CN1855813A - Verificating method and device - Google Patents

Verificating method and device Download PDF

Info

Publication number
CN1855813A
CN1855813A CN 200510066528 CN200510066528A CN1855813A CN 1855813 A CN1855813 A CN 1855813A CN 200510066528 CN200510066528 CN 200510066528 CN 200510066528 A CN200510066528 A CN 200510066528A CN 1855813 A CN1855813 A CN 1855813A
Authority
CN
China
Prior art keywords
user terminal
authentication
information
positional information
terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN 200510066528
Other languages
Chinese (zh)
Other versions
CN100583760C (en
Inventor
高海
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CN200510066528A priority Critical patent/CN100583760C/en
Publication of CN1855813A publication Critical patent/CN1855813A/en
Application granted granted Critical
Publication of CN100583760C publication Critical patent/CN100583760C/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Abstract

The key-ideal of the invention is: getting the location information about user end; in term of the obtained location information and predetermined location information corresponding to the user end, making authentication for the use end. The invention uses parameters currently existed in PON technology such as RTT value used in the authentication process for user end in order to provide security protection for legal user end and avoid the usage of network resource by illegal user end.

Description

A kind of implementation method of authentication and device
Technical field
The present invention relates to the network communications technology field, be specifically related to a kind of implementation method and device of authentication.
Background technology
In broadband access network, the bandwidth capacity of the SONET/SDH/GE of metro core net, metro edge net (synchronous optical network/synchronous digital hierarchy/gigabit) is very abundant, and partly there is serious bandwidth bottleneck problem in Access Network.
Compare with cable transmission, Optical Fiber Transmission has advantages such as capacity is big, loss is little, anti-electromagnetic interference capability is strong, and along with the progressively decline of Optical Fiber Transmission cost, the fiberize of Access Network part is the inexorable trend of Access Network development.
Representing the access network segment of " last kilometer ", needing Ultra Low Cost, simple structure and be convenient to characteristics such as realizations, this specific implementation to Access Network has been brought very big challenge.PON (EPON) is to realize the most potential technology in the broadband light Access Network owing to adopt passive device.
The structural representation of EPON as shown in Figure 1.
In Fig. 1, EPON generally includes: to be positioned at the OLT (optical line terminal) of CO (central office), a series of ONT/ONU (network unit/optical network terminal) that is positioned at user resident be the PON user terminal, the ODN (optical distribution network) that is made of optical fiber, passive optical splitters or coupler between OLT and ONT/ONU.
The PON network can be pulled out simple optical fiber to the broadband services subarea or the office garden from service exchange, and then isolates some branch roads with passive optical splitters or coupler on each building or business device from main fiber.This mode can make a plurality of PON user terminals share the relatively costly optical fiber link of this section from exchange to the user resident, thereby has greatly reduced Fiber-To-The-Building (FTTB) and the use cost that Fiber to the home (FTTH).
In order effectively to manage the PON user terminal among the PON, prevent that illegal PON user terminal from using Internet resources, the PON user terminal need authenticate at the terminal OLT device place before using Internet resources usually.
At present, the method that user terminal is authenticated is a lot, mainly comprises following two kinds.
Method one: operator writes authentication information the PON user terminal when user terminal is opened an account, like this, the PON user terminal at the beginning of powering at every turn, after the registration process of finishing PON agreement regulation, usually can initiate a verification process from the trend terminal OLT device, be that the PON user terminal reads the authentication information of its storage inside and sends to terminal OLT device,, then allow this PON user terminal online if authentication is passed through; Otherwise, forbid this PON user terminal online.
Method two: when operator opens an account at the PON user terminal, authentication information is directly offered the user.By computer input authentication information, computer passes to the PON user terminal by ethernet link etc. with authentication information to the user before each online, and the PON user terminal initiates to authenticate to terminal OLT device according to the authentication information of this input again.
In above-mentioned present authentication method, the authentication information of PON user terminal mainly comprises: MAC Address, sequence number, user name, password etc., or the combination in any of each element.If the PON user terminal is stolen, perhaps authentication information is illegally read and copies on another PON user terminal by other people, and the authentication information that perhaps needs the user to import is given away secrets, and other people just can usurp the right online of normal users so.
Thereby existing authentication method mainly depends on the confidentiality of authentication information, makes authenticating safety poor.
Summary of the invention
The objective of the invention is to, a kind of implementation method and device of authentication is provided, utilize the positional information of user terminal to authenticate, to realize improving the purpose of authentication security.
For achieving the above object, technical scheme provided by the invention comprises:
A kind of implementation method of authentication comprises:
A, obtain the positional information of user terminal;
B, this user terminal is authenticated according to the precalculated position information of the described positional information of obtaining, this user terminal correspondence.
Described step b specifically comprises:
Whether the difference of judging the precalculated position information that the described positional information of obtaining is corresponding with this user terminal mates in the predetermined difference value scope;
If coupling determines that this user terminal is the legal users terminal, authentication success;
If do not match, determine that this user terminal is illegal user terminal, authentification failure.
Described step b specifically comprises:
Whether the difference of judging the precalculated position information that predetermined authentication information coupling that authentication information that user terminal transmission comes is whether corresponding with this user terminal and the described positional information of obtaining and this user terminal are corresponding mates in the predetermined difference value scope;
If the predetermined authentication information that the authentication information that user terminal transmission comes is corresponding with this user terminal is mated and the difference of the precalculated position information that the described positional information of obtaining and this user terminal are corresponding is mated in the predetermined difference value scope, determine that this user terminal is the legal users terminal, authentication success;
Otherwise, determine that this user terminal is illegal user terminal, authentification failure.
The step of described authentification failure also comprises:
Refuse described user terminal and use Internet resources; And/or
Produce the warning information that described user terminal location moves.
Described positional information comprises: reciprocal time.
Also comprise before the described step a:
The transfer of data length that each user terminal and local side apparatus are set differs predetermined length at least.
Described local side apparatus comprises: the optical line terminal equipment of local side.
Described method also comprises:
Revise the precalculated position information of user terminal correspondence as required.
A kind of implement device of authentication comprises:
Obtain the positional information module: obtain the positional information of user terminal, and transfer to authentication module;
Authentication module: the precalculated position information according to the described positional information of obtaining, its user terminals stored correspondence authenticates this user terminal.
Described device also comprises:
Modified module: the precalculated position information of revising user terminals stored correspondence in the described authentication module.
Description by technique scheme as can be known, the present invention makes full use of existing parameter in the PON technology, as the RTT value, with the verification process of RTT value in conjunction with user terminal, legal user terminal is given safeguard protection, got rid of the situation that potential disabled user's terminal embezzlement validated user terminal is used Internet resources; Because the RTT value all can conveniently obtain, make simple, the easily realization of authentication method of the present invention in each PON technology; By only authenticating, or RTT value and other authentication informations combined realize authentication, authentication method of the present invention is realized flexibly according to the RTT value; Thereby realized improving the purpose of PON network user terminals authentication security by technical scheme provided by the invention.
Description of drawings
Fig. 1 is the structural representation of EPON;
Fig. 2 is the realization principle schematic of measuring distance function among the PON;
Fig. 3 is the implement device schematic diagram of authentication of the present invention.
Embodiment
Method core of the present invention is: obtain the positional information of user terminal, according to the precalculated position information of described positional information, this user terminal correspondence this user terminal is authenticated.
Based on core concept of the present invention technical scheme provided by the invention is further described below.
Because the PON technology has been used TDMA (time division multiple access) technology in up link, in order to make full use of bandwidth, various PON technology have all been used the measuring distance technology and have been compensated the range difference of each PON user terminal to terminal OLT device.The realization principle of measuring distance function as shown in Figure 2 among the PON.
In Fig. 2, the difference of T1 and T2 is the RTT of user terminal (reciprocal time) value, and RTT value representation PON user terminal is to the distance of terminal OLT device.
Though realize that in different PON technology the mode of measuring distance is slightly variant, the RTT value of each online user's terminal all can be provided in each PON technology.
The present invention makes full use of the existing parameter among the PON, i.e. RTT value, with the positional information of RTT value as user terminal, and with the positional information of user terminal as the authentication information of user terminal when authenticating.
The predetermined RTT value of each user terminal correspondence should have nothing in common with each other among the present invention, like this, when carrying out the PON network layout, terminal OLT device is had nothing in common with each other to the fiber lengths of each PON user terminal.
For guaranteeing each user terminal when landing the PON network, the RTT value of measuring has nothing in common with each other, and terminal OLT device gets final product greater than 10 meters to the concrete difference of the fiber lengths of each user terminal.In the practical wiring process, because each user terminal is dispersed in the different location, the ODN of each user terminal process also has nothing in common with each other, so above-mentioned difference is easy to satisfy greater than 10 meters cabling requirement.
The predetermined RTT value of each user terminal correspondence of the present invention can for user terminal after opening an account, when for the first time landing network, terminal OLT device is initiatively or the RTT value of passive this user terminal that obtains; Also can be for when network is landed in certain debugging of appointment, the RTT value of terminal OLT device active or passive this user terminal that obtains.
The predetermined RTT value of each user terminal correspondence can be stored in the terminal OLT device authentication information database.The predetermined RTT value of above-mentioned user terminals stored correspondence can be made amendment as required, as revise predetermined RTT value according to the modification request of user terminal.
After the predetermined RTT value with the user terminal correspondence is stored in the authentication information database, when user terminal lands network later on once more and need authenticate, terminal OLT device can be at first initiatively or the RTT value of this user terminal of passive measurement, then, the RTT value predetermined RTT value of measuring corresponding with this user terminal of its storage compared, if the difference of the predetermined RTT value that the RTT value of measuring is corresponding with this user terminal of its storage is in predetermined difference range, determine that then this user terminal is the legal users terminal, authentication success, otherwise, move the position that this user terminal is described, determine that this user terminal is illegal user terminal, authentification failure, terminal OLT device should carry out the processing procedure of authentification failure, as refuse this user terminal and land network, or the generation alarm log is confirmed processing etc. with the prompting attendant.
The present invention also can be when user end certification, positional information and other authentication informations is combined user terminal is authenticated.Other authentication informations can for: mac address information, sequence number, user name, password etc., other authentication informations also can be the combination in any of above-mentioned authentication information element.
When needs combine positional information and other authentication informations when user terminal authenticated, not only need the RTT value of user terminal and be scheduled to the RTT value in predetermined difference range, the predetermined authentication information coupling that also needs this user terminal of storing in other authentication informations and the terminal OLT device, can determine that this user terminal is the legal users terminal, authentication success.
The detailed process that authenticates in conjunction with other authentication informations is exemplified below:
At first, terminal OLT device obtains the RTT value of user terminal, then, relatively whether the next authentication information predetermined authentication information corresponding with this user terminal of its storage of this user terminal transmission mates, if do not match, determine that then this user terminal is disabled user's terminal, authentification failure is refused this user terminal and is landed network; If coupling continues then to judge whether the difference of the predetermined RTT value of the RTT value of this user terminal and its storage mates in the predetermined difference value scope, if mate in the predetermined difference value scope, then definite this user terminal is the validated user terminal, authentication success; If in the predetermined difference value scope, do not match, move the position that this user terminal is described, authentification failure, terminal OLT device carry out the do not match processing procedure of authentification failure of position, as refuse this user terminal and land network, or the generation alarm log is confirmed processing etc. with the prompting attendant.
After being provided with the predetermined RTT value of user terminal correspondence, when user terminal lands network later on once more and need authenticate, also can not carry out the authentication of relevant positional information to user terminal, only the authentication information that transmission comes according to user terminal authenticates.
The implement device of authentication provided by the invention as shown in Figure 3.
In Fig. 3, the implement device of authentication of the present invention comprises: obtain positional information module, authentication module and modified module.
Store the authentication information of each user terminal in the authentication module, as the precalculated position information of user terminal correspondence.Can also store other authentication informations of each user terminal in the authentication module, as MAC Address, sequence number, user name, password etc.
Authentication module receives the authentication request of user terminal, and the message transmission of needs being obtained this position information of user's terminal is to obtaining the positional information module.
Obtain the positional information module and obtain the positional information of user terminal, and transmit it to authentication module.
Authentication module authenticates this user terminal according to the precalculated position information of this user terminal correspondence of obtaining the next positional information of positional information module transmission, its storage, and the authentication result of authentication output success or authentification failure.
The process that authentication module authenticates is identical with description process in the said method, can be not only authenticate as authentication module, can also authenticate user terminal according to the positional information of user terminal, other authentication informations that the user terminal transmission comes according to the positional information of user terminal.The verification process of authentication module is not described in detail at this.
Modified module is mainly used in the precalculated position information of revising user terminals stored correspondence in the authentication module, and modified module can be revised this user terminal corresponding position information according to the application of the location revision information of user terminal.
Though described the present invention by embodiment, those of ordinary skills know, the present invention has many distortion and variation and does not break away from spirit of the present invention, as authenticate end and also can represent etc. that with other parameters the claim of application documents of the present invention comprises these distortion and variation for the positional information of other local side apparatus, user terminal.

Claims (10)

1, a kind of implementation method of authentication is characterized in that, comprising:
A, obtain the positional information of user terminal;
B, this user terminal is authenticated according to the precalculated position information of the described positional information of obtaining, this user terminal correspondence.
2, the implementation method of a kind of authentication as claimed in claim 1 is characterized in that, described step b specifically comprises:
Whether the difference of judging the precalculated position information that the described positional information of obtaining is corresponding with this user terminal mates in the predetermined difference value scope;
If coupling determines that this user terminal is the legal users terminal, authentication success;
If do not match, determine that this user terminal is illegal user terminal, authentification failure.
3, the implementation method of a kind of authentication as claimed in claim 1 is characterized in that, described step b specifically comprises:
Whether the difference of judging the precalculated position information that predetermined authentication information coupling that authentication information that user terminal transmission comes is whether corresponding with this user terminal and the described positional information of obtaining and this user terminal are corresponding mates in the predetermined difference value scope;
If the predetermined authentication information that the authentication information that user terminal transmission comes is corresponding with this user terminal is mated and the difference of the precalculated position information that the described positional information of obtaining and this user terminal are corresponding is mated in the predetermined difference value scope, determine that this user terminal is the legal users terminal, authentication success;
Otherwise, determine that this user terminal is illegal user terminal, authentification failure.
As the implementation method of claim 2 or 3 described a kind of authentications, it is characterized in that 4, the step of described authentification failure also comprises:
Refuse described user terminal and use Internet resources; And/or
Produce the warning information that described user terminal location moves.
As the implementation method of claim 1 or 2 or 3 described a kind of authentications, it is characterized in that 5, described positional information comprises: reciprocal time.
6, the implementation method of a kind of authentication as claimed in claim 5 is characterized in that, also comprises before the described step a:
The transfer of data length that each user terminal and local side apparatus are set differs predetermined length at least.
7, the implementation method of a kind of authentication as claimed in claim 6 is characterized in that, described local side apparatus comprises: the optical line terminal equipment of local side.
As the implementation method of claim 1 or 2 or 3 described a kind of authentications, it is characterized in that 8, described method also comprises:
Revise the precalculated position information of user terminal correspondence as required.
9, a kind of implement device of authentication is characterized in that, comprising:
Obtain the positional information module: obtain the positional information of user terminal, and transfer to authentication module;
Authentication module: the precalculated position information according to the described positional information of obtaining, its user terminals stored correspondence authenticates this user terminal.
10, a kind of implement device of authentication is characterized in that, described device also comprises:
Modified module: the precalculated position information of revising user terminals stored correspondence in the described authentication module.
CN200510066528A 2005-04-27 2005-04-27 Verification implementation method and device Expired - Fee Related CN100583760C (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN200510066528A CN100583760C (en) 2005-04-27 2005-04-27 Verification implementation method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN200510066528A CN100583760C (en) 2005-04-27 2005-04-27 Verification implementation method and device

Publications (2)

Publication Number Publication Date
CN1855813A true CN1855813A (en) 2006-11-01
CN100583760C CN100583760C (en) 2010-01-20

Family

ID=37195685

Family Applications (1)

Application Number Title Priority Date Filing Date
CN200510066528A Expired - Fee Related CN100583760C (en) 2005-04-27 2005-04-27 Verification implementation method and device

Country Status (1)

Country Link
CN (1) CN100583760C (en)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009009999A1 (en) * 2007-07-13 2009-01-22 Huawei Technologies Co., Ltd. Terminal detection authentication method, device and operational management system in passive optical network
WO2009089708A1 (en) * 2007-12-19 2009-07-23 Shenzhen Huawei Communication Technologies Co. , Ltd. Passive optical network system, optical line terminal, and method for generating and authenticating authentication information
CN101114910B (en) * 2007-08-23 2010-12-08 中兴通讯股份有限公司 ONT/ONU authentication method and system in PON system
CN101141411B (en) * 2007-10-17 2011-09-21 中兴通讯股份有限公司 Method for implementing user port location in passive optical network access equipment
CN101583053B (en) * 2008-05-13 2012-04-25 工业和信息化部电信传输研究所 Method for processing illegal optical network unit by GPON system
CN103167403A (en) * 2011-12-15 2013-06-19 中国移动通信集团四川有限公司 Authentication method and system of electronic channel service
CN102082977B (en) * 2009-12-01 2014-03-05 中国电信股份有限公司 Authentication method and system of optical network unit
CN103873247A (en) * 2012-12-14 2014-06-18 北京旋极信息技术股份有限公司 Dynamic password generation method, equipment, and authentication method and system
CN104219664A (en) * 2013-05-31 2014-12-17 上海一键通信科技有限公司 Identity verification method based on geographic-location coordinate information of equipment
CN105577288A (en) * 2015-12-12 2016-05-11 浙江环顺网络科技有限公司 Double-jack FTTH terminal and module replacing method thereof
CN106162384A (en) * 2015-04-03 2016-11-23 华为技术有限公司 The roaming authentication method of a kind of optical network access equipment and relevant device
CN109936699A (en) * 2017-12-19 2019-06-25 陕西外号信息技术有限公司 The safe determination method of optical label and system

Cited By (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8774629B2 (en) 2007-07-13 2014-07-08 Huawei Technologies Co., Ltd. Method and apparatus for authentication in passive optical network
US9674172B2 (en) 2007-07-13 2017-06-06 Huawei Technologies Co., Ltd. Method and apparatus for authentication in passive optical network
US9942634B2 (en) 2007-07-13 2018-04-10 Huawei Technologies Co., Ltd. Method and apparatus for authentication in passive optical network
US10455304B2 (en) 2007-07-13 2019-10-22 Huawei Technologies Co., Ltd. Method and apparatus for authentication in passive optical network
US8406628B2 (en) 2007-07-13 2013-03-26 Huawei Technologies Co., Ltd. Method, equipment, and system for detecting and authenticating terminal in passive optical network
US9397777B2 (en) 2007-07-13 2016-07-19 Huawei Technologies Co., Ltd. Method and apparatus for authentication in passive optical network
US10986427B2 (en) 2007-07-13 2021-04-20 Huawei Technologies Co., Ltd. Method, equipment, and system for detecting and authenticating terminal in passive optical network
WO2009009999A1 (en) * 2007-07-13 2009-01-22 Huawei Technologies Co., Ltd. Terminal detection authentication method, device and operational management system in passive optical network
CN101114910B (en) * 2007-08-23 2010-12-08 中兴通讯股份有限公司 ONT/ONU authentication method and system in PON system
CN101141411B (en) * 2007-10-17 2011-09-21 中兴通讯股份有限公司 Method for implementing user port location in passive optical network access equipment
WO2009089708A1 (en) * 2007-12-19 2009-07-23 Shenzhen Huawei Communication Technologies Co. , Ltd. Passive optical network system, optical line terminal, and method for generating and authenticating authentication information
CN101583053B (en) * 2008-05-13 2012-04-25 工业和信息化部电信传输研究所 Method for processing illegal optical network unit by GPON system
CN102082977B (en) * 2009-12-01 2014-03-05 中国电信股份有限公司 Authentication method and system of optical network unit
CN103167403A (en) * 2011-12-15 2013-06-19 中国移动通信集团四川有限公司 Authentication method and system of electronic channel service
CN103873247A (en) * 2012-12-14 2014-06-18 北京旋极信息技术股份有限公司 Dynamic password generation method, equipment, and authentication method and system
CN104219664A (en) * 2013-05-31 2014-12-17 上海一键通信科技有限公司 Identity verification method based on geographic-location coordinate information of equipment
CN104219664B (en) * 2013-05-31 2019-04-12 上海评驾科技有限公司 Identity identifying method based on device geographical location coordinate information
CN106162384A (en) * 2015-04-03 2016-11-23 华为技术有限公司 The roaming authentication method of a kind of optical network access equipment and relevant device
CN106162384B (en) * 2015-04-03 2020-02-21 华为技术有限公司 Roaming authentication method of optical network access equipment and related equipment
CN105577288B (en) * 2015-12-12 2017-12-15 浙江环顺网络科技有限公司 Double socket FTTH terminals and its module replacing method
CN105577288A (en) * 2015-12-12 2016-05-11 浙江环顺网络科技有限公司 Double-jack FTTH terminal and module replacing method thereof
CN109936699A (en) * 2017-12-19 2019-06-25 陕西外号信息技术有限公司 The safe determination method of optical label and system
CN109936699B (en) * 2017-12-19 2020-08-21 陕西外号信息技术有限公司 Optical label safety judgment method and system

Also Published As

Publication number Publication date
CN100583760C (en) 2010-01-20

Similar Documents

Publication Publication Date Title
CN1855813A (en) Verificating method and device
CN1968089A (en) Subscriber authentication method for passive optical network
CN1319329C (en) Automatic method for reporting MAC address from device of optical network unit at remote side to network management system
JP5366108B2 (en) Passive optical network security enhancement based on optical network terminator management control interface
CN101159598B (en) Remote management method of passive optical network terminal equipment
CN1756156A (en) Be used for coming at access to netwoks the equipment and the method for authenticated user in communication system
CN100574194C (en) A kind of method of safety management maintenance equipment and device
CN1957635A (en) Method for remote access of an optical network device in a passive optical network
CN102571353B (en) The method of verifying legitimacy of home gateway in passive optical network
WO2014114065A1 (en) License management authentication method and system for passive optical network device
US20170214984A1 (en) Converged passive optical lan
ES2585004T3 (en) Method, system and apparatus for implementing intercom multicasting in a passive optical network
JP4812339B2 (en) Access control method in subscriber communication network, access authentication device, and computer program for access authentication
CN102201956B (en) Triple play broadband access equipment embedded management method
CN102255904A (en) Communication network and terminal authentication method thereof
WO2017076146A1 (en) Network access authentication method and system
CN1933392A (en) System for raising local side terminal constitutional safety and performance and method thereof
CN106170938A (en) A kind of method, apparatus and system of EPON wavelength configuration
CN101150474A (en) An authentication scheme of Ethernet passive optical network (EPON) access system
CN106101874A (en) Way system method for designing in a kind of ocean platform based on EPON
CN109495481A (en) OLT device and ONU equipment inter-authentication method and control terminal
CN107017946B (en) A kind of method and system that ONU equipment is registered automatically
CN101197679B (en) User authentication method and system for preventing attack from refusal service
CN108600266A (en) A kind of statement filtering authentication method and Verification System
CN103618751B (en) Passive optical network service protection method based on separate mapping mechanism

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20100120

Termination date: 20170427