CN101127598B - A method and system for 802.1x authentication in passive optical network - Google Patents

Abstract

The invention discloses a method and system for realizing 802.1x authentication in a passive optical network. The access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to the authentication server; the authentication server authenticates the user equipment according to the received authentication message, and after the authentication is passed, sends the The authentication success message is sent to the access device in the passive optical network; the access device in the passive optical network opens a controlled port with the user equipment. The invention can ensure the realization of the 802.1x authentication process in the passive optical network, thereby realizing the legality authentication of user equipment in the passive optical network, ensuring the security of the network and improving the service quality of the business.

Description

A method and system for realizing 802.1x authentication in passive optical network

technical field

The invention relates to optical network technology, in particular to a method and system for realizing 802.1x authentication in a passive optical network (PON).

Background technique

Passive Optical Network (PON) technology is an optical access technology for point-to-multipoint transmission. FIG. 1 is a schematic diagram of a PON system. Referring to Figure 1, the PON system mainly includes: optical line terminal (OLT), optical distribution network (ODN) and optical network unit (ONU), wherein, OLT provides network side interface SNI, connected to one or more ODN; ODN is a passive optical splitter The device transmits the downlink data of the OLT to each ONU through optical branching, and transmits the uplink data of the ONUs to the OLT through aggregation.

During service transmission, in the downstream direction, the downstream traffic of the OLT is broadcast to the ONUs through time division multiplexing, and each ONU receives the required traffic as needed; in the upstream direction, multiple ONUs share the bandwidth of the same link, and the upstream traffic of the ONU The traffic is controlled by the OLT, and only a specific ONU is allowed to transmit data at the same time, and it is transmitted to the OLT through time division multiple access.

In the PON system, since the user equipment can be connected to the ONU and exchange data packets with the OLT through the ONU, unauthorized and illegal user equipment is likely to access the network through the ONU and attack the network. Therefore, in the PON system Access authentication must be performed on the accessing user equipment.

Currently, a preferred protocol for authenticating user equipment is 802.1x. 802.1x is a port-based authentication protocol, and its ultimate purpose is to determine whether a port is available. For the port connected to the user equipment, if the authentication is successful, this port is "opened" to allow all packets of the user equipment to pass through; if the authentication is unsuccessful, the port is kept "closed", that is, only the 802.1 The x authentication protocol packets are passed, but other data packets are not allowed to pass.

Figure 2 is a schematic diagram of the 802.1x architecture. Referring to Figure 2, in the 802.1x architecture, it mainly includes three parts: the requester system, the authentication system and the authentication server system, wherein the requester system is an entity located at one end of the LAN link, usually a user device that supports 802.1x authentication, The user equipment initiates 802.1x authentication by starting the client software; the authentication system is usually a network device supporting the 802.1x protocol, which provides a service port for the user equipment as the requester, and the authentication system is usually implemented by the access device in the network; The server system provides authentication services for the authentication system and realizes authentication and authorization functions.

In the 802.1x architecture, the EAPoL protocol defined by 802.1x runs between the supplicant system and the authentication system. When the authentication system works in the relay mode, the EAP protocol is also run between the authentication system and the authentication server, and the authentication data is encapsulated in the EAPoL frame, and the protocol is carried in other high-level protocols, so as to reach the authentication server through the complex network; When the authentication system works in the termination mode, the authentication system terminates the EAPoL message, converts it to other authentication protocols, and transmits the user authentication information to the authentication server system.

Each port (which may be a physical port or a logical port) of the authentication system includes controlled ports and uncontrolled ports. The uncontrolled port is always in the state of two-way connection, mainly used to transmit EAPoL protocol frame, and can guarantee to receive the EAPoL authentication message sent by the requester at any time; the controlled port is only opened when the authentication is passed, and is used to transmit network resources and Serve.

It can be seen from the above description that 802.1x provides a solution for authenticating user equipment. Therefore, the authentication process of the user equipment in the PON system can be implemented using the 802.1x authentication process. However, at present, there is no business process for implementing 802.1x authentication in the PON system, so that the legality authentication of user equipment in the PON system cannot be fundamentally guaranteed, and the security of PON system communication cannot be guaranteed.

In addition, since the PON system is a point-to-multipoint system, the entities that implement the access device function include ONU and OLT. The functions of ONU and OLT are inseparable. The bandwidth of ONU is allocated by OLT, and OLT is controlled by OAM channel. And configure part or all of the functions of the ONU, therefore, if the specific business functions of the ONU and OLT in the 802.1x authentication process are not considered, it is impossible to guarantee the realization of 802.1x authentication in the PON system.

Contents of the invention

In view of this, the first object of the present invention is to provide a method for implementing 802.1x authentication in a passive optical network, and the second object of the present invention is to provide a system for implementing 802.1x authentication in a passive optical network, To ensure the authentication of user equipment in the passive optical network and ensure the security of communication;

The third purpose of the present invention is to provide a method for reporting link information, and the fourth purpose of the present invention is to provide an ONU that reports link information of user equipment in the process of implementing 802.1x authentication in a passive optical network , to ensure the positioning of the user equipment.

In order to achieve the above object, the technical solution of the present invention is achieved in that:

A method for implementing 802.1x authentication in a passive optical network, the method comprising:

A. The access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to the authentication server; wherein the access device is an optical network unit ONU;

B. The authentication server authenticates the user equipment according to the received authentication message; after the authentication is passed, the authentication server sends an authentication success message to the access device, so that the access device opens the connection between the user equipment and the user equipment. The controlled port of the authentication server; the authentication server directly sends the service parameters corresponding to the user equipment to the ONU and the optical line terminal OLT, or sends them to the ONU and the OLT through other devices in the control layer; after receiving the service parameters, the OLT allocates the network for the ONU resources, and send the allocated network resources to the ONU;

Wherein, when the user activates the service, the user's identification is registered in the authentication server and/or other equipment of the control layer, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; After passing, the authentication server or/and other equipment of the control layer will send the identification of the ONU obtained according to the user identification to the OLT; the authentication server or/and other equipment of the control layer perform the sending according to the registered ONU and OLT identification Process; the OLT executes the sending process according to the identification of the ONU sent by the authentication server or/and other devices at the control layer;

Alternatively, the ONU receives the authentication message sent by the user equipment, and the ONU and/or OLT inserts link information into the authentication message, the link information includes the identifier of the ONU and the identifier of the OLT, and will include the link information The authentication message sent to the authentication server; the authentication server or/and other devices in the control layer execute the sending process according to the identification of the ONU and OLT obtained from the link information of the authentication message; the OLT sends the authentication message to the authentication server according to The ONU identifier obtained in the authentication message executes the sending process.

After step B, it further includes: after passing the authentication, the ONU sends an authentication success message of the EAPoL protocol to the user equipment.

The access device works in relay mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol;

In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, carries the EAP frame that encapsulates the authentication data in the authentication message Sent to the authentication server in other high-level protocols;

The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server encapsulates the authentication success message in an EAP frame, and sends it to the passive device that directly interacts with the authentication server through a high-level protocol. Access equipment in an optical network.

The access device works in termination mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol;

In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, converts the authentication message of the EAPoL protocol into the authentication of other protocols message, and then sent to the authentication server;

The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server uses the other protocol to send the authentication success message to the passive optical network that directly exchanges messages with the authentication server Access the device.

A method for implementing 802.1x authentication in a passive optical network, the method comprising:

A. The access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to the authentication server; wherein, the access device includes an optical network unit ONU and an optical line terminal OLT; the user equipment Send the authentication message to the ONU, the ONU transparently transmits the authentication message to the OLT, and the OLT sends the authentication message to the authentication server;

B. The authentication server authenticates the user equipment according to the received authentication message; after the authentication is passed, the authentication server sends an authentication success message to the OLT, and the OLT sends a connection command to the ONU after receiving the authentication success message, so that all The ONU opens the controlled port between the ONU and the user equipment; the authentication server directly sends the service parameters corresponding to the user equipment to the OLT or sends them to the OLT through other devices in the control layer; the OLT allocates network resources for the ONU, and the allocated The service parameters corresponding to network resources and user equipment are sent to ONU;

Among them, when the user opens the service, the user's identification is registered in the authentication server and/or other equipment at the control layer, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; the authentication server Or/and other devices at the control layer carry the ID of the registered ONU in the authentication success message and send it to the OLT; the OLT sends the allocated network resources and service parameters corresponding to the user equipment according to the ONU ID carried in the authentication success message The process to the ONU;

Or, the ONU receives the authentication message sent by the user equipment, inserts the link information into the authentication message as one or more Option, and sends the authentication message containing the link information to the OLT, so that the The OLT sends an authentication message containing link information to the authentication server for authentication, and the link information includes the port to which the user equipment is connected, the identifier of the OLT, and the identifier of the ONU; the authentication server or/and the control layer According to the identification of the ONU and OLT obtained from the link information of the authentication message, the other equipment in the network performs the sending process; the OLT performs the allocation of the allocated network resources according to the ONU identification obtained from the authentication message sent to the authentication server. The process of sending the service parameters corresponding to the user equipment to the ONU;

Or, after the ONU receives the authentication message, the ONU sends the location information of the authentication message and the link information of the user equipment to the OLT through the operation management and maintenance channel between the OLT and the ONU, wherein the link information Contains the identification of the ONU and the port connected to the user equipment, and the location information includes the session identification;

The OLT executes the process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU according to the received positioning information and the link information of the user equipment.

The access device works in relay mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol;

In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, carries the EAP frame that encapsulates the authentication data in the authentication message Sent to the authentication server in other high-level protocols;

The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server encapsulates the authentication success message in an EAP frame, and sends it to the passive device that directly interacts with the authentication server through a high-level protocol. Access equipment in an optical network.

The access device works in termination mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol;

In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, converts the authentication message of the EAPoL protocol into the authentication of other protocols message, and then sent to the authentication server;

The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server uses the other protocol to send the authentication success message to the passive optical network that directly exchanges messages with the authentication server Access the device.

After step B, it further includes: after passing the authentication, the OLT sends an authentication success message of the EAPoL protocol to the user equipment.

A system for implementing 802.1x authentication in a passive optical network, the system includes: user equipment, an access device in the passive optical network, and an authentication server, wherein,

The user equipment is used to send the authentication message to the access equipment in the passive optical network;

The access device in the passive optical network is used to receive the authentication message sent by the user equipment, and send the authentication message to the authentication server; wherein the access device is an optical network unit ONU;

The authentication server authenticates the user equipment according to the received authentication message;

The authentication server is further configured to send an authentication success message to the access device in the passive optical network after the authentication is passed; the access device in the passive optical network is also configured to send the authentication success message to After that, open the controlled port with the user equipment; the authentication server is also used to directly send the service parameters corresponding to the user equipment to the ONU and the optical line terminal OLT, or send them to the ONU and the OLT through other equipment in the control layer; The OLT is used to allocate network resources for the ONU after receiving the service parameters, and send the allocated network resources to the ONU;

Wherein, the authentication server is also used to register the user's identification when the user opens the service, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; , sending the ONU identifier obtained according to the user identifier to the OLT; the authentication server performs the sending process according to the registered ONU and OLT identifiers; the OLT executes the ONU identifier according to the ONU identifier sent by the authentication server the process of sending;

Or, the ONU is also used to receive the authentication message sent by the user equipment, and the ONU and/or OLT inserts link information in the authentication message, and the link information includes the identifier of the ONU and the identifier of the OLT, which will include The authentication message of the link information is sent to the authentication server; wherein, the authentication server performs the process of sending according to the identification of the ONU and the OLT obtained from the link information of the authentication message; the OLT then sends it to the authentication server according to the The ONU identifier obtained in the authentication message executes the sending process.

The ONU is further configured to send the authentication message to the authentication server through the OLT after receiving the authentication message from the user equipment.

The OLT is further configured to send the authentication message to the authentication server after receiving the authentication message from the ONU.

The OLT and the authentication server are integrated in the same physical device, or located in different physical devices.

A system for implementing 802.1x authentication in a passive optical network, the system includes: user equipment, an access device in the passive optical network, and an authentication server, wherein,

The user equipment is used to send the authentication message to the access equipment in the passive optical network;

The access device in the passive optical network is used to receive the authentication message sent by the user equipment, and send the authentication message to the authentication server; wherein, the access device includes an optical network unit ONU and an optical line terminal OLT; the The user equipment sends the authentication message to the ONU, the ONU transparently transmits the authentication message to the OLT, and the OLT sends the authentication message to the authentication server;

The authentication server authenticates the user equipment according to the received authentication message;

The authentication server is also used to send an authentication success message to the OLT after the authentication is passed; it is also used to directly send the service parameters corresponding to the user equipment to the OLT or send it to the OLT through other devices at the control layer;

The OLT is used to send a connection command to the ONU after receiving the authentication success message, so that the ONU opens a controlled port with the user equipment; it is also used to allocate network resources for the ONU, and the allocated The network resources and service parameters corresponding to the user equipment are sent to the ONU;

Wherein, the authentication server is also used to register the user's identification when the user opens the service, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; The identification of the ONU is carried in the successful authentication message and sent to the OLT; the OLT performs the process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU according to the ONU identification carried in the successful authentication message;

Or, the ONU is also configured to receive an authentication message sent by the user equipment, insert link information into the authentication message as one or more Option, and send the authentication message containing the link information to the OLT, to making the OLT send an authentication message containing link information to the authentication server for authentication, the link information including the port connected to the user equipment, the OLT identifier and the ONU identifier; the authentication server It is also used to perform the sending process according to the ONU and OLT identifiers obtained from the authentication message link information; the OLT is used to perform the sending process according to the ONU identifier obtained from the authentication message sent to the authentication server. The process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU.

The ONU is further configured to send the authentication message to the authentication server through the OLT after receiving the authentication message from the user equipment.

The OLT is further configured to send the authentication message to the authentication server after receiving the authentication message from the ONU.

The OLT and the authentication server are integrated in the same physical device, or located in different physical devices.

It can be seen that the present invention provides a complete business process for realizing 802.1x authentication in the passive optical network, therefore, it can fundamentally ensure the legality authentication of the user equipment in the PON system and ensure the security of the PON system communication sex.

In addition, the present invention provides the specific service functions respectively completed by the ONU and the OLT as the access equipment in the 802.1x authentication process. Wherein, when only the ONU is used as the authentication system, the present invention realizes the authentication of the user equipment at the place closest to the user equipment, therefore, the security of the authentication process can be improved, and illegal users can be prevented from occupying the bandwidth resources of the PON system; When the ONU and the OLT are used as authentication systems at the same time, the present invention realizes the centralized authentication processing by the OLT without the need for each ONU to perform authentication processing separately, thereby reducing the cost of the PON system and improving the bandwidth efficiency of the PON system.

In the present invention, it is further proposed to report the link information of the user equipment including the identification of the ONU and the OLT through the 802.1x authentication process, so that the authentication server obtains the location information of the ONU and the OLT, and the OLT obtains the location information of the ONU , to ensure that various authentication information can be issued accurately, and to ensure that the OLT can issue the network resources allocated for the ONU, thereby ensuring that the user equipment can access network resources through the PON system.

Description of drawings

FIG. 1 is a schematic diagram of a PON system.

Figure 2 is a schematic diagram of the 802.1x architecture.

FIG. 3 is a schematic diagram of a basic structure of a system for implementing 802.1x authentication in a passive optical network in the present invention.

FIG. 3A is a schematic diagram of the system structure when the access device in the passive optical network is an ONU in the present invention.

Fig. 3B is a schematic diagram of the system structure when the access devices in the passive optical network include ONU and OLT in the present invention.

Fig. 4 is a flow chart of implementing 802.1x authentication in the passive optical network when the ONU is used as the authentication system in the present invention.

Fig. 5 is a flow chart of realizing 802.1x authentication in the passive optical network when the ONU and the OLT are jointly used as the authentication system in the present invention.

Detailed ways

The present invention proposes a method for realizing 802.1x authentication in a passive optical network, the core idea of which is: the access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to Authentication server; the authentication server authenticates the user equipment according to the received authentication message, and sends an authentication success message to the access equipment in the passive optical network after the authentication is passed; the access equipment in the passive optical network opens and communicates with Controlled ports between user devices.

Wherein, the access device in the passive optical network that completes the authentication system function may be an ONU; or, the access device in the passive optical network that completes the authentication system function may include an ONU and an OLT.

Correspondingly, the present invention also proposes a system for realizing 802.1x authentication in the passive optical network. FIG. 3 is a schematic diagram of a basic structure of a system for implementing 802.1x authentication in a passive optical network in the present invention. Referring to FIG. 3, the basic structure of the system of the present invention includes: user equipment, access equipment in the passive optical network, and an authentication server, wherein,

The user equipment is used to send the authentication message to the access equipment in the passive optical network;

The access device in the passive optical network is used to receive the authentication message sent by the user equipment, send the authentication message to the authentication server, and open the controlled port with the user equipment after receiving the authentication success message; The authentication server authenticates the user equipment according to the received authentication message, and sends an authentication success message to the access equipment in the passive optical network after the authentication is passed.

FIG. 3A is a schematic diagram of the system structure when the access device in the passive optical network is an ONU in the present invention. Referring to FIG. 3A , in the system of the present invention, the access device in the passive optical network that completes the authentication system function may be an ONU.

Fig. 3B is a schematic diagram of the system structure when the access devices in the passive optical network include ONU and OLT in the present invention. Referring to FIG. 3B, in the system of the present invention, the access device in the passive optical network that completes the authentication system function may include ONU and OLT, wherein,

The ONU is used to transmit the received authentication message of the user equipment to the OLT, and after receiving the connection command of the OLT, open the controlled port with the user equipment;

The OLT is configured to send the received authentication message to the authentication server, and after receiving the authentication success message, send the connection message to the ONU.

In order to further ensure that after the authentication is successful, the user can access network resources through the PON system, in the present invention, the OLT obtains the identifier of the ONU, and according to the acquired identifier of the ONU, assigns the allocated network resources, such as bandwidth and priority, to sent to the ONU.

Referring to FIG. 3A and FIG. 3B , in the present invention, the OLT and the authentication server of the PON system can be integrated in the same physical device, or can be located in different physical devices.

In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

Fig. 4 is a flow chart of implementing 802.1x authentication in the passive optical network when the ONU is used as the authentication system in the present invention. Referring to Fig. 3 A and Fig. 4, in the present invention, since ONU is the access device in the PON system, so ONU can complete the authentication system function in the 802.1x architecture, at this moment, realize the process of 802.1x authentication in the PON system Include the following steps:

Step 401: the user equipment carries the authentication information in the authentication message of the EAPoL protocol and sends it to the ONU.

Step 402: After receiving the authentication message of the EAPoL protocol, the ONU sends the authentication message to the authentication server through the OLT.

Step 403: After receiving the authentication message, the authentication server authenticates the user equipment according to the authentication information carried in the authentication message.

Step 404: The authentication server judges whether the authentication is successful, if yes, execute step 405, otherwise, end the current process.

Step 405: the authentication server sends an authentication success message to the ONU through the OLT.

In the present invention, ONU can work in relay mode or termination mode,

When the ONU works in the relay mode, in the above step 402, after the ONU receives the authentication message of the EAPoL protocol, the EAP frame that encapsulates the authentication data in the authentication message is carried in other high-level protocols, such as the Radius protocol, and then Send to the authentication server through the OLT; in the above step 405, the authentication server encapsulates the authentication success message in the EAP frame, and sends it to the ONU through the OLT through a high-level protocol such as the Radius protocol.

When the ONU works in the termination mode, in step 402, after the ONU receives the authentication message of the EAPoL protocol, it converts the authentication message of the EAPoL protocol into other protocols such as the authentication message of the Radius protocol, and then sends it to the authentication message by the OLT. Server; in the above step 405, the authentication server sends the authentication success message to the ONU through the OLT by using other protocols such as the Radius protocol.

Step 406: After receiving the authentication success message, the ONU performs opening of the controlled port between itself and the user equipment and other related business processes.

Here, after the ONU opens the controlled port between itself and the user equipment, the user equipment is allowed to access network resources or services through the PON system.

In addition, the other related service processing may be processing such as binding the opened controlled port to a user equipment identifier such as a MAC (Media Access Control) address.

Step 407: the ONU sends an authentication success message of the EAPoL protocol to the user equipment.

In order to further ensure that the user equipment can access network resources through the PON system after passing the authentication, corresponding uplink resources must be allocated to the user equipment in the ONU. Therefore, in the process shown in FIG. 4 above, in step 405, the authentication server and/or other devices at the control layer may further carry the service parameters corresponding to the user equipment in the authentication success message or carry it in other messages and send it to the ONU and, after successful authentication in step 404, the authentication server can directly send the service parameters corresponding to the user equipment to the OLT or send them to the OLT through other equipment at the control layer, and after receiving the service parameters, the OLT will allocate corresponding Network resources, such as bandwidth and service level, etc., and send the allocated network resources to the ONU. After that, the user equipment can send the data message to the PON network through the controlled port opened on the ONU to complete the access to the corresponding network resources.

Among them, since a PON interface of the OLT is shared by multiple ONUs, one ONU may be shared by multiple users through physical or logical ports, and when realizing the allocation of network resources for the ONU, the authentication server and/or other servers in the control layer ( Such as policy server, resource management server) needs to send the service parameters corresponding to the user equipment to ONU and OLT, and OLT needs to send the allocated network resources to ONU, so the authentication server and/or other servers in the control layer (such as policy server, The resource management server) needs to obtain the identification of the ONU and the OLT in advance, and the OLT needs to obtain the identification of the ONU in advance.

In the present invention, when the 802.1x authentication is realized in the passive optical network by the ONU as the authentication system, the authentication server is made to obtain the identification of the ONU and the OLT, and the process for the OLT to obtain the identification of the ONU includes the following three implementations:

Method 1. When the user opens the service, register the user's identification on the authentication server side, which may include the identification of the ONU connected to the user equipment, the connected port, the identification of the OLT, etc.; after the authentication is successful, the authentication server according to the registration Obtain the location of the OLT and the identifier of the ONU to which the user is connected, and perform the above-mentioned process of sending the service parameters corresponding to the user equipment to the ONU according to the acquired identifier of the ONU; The identification of the OLT, the identification of the ONU is directly sent to the OLT or sent to the OLT through other devices in the control layer, so that the OLT obtains the identification of the corresponding ONU, thereby completing the above process of sending the allocated network resources to the ONU.

In mode 1, after the service is opened, the user cannot move, and the user can pass the authentication only by connecting to the ONU registered when the service is opened.

Mode 2. During the authentication process, when the user equipment, ONU and the authentication server interact, the ONU and/or OLT inserts link information in the authentication message sent by the user equipment to the authentication server, and the link information includes the ONU's identification , the identification or IP address of OLT, etc., wherein, can insert all link information by ONU; Or OLT inserts all link information; , the port to which the authentication device is requested, the link information inserted by the OLT includes the identifier or address of the OLT, and the identifier of the PON interface receiving the authentication message), and the authentication server can know the OLT according to the link information in the received authentication message and the identity of the ONU.

In the second method, the specific implementation of ONU inserting link information in the authentication message includes:

In the above-mentioned process shown in Figure 4, after the ONU receives the authentication message of the EAPoL protocol sent by the user equipment, the link information (including the connected port and the ONU identifier) of the user equipment requesting authentication is used as the EAPoL protocol One or more options (options) in the authentication message or one or more options as a high-level protocol (such as the Radius protocol) are passed to the authentication server,

Among them, when the ONU works in the relay mode, if the ONU uses the link information as one or more Option of the authentication message of the EAPoL protocol, the ONU first inserts the link of the user equipment requesting authentication in the authentication message of the EAPoL protocol. Then the authentication message of the EAPoL protocol inserted with the link information is carried in the high-level protocol and passed to the authentication server; if the ONU uses the identification as one or more Option of the high-level protocol (such as Radius), the ONU will receive The authentication message of the received EAPoL protocol is carried in the high-level protocol, and the link information of the user equipment requesting authentication is directly inserted into the Option of one or more bearer identifiers of the high-level protocol;

When the ONU works in the termination mode, the ONU converts the received EAPoL protocol authentication message into a high-layer protocol message (such as Radius), and inserts the link information of the user equipment requesting authentication into the Option of the bearer identifier of the high-layer protocol .

In the second method, the specific implementation of the OLT inserting link information in the authentication message includes:

The OLT can act as an agent or relay of a high-level protocol (such as a Radius protocol proxy or relay), monitor the high-level protocol message (such as a Radius message) received by the PON interface, and link information (including the identification or address of the OLT, the PON Interface identifier, etc.) are inserted into high-level protocol packets (such as Radius protocol packets) as Option.

Mode 3, the authentication process, after the ONU detects that the user port receives the authentication message of the EAPoL protocol, the location information of the authentication message of the EAPoL protocol (such as the identification of the user equipment in the session identifier or the authentication message of the EAPoL protocol, such as MAC address) and the link information of the user equipment (including the identification of the ONU, the port to which the user equipment is connected) are sent to the OLT through the OAM (operation, management and maintenance) channel (such as the OMCI channel of the GPON protocol) between the OLT and the ONU.

Fig. 5 is a flow chart of realizing 802.1x authentication in the passive optical network when the ONU and the OLT are jointly used as the authentication system in the present invention. Referring to Fig. 3B and Fig. 5, in the present invention, since both ONU and OLT are the access devices in the PON system, so ONU and OLT can jointly complete the authentication system function in the 802.1x architecture, at this moment, in the PON system The process of implementing 802.1x authentication includes the following steps:

Step 501: the user equipment carries the authentication information in the authentication message of the EAPoL protocol and sends it to the ONU.

Step 502: The ONU transparently transmits the received authentication message of the EAPoL protocol to the OLT.

Step 503: After receiving the authentication packet of the EAPoL protocol, the OLT sends the authentication packet to the authentication server.

Step 504: After receiving the authentication message, the authentication server authenticates the user equipment according to the authentication information carried in the authentication message.

Step 505: The authentication server judges whether the authentication is successful, if yes, execute step 506, otherwise, end the current process.

Step 506: the authentication server sends an authentication success message to the OLT.

In the present invention, OLT can work in relay mode or termination mode,

When the OLT works in the relay mode, in the above step 503, after receiving the authentication message of the EAPoL protocol, the OLT carries the EAP frame encapsulating the authentication data in other high-level protocols, such as the Radius protocol, and then sends it to the authentication server ; In the above step 506, the authentication server encapsulates the authentication success message in an EAP frame, and sends it to the OLT through a high-level protocol such as the Radius protocol.

When OLT was working in termination mode, in step 503, after OLT received the authentication message of EAPoL protocol, the authentication message of this EAPoL agreement was converted into other protocols such as the authentication message of Radius protocol, and then sent to the authentication server; In the above step 506, the authentication server sends authentication success information to the OLT by using other protocols such as the Radius protocol.

Step 507: After receiving the authentication success message, the OLT sends a connection command to the ONU.

Step 508: After receiving the connection command, the ONU performs opening of the controlled port between itself and the user equipment and other related business processing.

Here, after the OLT opens the controlled port between itself and the user equipment, it allows the user equipment to access network resources or services through the PON system.

In addition, the other related service processing may be processing such as binding the opened controlled port with the user equipment.

Step 509: the OLT sends an authentication success message of the EAPoL protocol to the ONU.

Step 510: the ONU sends an authentication success message of the EAPoL protocol to the user equipment.

In order to further ensure that the user equipment can access network resources through the PON system after passing the authentication, corresponding uplink resources must be allocated to the user equipment in the ONU. Therefore, in the process shown in FIG. 5 above, in step 506, the authentication server and/or other devices at the control layer may further carry the service parameters corresponding to the user equipment in the authentication success message and send it to the OLT; the OLT receives the user equipment After corresponding service parameters, allocate corresponding PON network resources for the ONU, such as bandwidth and service level, etc., and then send the allocated network resources and service parameters corresponding to the user equipment to the ONU. After that, the user equipment can send the data message to the PON network through the controlled port opened on the ONU to complete the access to the corresponding network resources.

Among them, since a PON interface of the OLT is shared by multiple ONUs, and one ONU may be shared by multiple users through physical or logical ports, and when realizing the allocation of network resources for the ONU, the OLT needs to send the allocated network resources to the ONU. Therefore, the OLT needs to obtain the identifier of the ONU in advance. In addition, preferably, the link information of the user equipment can also be sent to the authentication server, so that the authentication server can also obtain the link information of the user equipment.

In the present invention, when the 802.1x authentication is realized in the passive optical network by the ONU and the OLT jointly as the authentication system, the process that makes the OLT obtain the mark of the ONU includes the following three implementations:

Mode A, when the user activates the service, register the user's identification (including the identification of the ONU connected to the user equipment, the connected port, the identification of the OLT connected, etc.) at the authentication server side. During authentication, the authentication server can obtain the identification of the ONU and OLT connected to the user according to the registered user identification, and the authentication server can send the obtained identification of the ONU connected to the user to the OLT, so that the OLT obtains the identification of the ONU, thereby completing The process of sending the allocated network resources to the ONU.

In mode A, after the service is opened, the user cannot move, and the user can pass the authentication only by connecting to the ONU registered when the service is opened.

Mode B, authentication process, after the ONU snoops the user port and receives the authentication message of the EAPoL agreement, the location information of the authentication message of the EAPoL agreement (such as the identification of the user equipment in the authentication message of the session identification or the EAPoL agreement, such as MAC address) and the link information of the user equipment (including the identification of the ONU, the port to which the user equipment is connected) are sent to the OLT through the OAM (operation, management and maintenance) channel (such as the OMCI channel of the GPON protocol) between the OLT and the ONU.

Mode C, during the authentication process, when user equipment, ONU and OLT, and authentication server interact, ONU or OLT can insert link information (including the identification of ONU, OLT's ID or IP address, etc.), the authentication server can learn the location of the OLT from the link information in these packets.

Wherein, the method of ONU inserting link information is: ONU listens to the authentication message of EAPoL protocol that the port connected with user equipment receives, and uses the link information (comprising connected port, ONU identification) of requesting authentication user equipment as EAPoL One or more options (options) of the authentication message of the protocol are inserted in the authentication message of the EAPoL protocol received by the port connected to the user equipment. After the authentication message of the EAPoL protocol with link information arrives at the OLT, the OLT can Obtain the link information of the user equipment from the Option carrying link information in the authentication message of the EAPoL protocol, determine the ONU connected to the user, and complete the subsequent process of allocating network resources. According to needs, the OLT may further associate and store the link information of the user equipment and the session identifier of the authentication message locally. The OLT can remove or retain the link information inserted by the ONU in the authentication message of the EAPoL protocol as required, and then transmit the authentication message to the authentication server in a relay mode or a termination mode. The OLT may also insert link information (such as the identifier of the OLT and the PON port) into the authentication message sent to the authentication server as required. If there is link information in the authentication message, the authentication server can obtain the link information of the user equipment requesting authentication from the authentication message, and pass it to other servers (such as a server providing policy services or a resource management server).

After passing the authentication, the authentication server needs to carry the link information in the authentication success message and send it to the OLT. After the OLT receives the authentication success message sent by the authentication server, the OLT obtains the link information of the user equipment according to the user link information in the authentication success message. The path information (such as the identification of the ONU connected to the user, the port connected to the user equipment) determines the ONU connected to the user, so as to complete the subsequent process of allocating network resources. This processing procedure corresponds to method A, and optionally, may also correspond to method B and method C. In the above method B, the authentication server may not carry the link information in the authentication success message. In this way, the OLT can obtain the user's ID from the locally saved association information of the session identifier and the user identifier according to the session identifier in the authentication success message. Identification (such as the identification of the ONU connected to the user, the port connected to the user equipment), to determine the ONU connected to the user, so as to complete the subsequent process of allocating network resources.

In the present invention, the ONU mentioned above can also be recorded as ONT, both of which refer to optical network units.

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (16)

1. A method for realizing 802.1x authentication in a passive optical network, characterized in that the method comprises: A. The access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to the authentication server; wherein the access device is an optical network unit ONU; B. The authentication server authenticates the user equipment according to the received authentication message; after the authentication is passed, the authentication server sends an authentication success message to the access device, so that the access device opens the connection between the user equipment and the user equipment. The controlled port of the authentication server; the authentication server directly sends the service parameters corresponding to the user equipment to the ONU and the optical line terminal OLT, or sends them to the ONU and the OLT through other devices in the control layer; after receiving the service parameters, the OLT allocates the network for the ONU resources, and send the allocated network resources to the ONU; Wherein, when the user activates the service, the user's identification is registered in the authentication server and/or other equipment of the control layer, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; After passing, the authentication server or/and other equipment at the control layer will send the ONU identification obtained according to the user identification to the OLT; the authentication server or/and other equipment at the control layer will correspond the user equipment to the The business parameters of the ONU are sent to the ONU and the OLT; the OLT performs the sending process according to the identification of the ONU sent by the authentication server or/and other equipment at the control layer; Or, the ONU receives the authentication message sent by the user equipment, and the ONU and/or OLT inserts the link information in the authentication message, the link information includes the identification of the ONU and the identification of the OLT, and will include the link information The authentication message of the authentication message is sent to the authentication server; the authentication server or/and other devices in the control layer execute the sending process according to the identification of the ONU and the OLT obtained from the link information of the authentication message; the OLT sends it to the authentication server according to the The ONU identifier obtained in the authentication message executes the sending process. 2. The method according to claim 1, characterized in that, after step B, further comprising: after passing the authentication, the ONU sends an authentication success message of the EAPoL protocol to the user equipment. 3. The method according to claim 1, wherein the access device works in a relay mode; the authentication message sent by the user equipment is an authentication message of the EAPoL protocol; In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, carries the EAP frame that encapsulates the authentication data in the authentication message Sent to the authentication server in other high-level protocols; The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server encapsulates the authentication success message in an EAP frame, and sends it to the passive device that directly interacts with the authentication server through a high-level protocol. Access equipment in an optical network. 4. The method according to claim 1, wherein the access device works in a termination mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol; In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, converts the authentication message of the EAPoL protocol into the authentication of other protocols message, and then sent to the authentication server; The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server uses the other protocol to send the authentication success message to the passive optical network that directly exchanges messages with the authentication server Access the device. 5. A method for realizing 802.1x authentication in a passive optical network, characterized in that the method comprises: A. The access device in the passive optical network receives the authentication message sent by the user equipment, and sends the authentication message to the authentication server; wherein, the access device includes an optical network unit ONU and an optical line terminal OLT; the user equipment Send the authentication message to the ONU, the ONU transparently transmits the authentication message to the OLT, and the OLT sends the authentication message to the authentication server; B. The authentication server authenticates the user equipment according to the received authentication message; after the authentication is passed, the authentication server sends an authentication success message to the OLT, and the OLT sends a connection command to the ONU after receiving the authentication success message, so that all The ONU opens the controlled port between the ONU and the user equipment; the authentication server directly sends the service parameters corresponding to the user equipment to the OLT or sends them to the OLT through other devices in the control layer; the OLT allocates network resources for the ONU, and the allocated The service parameters corresponding to network resources and user equipment are sent to ONU; Wherein, when the user activates the service, the user's identification is registered in the authentication server and/or other equipment at the control layer, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; the authentication server Or/and other devices at the control layer carry the registered ONU identifier in the authentication success message and send it to the OLT; the OLT executes sending the allocated network resources and the service parameters corresponding to the user equipment according to the ONU identifier carried in the authentication success message The process to the ONU; Or, the ONU receives the authentication message sent by the user equipment, inserts the link information into the authentication message as one or more Option, and sends the authentication message containing the link information to the OLT, so that the The OLT sends the authentication message containing the link information to the authentication server for authentication, and the link information includes the port connected to the user equipment, the identifier of the OLT, and the identifier of the ONU; the authentication server or/and the control layer According to the identification of the ONU and OLT obtained from the link information of the authentication message, the other equipment of the user equipment sends the service parameters corresponding to the user equipment to the ONU and the OLT; the OLT executes according to the ONU identification obtained from the authentication message sent to the authentication server The process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU; Or, after the ONU receives the authentication message, the ONU sends the location information of the authentication message and the link information of the user equipment to the OLT through the operation management and maintenance channel between the OLT and the ONU, wherein the link information Contains the identification of the ONU and the port connected to the user equipment, and the location information includes the session identification; The OLT executes the process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU according to the received positioning information and the link information of the user equipment. 6. The method according to claim 5, wherein the access device works in a relay mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol; In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, carries the EAP frame that encapsulates the authentication data in the authentication message Sent to the authentication server in other high-level protocols; The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server encapsulates the authentication success message in an EAP frame, and sends it to the passive device that directly interacts with the authentication server through a high-level protocol. Access equipment in an optical network. 7. The method according to claim 5, wherein the access device works in a termination mode; the authentication packet sent by the user equipment is an authentication packet of the EAPoL protocol; In step A, the step of sending the authentication message to the authentication server includes: the access device in the passive optical network that directly exchanges messages with the authentication server, converts the authentication message of the EAPoL protocol into the authentication of other protocols message, and then sent to the authentication server; The step of sending the authentication success message to the access device in the passive optical network includes: the authentication server uses the other protocol to send the authentication success message to the passive optical network that directly exchanges messages with the authentication server Access the device. 8. The method according to claim 5, further comprising: after step B, the OLT sends an authentication success message of the EAPoL protocol to the user equipment after the authentication is passed. 9. A system for implementing 802.1x authentication in a passive optical network, characterized in that the system includes: user equipment, an access device in a passive optical network, and an authentication server, wherein, The user equipment is used to send the authentication message to the access equipment in the passive optical network; The access device in the passive optical network is used to receive the authentication message sent by the user equipment, and send the authentication message to the authentication server; wherein the access device is an optical network unit ONU; The authentication server authenticates the user equipment according to the received authentication message; The authentication server is further configured to send an authentication success message to the access device in the passive optical network after the authentication is passed; the access device in the passive optical network is also configured to send the authentication success message to After that, open the controlled port with the user equipment; the authentication server is also used to directly send the service parameters corresponding to the user equipment to the ONU and the optical line terminal OLT, or send them to the ONU and the OLT through other equipment in the control layer; The OLT is used to allocate network resources for the ONU after receiving the service parameters, and send the allocated network resources to the ONU; Wherein, the authentication server is also used to register the user's identification when the user opens the service, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; , sending the identifier of the ONU obtained according to the user identifier to the OLT; the authentication server sends the service parameters corresponding to the user equipment to the ONU and the OLT according to the identifiers of the registered ONU and OLT; The identification of the ONU sent carries out the process of sending; Or, the ONU is also used to receive the authentication message sent by the user equipment, and the ONU and/or OLT inserts link information in the authentication message, and the link information includes the identifier of the ONU and the identifier of the OLT, which will include The authentication message of the link information is sent to the authentication server; wherein, the authentication server performs the process of sending according to the identification of the ONU and the OLT obtained from the link information of the authentication message; the OLT then sends it to the authentication server according to the The ONU identifier obtained in the authentication message executes the sending process. 10. The system according to claim 9, wherein the ONU is further configured to send the authentication message to the authentication server through the OLT after receiving the authentication message from the user equipment. 11. The system according to claim 9, wherein the OLT is further configured to send the authentication message to the authentication server after receiving the authentication message from the ONU. 12. The system according to claim 9, wherein the OLT and the authentication server are integrated in the same physical device, or located in different physical devices. 13. A system for implementing 802.1x authentication in a passive optical network, characterized in that the system includes: user equipment, an access device in a passive optical network, and an authentication server, wherein, The user equipment is used to send the authentication message to the access equipment in the passive optical network; The access device in the passive optical network is used to receive the authentication message sent by the user equipment, and send the authentication message to the authentication server; wherein, the access device includes an optical network unit ONU and an optical line terminal OLT; the The user equipment sends the authentication message to the ONU, the ONU transparently transmits the authentication message to the OLT, and the OLT sends the authentication message to the authentication server; The authentication server authenticates the user equipment according to the received authentication message; The authentication server is also used to send an authentication success message to the OLT after the authentication is passed; it is also used to directly send the service parameters corresponding to the user equipment to the OLT or send it to the OLT through other devices at the control layer; The OLT is used to send a connection command to the ONU after receiving the authentication success message, so that the ONU opens a controlled port with the user equipment; it is also used to allocate network resources for the ONU, and the allocated The network resources and service parameters corresponding to the user equipment are sent to the ONU; Wherein, the authentication server is also used to register the user's identification when the user opens the service, which includes the identification of the ONU connected to the user equipment, the port of the connected ONU, and the identification of the OLT; The identification of the ONU is carried in the successful authentication message and sent to the OLT; the OLT performs the process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU according to the ONU identification carried in the successful authentication message; Or, the ONU is also configured to receive an authentication message sent by the user equipment, insert link information into the authentication message as one or more Option, and send the authentication message containing the link information to the OLT, to making the OLT send an authentication message containing link information to the authentication server for authentication, the link information including the port connected to the user equipment, the OLT identifier and the ONU identifier; the authentication server It is also used to send the service parameters corresponding to the user equipment to the ONU and OLT according to the identification of the ONU and OLT obtained from the link information of the authentication message; The obtained ONU identifier performs a process of sending the allocated network resources and service parameters corresponding to the user equipment to the ONU. 14. The system according to claim 13, wherein the ONU is further configured to send the authentication message to the authentication server through the OLT after receiving the authentication message from the user equipment. 15. The system according to claim 13, wherein the OLT is further configured to send the authentication message to the authentication server after receiving the authentication message from the ONU. 16. The system according to claim 13, wherein the OLT and the authentication server are integrated in the same physical device, or located in different physical devices.