass all packets transmitted from the PC 111 of the user terminal registered in the authenticated terminal table storage unit 137 through the upper network. In this way, the user terminal PC 111 can access the backbone network via the ONU 101 and the OLT 105.

  Next, the flow of processing from when the user terminal PC 111 is connected to the ONU 101 until the backbone network can be accessed will be described with reference to the flowchart of FIG. The flowchart of FIG. 8 is drawn so that the processing relationships among the PC 111, the ONU 101, the OLT 105, and the DHCP server 106 of the user terminal shown in FIG.

  (Step S101) The ONU 101 is powered on. The ONU 101 to which the power is turned on periodically transmits the CC frame 300 from the CC frame transmission unit 123 to the OLT 105 as described above.

  (Step S102) The CC frame receiving unit 133 of the OLT 105 receives the CC frame 300 transmitted from the ONU 101.

  (Step S103) The OLT control unit 132 of the OLT 105 determines whether or not the transmission source MAC address of the CC frame received by the CC frame reception unit 133 matches the MAC address of the ONU registered in advance in the registered ONU table storage unit 135. Is determined. If they match, the process proceeds to step S104. If they do not match, the process returns to step S102 to receive the CC frame 300. Actually, since the CC frame receiving unit 133 constantly receives the CC frame 300 periodically transmitted from the ONU 101, the reception operation is continued even after the process proceeds to step S104.

  (Step S104) Since the OLT control unit 132 of the OLT 105 matches the MAC address of the ONU registered in advance in the registered ONU table storage unit 135, the transmission source MAC address of the CC frame 300 received by the CC frame reception unit 133 The ONU name and MAC address are stored in the authenticated ONU table storage unit 136. Further, the OLT control unit 132 instructs the packet filter unit 131 to pass a broadcast packet transmitted via a valid ONU stored in the authenticated ONU table storage unit 136 to the upper network. In this state, the DHCP packet can pass through the packet filter unit 131, and the DHCP packet can be transmitted and received between the PC 111 of the user terminal and the DHCP server 106.

  (Step S <b> 105) The PC 111 of the user terminal transmits a DHCP discover frame 301 that is a broadcast packet to the DHCP server 106 via the ONU 101 and the OLT 105 in order to receive an IP address assignment. The PC 111 continues to transmit the DHCP discover frame 301 that is a broadcast packet to the ONU 101 and the OLT 105 to receive the IP address assignment by this time point. However, since it is filtered by the OLT 105, the PC 111 reaches the DHCP server 106. Not.

  (Step S <b> 106) Upon receiving the DHCP discover frame 301 transmitted from the PC 111, the DHCP server 106 transmits a DHCP offer frame 302 describing an available IP address to the PC 111.

  (Step S <b> 107) Upon receiving the DHCPoffer frame 302 transmitted from the DHCP server 106, the PC 111 transmits a DHCP request frame 303 requesting permission to use the IP address received from the DHCP server 106 to the DHCP server 106.

  (Step S108) The DHCP monitor unit 124 of the ONU 101 snoops the DHCP request frame 303 transmitted from the PC 111, and the ONU control unit 122 knows that the PC 111 has transmitted the DHCP request frame 303 and the MAC address of the PC 111.

  (Step S109) The DHCP monitor unit 134 of the OLT 105 snoops the DHCP request frame 303 transmitted from the PC 111, and the OLT control unit 132 knows that the PC 111 has transmitted the DHCP request frame 303 and the MAC address of the PC 111.

  (Step S <b> 110) Upon receiving the DHCP request frame 303 transmitted from the PC 111, the DHCP server 106 transmits a DHCPPack frame 304 describing an IP address permitted to the PC 111 to the PC 111.

  (Step S111) The DHCP monitor unit 134 of the OLT 105 snoops the DHCPPack frame 304 transmitted from the DHCP server 106, and the OLT control unit 132 knows that the DHCP server 106 has transmitted the DHCPPack frame 304 and the IP address of the PC 111. . Then, the MAC address and IP address of the PC 111 are registered in the authenticated terminal table storage unit 137.

  (Step S112) The DHCP monitor unit 124 of the ONU 101 snoops the DHCPPack frame 304 transmitted from the DHCP server 106, and the ONU control unit 122 knows that the DHCP server 106 has transmitted the DHCPPack frame 304 and the IP address of the PC 111. . At this time, the ONU control unit 122 knows that the user authentication of the PC 111 is completed, and associates the IP address permitted to the PC 111 with the MAC address of the PC 111 monitored in step S108, and transmits the transmission filter table storage unit. 125. Thereafter, the transmission filter unit 125 of the ONU 101 transmits all packets from the user terminal having the MAC address and the IP address stored in the transmission filter table storage unit 125.

  (Step S113) The PC 111 that has received the DHCPPack frame 304 transmitted from the DHCP server 106 can access the backbone by unicast or multicast using the permitted IP address.

  As described above, in an access network using the Ethernet-PON system, user authentication of the PC 111 of the user terminal can be performed without providing an expensive BRAS as in the prior art. Moreover, by using the Ethernet-OAM CC frame 300 transmitted / received between the ONU 101 and the OLT 105, the OLT 105 can authenticate the ONU 101, and further, the DHCP transmitted / received between the PC 111 and the DHCP server. By snooping the packet, it is possible to identify the packet of the PC 111 and permit communication to the upper network. In particular, since the ONU 101 is provided with a transmission filter unit 121 for filtering packets of the PC 111, for example, the same IP address as that of the PC 111 is set to the PC 112 that is not authenticated by the ONU 101 and connected to the ONU 101 to access the upper network. However, since the MAC address of the PC 112 is different from that of the PC 111, the packet of the PC 112 is blocked by the transparent filter 121 of the ONU 101. This is because the correspondence between the MAC address of the PC 112 and the IP address is not stored in the transparent filter table storage unit 125 of the ONU 101. In this way, unauthorized use by connecting an unauthorized terminal to the ONU 101 can be prevented.

  Similarly, when the PC 111 in which the correspondence between the IP address and the MAC address is stored in the transmission filter table storage unit 125 of the ONU 101 is connected to the ONU 102, the transmission filter table corresponding to the transmission filter table storage unit 125 of the ONU 102. Since the correspondence between the MAC address of the PC 111 and the IP address is not stored, the host network cannot be accessed. If the packet filter unit 131 of the OLT 105 checks the correspondence between the MAC address and the IP address of the PC 111 instead of the transmission filter unit 121 of each ONU, any of the ONU 101, ONU 102, or ONU 103 under the same OLT 105 is checked. Even if the PC 111 is connected to the PC, there is a problem that access to the upper network becomes possible. However, as in this embodiment, the correspondence between the MAC address of the user terminal and the IP address must be confirmed on each ONU side. Accordingly, it is possible to prevent unauthorized access to the upper network when the PC 111 is connected by moving to the ONU 102 or ONU 103 under the same OLT 105. Of course, when connected to an ONU under the control of an OLT different from the OLT 105, not only is the ONU side blocked, but also the OLT side completes user authentication for packets other than broadcast packets and the user authenticated ONU table storage unit 136. Therefore, unauthorized access to the upper network can be prevented.

  Here, the transition of the filter state of a packet transmitted from the user terminal to the upper network will be described with reference to FIG. FIG. 9 is a diagram depicting the filtering state of packets transmitted by the PCs 111, 112, and 113 of the user terminals filtered by the ONU 101, ONU 102, ONU 103, and OLT 105. Therefore, the filtering process of FIG. 9 includes the filtering process of both the transmission filter unit 121 of each ONU and the packet filter unit 131 of the OLT 105.

  Hereinafter, the transition of the filter state of FIG. 9 will be described in order.

  (Step S201) At this time, the power of each ONU is turned on, and all packets sent by the user terminal connected to each ONU are blocked (filter state). It should be noted that other than broadcast packets are blocked by the transmission filter unit of each ONU, and broadcast packets are blocked by the packet filter 131 of the OLT 105.

  In this state, each ONU periodically transmits a CC frame to the OLT 105, and the OLT 105 that has received this sends out a CC frame after confirming whether it is registered in the registered ONU table storage unit 135 in advance. Authenticate the ONU MAC address.

  (Step S202) At this time, the blocking of the broadcast packet by the packet filter 131 of the OLT 105 is released, and the DHCP packet transmitted from each user terminal is transmitted to the DHCP server 106 on the upper network side. Note that packets other than broadcast packets are still blocked by the transmission filter unit 121 of each ONU.

  In this state, each ONU monitors the DHCP request frame 303 and the DHCPPack frame 304 transmitted / received between each user terminal and the DHCP server 106, and the correspondence between each user terminal's MAC address and IP address is a transparent filter table. Register in the storage unit 125. Similarly, in the OLT 105, the DHCP request frame 303 and the DHCPPack frame 304 transmitted / received between each user terminal and the DHCP server 106 are monitored, and the correspondence between the MAC address and the IP address of each user terminal is authenticated terminal table. Register in the storage unit 137.

  In this state, if a CC frame periodically transmitted / received between each ONU and the OLT 105 is not detected by the OLT 105 within a predetermined time, the CC frame time-out is returned to the state of step S201, and user authentication is performed. Try again. Alternatively, when the OLT 105 receives a CC frame from an ONU having an unregistered MAC address in the authenticated ONU table storage unit 136 of the OLT 105, it is determined that the ONU has been replaced, and the process returns to the state of step S201, Re-authenticate.

  (Step S203) At this point, the blocking of all packets of the transmission filter 121 of each ONU is released, and further, the blocking of all packets of the packet filter 131 of the OLT 105 is also released. All cast and multicast packets are transmitted to the upper network side.

  In this state, if the CC frame periodically transmitted / received between each ONU and the OLT 105 is not detected by the OLT 105 within a predetermined time, the CC frame is timed out, and the process returns to the state of step S201 to perform user authentication again. Alternatively, when the DHCP discover frame 301 is snooping, it is determined that the power of the user terminal has been turned on again, the process returns to the state of step S201, and user authentication is performed again. Alternatively, when the OLT 105 receives a CC frame from an ONU having an unregistered MAC address in the authenticated ONU table storage unit 136 of the OLT 105, it is determined that the ONU has been replaced, and the process returns to the state of step S201, and the user Re-authenticate.

  As described above, the user authentication system 100 according to the present embodiment can provide a user authentication system in an access network using the Ethernet-PON system without using BRAS. In particular, since the ONU 101, the ONU 102, the ONU 103, the optical coupler 104, the OLT 105, and the DHCP server 106 can be used only by changing the ONU or OLT software, a user authentication system can be easily and inexpensively implemented. Can be provided.

100: User authentication system 101: ONU
102 ... ONU
103 ... ONU
104 ... Optical coupler 105 ... OLT
106: DHCP server 121 ... Transmission filter unit 122 ... ONU control unit 123 ... CC frame transmission unit 124 ... DHCP monitor unit 125 ... Transmission filter table storage unit 131 ... Packet filter Unit 132 ... OLT control unit 133 ... CC frame reception unit 134 ... DHCP monitor unit 135 ... registered ONU table storage unit 136 ... authenticated ONU table storage unit 137 ... authenticated terminal Table storage unit

JP 2001-268125 A

Claims (4)

An OLT for connecting an access from a wavelength division multiplexing PON system formed under the network to an upper network;
A plurality of ONUs connecting user terminals to the OLT;
An optical coupler that multiplexes the plurality of ONUs and connects to the OLT;
In a user authentication system in a wavelength division multiplexing PON system configured with a DHCP server that issues an IP address to the user terminal,
The ONU is
A transmission filter unit for filtering frames transmitted from the user terminal;
A periodic frame transmitting unit that periodically transmits a periodic frame including its own MAC address to the OLT;
A transmission filter table that stores the correspondence between the MAC address and IP address of the packet of the user terminal that allows the ONU to pass through the transmission filter unit;
The MAC address of the user terminal is monitored by snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server, and the IP address assigned to the user terminal is monitored by snooping of the DHCPPack frame, and the user terminal An ONU-side monitoring unit that registers the correspondence between the MAC address and the IP address in the transparent filter table ;
An ONU control unit that performs filtering control of the transmission filter unit,
The OLT is
A registered ONU table in which MAC addresses of all the ONUs installed under its own OLT are stored in advance;
And authenticated ONU table storing the ONU and the MAC address is authenticated from among the registered ONU table,
And regular frame receiving unit that receives the periodic frame sent from the ONU,
The ONU and the when the periodic frame receiving unit is MAC address of the ONU stored in the regular frame received to determine whether they meet the MAC address stored in the registered ONU table matches An authenticated ONU table registration unit for registering a MAC address in the authenticated ONU table;
A packet filter unit for filtering frames transmitted from the ONU;
The MAC address of the user terminal is monitored by snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server, and the IP address assigned to the user terminal is monitored by snooping of a DHCPPack frame, and the user terminal An OLT-side monitor unit that registers the MAC address and IP address of the device in the authenticated terminal table;
An OLT control unit that performs filtering control of the packet filter unit,
A first state in which all frames transmitted from the user terminal are not passed through an upper network, a second state in which a broadcast packet transmitted from the user terminal is passed through an upper network, and a transmission from the user terminal A third state in which all frames are passed through the upper network,
In the first state, the OLT control unit registers the MAC address of the ONU stored in the periodic frame received from the ONU after powering on the ONU in the registered ONU table and the authenticated ONU table. If not, then the broadcast packets received from the ONU to the state impervious to the upper network, the ONU control unit, in a state passing broadcast packets transmitted from the user terminal to the OLT,
In the second state, the OLT control unit receives a broadcast packet received from the ONU when the MAC address of the ONU stored in the periodic frame received from the ONU is registered in the authenticated ONU table. And the ONU control unit sets a broadcast packet transmitted from the user terminal to pass through the OLT,
In the third state, the OLT control unit, when the MAC address of the ONU stored in the regular frame received from the ONU is registered in the authenticated ONU table, and via the ONU When the MAC address and the IP address of the user terminal stored in the frame received from the user terminal match the MAC address registered in the authenticated terminal table and the IP address, receive from the user terminal When all frames are passed through an upper network, and the ONU control unit registers the MAC address and the IP address of the user terminal stored in the frame received from the user terminal in the transparent filter table , All frames received from the user terminal User authentication system, characterized by a state to pass. The user authentication system according to claim 1,
The user authentication system, wherein the periodic frame is an Ethernet-OAM CC frame. An OLT for connecting an access from a wavelength division multiplexing PON system formed under the network to an upper network;
A plurality of ONUs connecting user terminals to the OLT;
An optical coupler that multiplexes the plurality of ONUs and connects to the OLT;
In a user authentication method in a wavelength division multiplexing PON system configured with a DHCP server that issues an IP address to the user terminal,
The ONU is
A transmission filter procedure for filtering frames transmitted from the user terminal;
A periodic frame transmission procedure for periodically transmitting a periodic frame including its own MAC address to the OLT;
The MAC address of the user terminal is monitored by snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server, and the IP address assigned to the user terminal is monitored by snooping of the DHCPPack frame, and the user terminal An ONU-side monitoring procedure for registering the correspondence between the MAC address and the IP address in the transparent filter table ;
An ONU control procedure for performing filtering control of the transmission filter procedure;
Run
The OLT is
And regular frame receiving step of receiving said periodic frame sent from the ONU,
MAC address of the stored in the regular frame received ONU is stored in the registered ONU table MAC addresses of all of the ONU placed under the own OLT is stored in advance in the periodic frame reception procedure An ONU table registration procedure for determining whether or not to match the MAC address, and registering the ONU and the MAC address in the authenticated ONU table if they match,
A packet filter procedure for filtering frames sent from the ONU;
The MAC address of the user terminal is monitored by snooping of a DHCP request frame transmitted and received between the user terminal and the DHCP server, and the IP address assigned to the user terminal is monitored by snooping of a DHCPPack frame , and the user terminal An OLT-side monitoring procedure for registering the MAC address and IP address of the device in the authenticated terminal table;
An OLT control procedure for performing filtering control of the packet filter procedure;
Run
A first state in which all frames transmitted from the user terminal are not passed through an upper network, a second state in which a broadcast packet transmitted from the user terminal is passed through an upper network, and a transmission from the user terminal A third state in which all frames are passed through the upper network,
In the first state, the OLT control procedure registers the ONU MAC address stored in the periodic frame received from the ONU after the ONU is powered on in the registered ONU table and the authenticated ONU table. If not, then the broadcast packets received from the ONU to the state impervious to the upper network, the ONU control procedure in a state through a broadcast packet transmitted from the user terminal to the OLT,
In the second state, the OLT control procedure is a broadcast packet received from the ONU when the MAC address of the ONU stored in the periodic frame received from the ONU is registered in the authenticated ONU table. And the ONU control procedure sets the broadcast packet transmitted from the user terminal to pass through the OLT,
In the third state, the OLT control procedure is performed when the MAC address of the ONU stored in the periodic frame received from the ONU is registered in the authenticated ONU table and through the ONU. when matching the MAC address and the IP address, the MAC address and the IP address is registered in the authenticated terminal table of the user terminal stored in the frame received from the user terminal, wherein via the ONU All frames received from the user terminal are put through a higher-level network, and the ONU control procedure is such that the MAC address and the IP address of the user terminal stored in the frame received from the user terminal are stored in the transparent filter table. If registered, receive from the user terminal User authentication method which is characterized in that the entire frame of the state through the OLT. The user authentication method according to claim 3 , wherein
The user authentication method, wherein the periodic frame is an Ethernet-OAM CC frame.

Images