TWI531194B - Cable modem and method for reissuing a digital certificate - Google Patents

Description

Cable data machine and digital certificate updating method thereof

The invention relates to an electronic device and a safety management method thereof, in particular to a cable data machine and a digital certificate updating method thereof.

With the development of communication and information technology, the traditional three major information networks (telecom network, computer network, cable TV network) are intermingling and integrating with each other. Hybrid Fiber/coax (HFC) utilizes the well-known cable TV network to provide broadband and comprehensive information for compatible telephony, cable TV and computer networking functions with its advanced optical fiber transmission technology and bandwidth advantages. network.

However, since the HFC network itself adopts the topology of the shared channel, the user can receive all the data transmitted on the network, so there is a great security risk. The user may impersonate or pretend that other network terminals send an application to the server to obtain unauthorized services, or the fake server terminal sends an illegal response. Hackers may also listen, steal, and maliciously tamper with information on public lines. In severe cases, the entire network may be blocked or even embarrassed. Therefore, it is very important to ensure the security of the data on the HFC network.

To this end, each cable modem (CM) has cured a digital certificate issued by a Certificate Authority (CA), which includes a pair of matching keys (ie, key pairs). In the Baseline Encryption (BPI) protocol, the Cable Modem Terminal System (CMTS) verifies the legal identity of the CM through the digital certificate, which effectively prevents the pretender from stealing other legitimate users.

The CM digital certificate has an expiration date, such as 20 years. When the digital certificate expires, the legal identity of the CM expires, and the user cannot use the CM to enjoy the services provided by the HFC network. If the digital certificate has a short expiration date, or if the digital certificate is about to expire, in order to ensure that the user can use it for a longer period of time, the digital certificate needs to be updated for the CM.

In view of the above, it is necessary to propose a cable data machine and a digital certificate update method thereof.

A cable data machine capable of updating a digital certificate, comprising: a determining module, configured to determine whether a digital certificate needs to be updated according to a current digital certificate of the cable data machine; and a requesting module, configured to send an update request data packet to the authentication The analysis module is configured to monitor and analyze the received data packet to obtain an update request response data packet from the certification center; and a write module for re-issuing the digital certificate in the update request response data packet Write to the memory of the cable modem and replace the current digital certificate.

A cable data machine digital certificate updating method, comprising the steps of: determining whether to update a digital certificate according to a current digital certificate of the cable data machine; sending an update request data packet to a certification center; monitoring and analyzing the received data packet, Obtain an update request response packet from the certificate authority; and write the reissued digital certificate in the update request response packet into the memory of the cable modem and replace the current digital certificate.

With the present invention, the digital certificate can be securely updated to ensure that the cable modem is functioning properly for the desired period of time.

Referring to Figure 1, there is shown a schematic diagram of the operating environment of a preferred embodiment of the cable modem of the present invention. The cable modem (CM) 2 runs in the digital certificate updating system 5, and the digital certificate updating system 5 further includes: a cable modem terminal system (CMTS) 1, a user front device ( Custom Premise Equipment, CPE) 3 and Certificate Authority (CA) 4. The cable modem 2 is connected to the client front device 3 via an Ethernet interface or a USB interface. The cable data machine 2 receives the data packet from the user front device 3, modulates it into a radio frequency signal and forms the uplink data to the cable data machine front end system 1, and modulates the downlink radio frequency signal into a digital signal output to Client front device 3. The cable modem front end system 1 is connected to at least one cable data machine 2 (only one shown) through a fiber/coax hybrid (Hybrid Fiber/coax, HFC) network for cable data machine 2 The management includes authenticating the legal identity of the cable modem 2, receiving the downlink data and transmitting it to the cable modem 2, receiving the upstream data from the cable modem 2 and transmitting it to the Internet. The client front device 3 is a user terminal device, including a personal computer, a Voip phone, etc., and each cable data machine 2 is connected to at least one client front device 3 (only one is shown). The authentication center 4 is connected to the cable modem front end system 1 via the Internet for responding to the update request of the cable data machine 2, and reissuing the digital certificate for the cable data machine 2.

Referring to Figure 2, there is shown a functional block diagram of a preferred embodiment of the cable modem of the present invention. The cable data machine 2 includes a determination module 20, an acquisition module 21, a request module 22, an analysis module 23, and a write module 24.

The determining module 20 is configured to use the current digital certificate of the cable data machine 2, Determine if you need to update the digital certificate. In this embodiment, if the validity period of the digital certificate is less than the expected time, the digital certificate needs to be updated. For example, if the cable modem 2's current digital certificate is valid for 10 years and the expected time is 15 years, the cable modem 2 needs to be updated with the digital certificate. It can also be judged based on other conditions. For example, if the remaining valid time of the current digital certificate is less than the minimum remaining time, the digital certificate needs to be updated.

The obtaining module 21 is configured to obtain a public network IP address. In the present embodiment, the cable modem 2 has a private network IP address. In this case, the cable modem 2 cannot communicate with the authentication center 4 using its own private IP address. In order to communicate with the Certification Authority 4, the Cable Data Machine 2 needs to obtain a public IP address. In order to ensure that the data machine 2 can communicate with the external network normally, in this embodiment, the obtaining module 21 obtains the required public network IP address according to the source IP address of the received data packet. If the source IP address of the data packet is a public network IP address, it indicates that the destination IP address is also a public network IP address, and indicates that the data machine 2 can normally communicate with the external network. The specific method is as follows: monitoring whether the data packet sent to the user front device 3 is received; if the data packet is received, determining whether the source IP address of the data packet is a public network IP address; if the source IP address of the data packet If the address is a public IP address, the destination IP address of the packet is saved as the obtained public IP address. If a cable IP address is assigned to the cable modem 2, the public network IP address can be directly used to communicate with the authentication center 4.

The requesting module 22 is configured to send the update request data packet to the authentication center 4 through the cable modem front end system 1 by using the obtained public network IP address as the source IP address. The update request packet includes the source IP address, the destination IP address, and the source port. Number, destination nickname, check number, device physical address, certificate length, certificate information, etc. The source IP address is the obtained public network IP address, and the destination IP address is the public network IP address of the authentication center 4; the source nickname and the destination nickname are two preset nicknames. For example, the source code for the update request packet is 29370 and the destination nickname is 53539. The checksum is used to verify the update request packet to prevent the data from being changed. For example, the checksum of the update request packet is set to 0x97687654. When the authentication center 4 receives the update request data packet, it determines whether the update request data packet is correct according to the check number. If it is correct, the authentication center 4 sends an update request response data packet. In the present embodiment, a random timer A is used to generate a random delay to avoid simultaneous transmission of an update request packet by the plurality of cable modems 2 to the authentication center 4. If a plurality of cable modems 2 communicate with the authentication center 4 at the same time, data loss is likely to occur. In the present embodiment, the timing of the random timer A is 0 to 10 minutes.

The analysis module 23 is configured to monitor and analyze data packets from the Internet to obtain an update request response data packet. In this embodiment, a random timer B is utilized to monitor packets from the Internet. In the present embodiment, the timing of the random timer B is 0 to 10 minutes. When the scheduled time of the random timer B arrives, if the data packet from the Internet is not received, or the received data packet is not the update request response data packet, the request module 22 resends the update request data packet to the authentication. Center 4. If a packet from the Internet is received, the analysis module 23 determines whether the received packet is an update request response packet. Corresponding to the update request packet, the update request response packet includes a source IP address, a destination IP address, a source nickname, a destination nickname, a check digit, a device physical address, and a certificate. Length, certificate information, etc. Moreover, the source IP address, the destination IP address, the source nickname, and the destination nickname of the update request response packet respectively correspond to the update request packet. For example, the source IP address of the update request response packet is the destination IP address of the update request packet, and the destination IP address of the update request response packet is the source IP address of the update request packet. In this embodiment, the analysis module 23 determines whether it is an update request response packet according to the format of the received data packet. For example, first determine whether the source IP address of the data packet is the public network IP address of the authentication center 4, and whether the destination IP address is the obtained public network IP address. If the source IP address of the data packet is the public network IP address of the authentication center 4, and the destination IP address is the obtained public network IP address, it is determined whether the source nickname and the destination nickname of the data packet are correct. . For example, the source nickname of the update request packet sent by the request module 22 is 29370, and the destination nickname is 53539. If the source nickname of the received data packet is 53539 and the destination nickname is 29370, the received data is received. The source nickname and destination nickname of the package are correct. If the source nickname and destination nickname of the received packet are correct, it is judged whether the checksum is correct. For example, if the checksum of the set update request response packet is 0x75493023, if the checksum of the received packet is 0x75493023, the checksum is correct. If the checksum is correct, the packet is an update request response packet. If it is not the update request response packet, the analysis module 23 transmits the data packet to the corresponding client front device 3.

The writing module 24 is configured to write the re-signed digital certificate into the memory of the cable data machine 2 and replace the current digital certificate when the digital certificate re-issued in the update request response data packet meets the requirements. In this embodiment, if the reissued digital certificate has a validity period greater than or equal to the period Looking at the time, the digital certificate meets the requirements. If the reissued digital certificate does not meet the requirements, the packet is discarded. In the present embodiment, the reissued digital certificate is written into the flash memory of the cable modem 2. The reissued digital certificate takes effect after the cable modem 2 is restarted.

Referring to Figure 3, there is shown a flow chart of a preferred embodiment of the method for updating a digital data certificate of a cable modem of the present invention.

In step S301, the cable modem 2 is turned on.

In step S302, the determining module 20 determines whether it is necessary to update the digital certificate according to the current digital certificate of the cable data machine 2. If you do not need to update the digital certificate, the process ends. In this embodiment, if the validity period of the digital certificate is less than the expected time, the digital certificate needs to be updated. For example, if the cable modem 2's current digital certificate is valid for 10 years and the expected time is 15 years, the cable modem 2 needs to be updated with the digital certificate. It can also be judged based on other conditions. For example, if the remaining valid time of the current digital certificate is less than the minimum remaining time, the digital certificate needs to be updated.

Step S303, if it is necessary to update the digital certificate, the obtaining module 21 monitors whether the data packet sent to the user front device 3 is received. If the packet is not received, continue monitoring.

Step S304, if the data packet is received, the obtaining module 21 determines whether the source IP address of the data packet is a public network IP address. If the source IP address of the data packet is not a public network IP address, then return to step S303.

Step S305: If the source IP address of the data packet is a public network IP address, the obtaining module 21 saves the destination IP address of the data packet as the obtained public network IP address.

In the present embodiment, the cable modem 2 has a private network IP address. In this case, the cable modem 2 cannot communicate with the authentication center 4 using its own private IP address. In order to communicate with the Certification Authority 4, the Cable Data Machine 2 needs to obtain a public IP address. Steps S303 to S305 are specific steps for the cable data machine 2 to acquire a public network IP address. In addition, in this embodiment, in order to ensure that the data machine 2 can normally communicate with the external network, the obtaining module 21 obtains the required public network IP address according to the source IP address of the received data packet. If the source IP address of the data packet is a public network IP address, it indicates that the destination IP address is also a public network IP address, and indicates that the data machine 2 can normally communicate with the external network. If a cable IP address is assigned to the cable modem 2, the public network IP address can be directly used to communicate with the authentication center 4.

In step S306, a random timer A is started. When the timing of the random timer A expires, step S307 is performed. If a plurality of cable modems 2 communicate with the authentication center 4 at the same time, data loss is likely to occur. In the present embodiment, the random timer A is used to generate a random delay to avoid simultaneous transmission of the update request packet by the plurality of cable modems 2 to the authentication center 4. In the present embodiment, the timing of the random timer A is 0 to 10 minutes.

Step S307, the requesting module 22 sends the update request data packet to the authentication center 4 through the cable data machine front end system 1 by using the acquired public network IP address as the source IP address, and starts a random timer B. The update request packet includes a source IP address, a destination IP address, a source nickname, a destination nickname, a check number, a device physical address, a certificate length, and a certificate information. The source IP address is the obtained public network IP address, and the destination IP address is the public network IP address of the authentication center 4; the source nickname and the destination nickname are two preset nicknames. For example, the source nickname of the update request packet is 29370, and the destination nickname is 53539. The checksum is used to verify the update request packet to prevent the data from being changed. For example, the checksum of the update request packet is set to 0x97687654. When the authentication center 4 receives the update request data packet, it determines whether the update request data packet is correct according to the check number. If it is correct, the authentication center 4 sends an update request response data packet. In the present embodiment, the timing of the random timer B is 0 to 10 minutes.

In step S308, the analysis module 23 monitors whether a data packet from the Internet is received. If the data packet from the Internet is not received, step S309 is performed; otherwise, if the data packet from the Internet is received, step S310 is performed.

In step S309, the analysis module 23 determines whether the timing time of the random timer B has arrived. If the timing time has not arrived, the process returns to S308, otherwise returns to step S307.

In step S310, the analysis module 23 determines whether the received data packet is an update request response data packet. Corresponding to the update request data packet, the update request response data packet also includes a source IP address, a destination IP address, a source nickname, a destination nickname, a check number, a device physical address, a certificate length, and a certificate information. Moreover, the source IP address, the destination IP address, the source nickname, and the destination nickname of the update request response packet respectively correspond to the update request packet. For example, the source IP address of the update request response packet is the destination IP address of the update request packet, and the destination IP address of the update request response packet is the source IP address of the update request packet. In this embodiment, the analysis module 23 determines whether it is an update request response packet according to the format of the received data packet. For example, first determine whether the source IP address of the data packet is the public network IP address of the authentication center 4, and whether the destination IP address is the obtained public network IP address. . If the source IP address of the data packet is the public network IP address of the authentication center 4, and the destination IP address is the obtained public network IP address, it is determined whether the source nickname and the destination nickname of the data packet are correct. . For example, in step S307, the source nickname of the update request packet is 29370, and the destination nickname is 53539. If the source nickname of the received packet is 53539 and the destination nickname is 29370, the received packet is received. The source nickname and destination nickname are correct. If the source nickname and destination nickname of the received packet are correct, it is judged whether the checksum is correct. For example, if the checksum of the set update request response packet is 0x75493023, if the checksum of the received packet is 0x75493023, the checksum is correct. If the checksum is correct, the packet is an update request response packet.

In step S311, if it is not the update request response packet, the analysis module 23 transmits the data packet to the corresponding client front device 3, and proceeds to step S309.

Step S312, if the update request response packet is received, the writing module 24 determines whether the digital certificate re-issued in the data packet meets the requirement. In this embodiment, if the re-issued digital certificate has a validity period greater than or equal to the expected time, the digital certificate meets the requirements.

In step S313, if the re-issued digital certificate does not meet the requirement, the writing module 24 discards the data packet, and the random timer B stops counting, and returns to step S307.

Step S314, if the re-issued digital certificate meets the requirement, the random timer B stops counting, and the writing module 24 writes the re-signed digital certificate into the memory of the cable data machine 2 and replaces the current digital certificate. E.g Write to the flash memory of the cable modem 2. The reissued digital certificate takes effect after the cable modem 2 is restarted.

In addition, in the above embodiment, the authentication center 4 is responsible for receiving the update request data packet from the cable data machine 2, and determining whether it is necessary to update the digital certificate; if the digital certificate needs to be updated, the digital certificate is reissued and will be reissued. The digital certificate is sent to the cable modem 2, and a record of reissuing the digital certificate is generated in the database of the certification center 4. The authentication center 4 uses the same discriminating method as the cable modem 2 to determine whether the digital certificate needs to be updated. For example, if the current digital certificate of the cable modem 2 has a validity period less than the expected time, the digital certificate needs to be updated.

The above is only the preferred embodiment of the present invention, and has been used in a wide range of applications. Any other equivalent changes or modifications which are not departing from the spirit of the present invention should be included in the following claims. Inside.

1‧‧‧ Cable Data Machine Front End System

2‧‧‧ Cable Data Machine

3‧‧‧Customer front device

4‧‧‧ Certification Center

5‧‧‧Digital Certificate Update System

20‧‧‧Judgement module

21‧‧‧Getting module

22‧‧‧Request Module

23‧‧‧Analysis module

24‧‧‧Write module

S301‧‧‧Open cable data machine

S302‧‧‧Whether to update the digital certificate

S303‧‧‧Do you receive the data sent to the user's front-end device?

S304‧‧‧ Whether the source IP address is a public IP address

S305‧‧‧Use the destination IP address of the packet as the public IP address to communicate with the certificate authority

S306‧‧‧Start random timer A

S307‧‧‧ Send update request packet, start random timer B

S308‧‧‧Do you receive information from the Internet?

S309‧‧‧ Whether the time of the random timer B has arrived

S310‧‧‧ Is it an update request response packet?

S311‧‧‧Transfer the data packet to the corresponding client front device

S312‧‧‧Digital certificate meets the requirements

S313‧‧‧ discard the packet, random timer B stops timing

S314‧‧‧ Random timer B stops timing and writes the reissued digital certificate to the cable modem

1 is a schematic diagram of an operating environment of a preferred embodiment of a cable modem of the present invention.

2 is a functional block diagram of a preferred embodiment of the cable modem of the present invention.

3 is a flow chart of a preferred embodiment of a method for updating a digital data certificate of a cable data machine of the present invention.

2‧‧‧ Cable Data Machine

20‧‧‧Judgement module

21‧‧‧Getting module

22‧‧‧Request Module

23‧‧‧Analysis module

24‧‧‧Write module

Claims (10)

A cable data machine capable of updating a digital certificate, comprising: a determining module, configured to determine, according to a current digital certificate of the cable data machine, whether a validity period of the digital certificate meets a preset requirement; and a request module is used for When the validity period of the digital certificate does not meet the preset requirements, a random timer is started. When the random timer expires, the update request packet is sent to the authentication center; the analysis module is used to monitor and analyze the received data. a data packet to obtain an update request response data packet from the authentication center; and a write module for writing the reissued digital certificate in the update request response data packet into the memory of the cable data machine and replacing the current Digital certificate. The cable data machine of claim 1, wherein the cable data machine further comprises an acquisition module, configured to acquire a public network IP address, and the update request data packet is obtained by acquiring a public network IP address. Is the source IP address. The cable data machine of claim 2, wherein the obtaining module acquires a public network IP address by the following method: monitoring whether the user is sent to the user connected to the cable data machine The data packet of the front device; if the data packet is received, it is determined whether the source IP address of the data packet is a public network IP address; if the source IP address of the data packet is a public network IP address, The destination IP address of the packet is saved as the obtained public IP address. The cable data machine of claim 1, wherein the update request data packet includes a check number, and the authentication center checks the update request data packet according to the check number. The cable data machine of claim 1, wherein the update request response data packet includes a check digit, and the analysis module is configured according to the checksum number. The update request response packet. A method for updating a digital certificate of a cable data machine, comprising the steps of: determining, according to a current digital certificate of the cable data machine, whether a validity period of the digital certificate meets a predetermined requirement; when the validity period of the digital certificate does not meet a predetermined requirement Activating a random timer, sending an update request packet to the authentication center when the random timer expires; monitoring and analyzing the received data packet to obtain an update request response packet from the authentication center; The reissued digital certificate in the update request response packet is written into the memory of the cable modem and replaces the current digital certificate. The cable data machine digital certificate updating method according to claim 6, wherein before the sending the update request data packet to the authentication center, the method further comprises: acquiring a public network IP address, wherein the update request data packet is The obtained public IP address is the source IP address. The cable data machine digital certificate updating method according to claim 7, wherein the specific method for obtaining a public network IP address is as follows: monitoring whether a transmission is received and connected to the cable data machine. The data packet of the user premises device; if the data packet is received, it is determined whether the source IP address of the data packet is a public network IP address; if the source IP address of the data packet is a public network IP address, The destination IP address of the data packet is saved as the obtained public network IP address. The cable data machine digital certificate updating method according to claim 6, wherein the update request data packet includes a check number, and the authentication center checks the update request data packet according to the check number. The cable data machine digital certificate update party as described in item 6 of the patent application scope The method, wherein the update request response packet includes a check number, and the cable modem verifies the update request response packet according to the check number.