WO2009033335A1

WO2009033335A1 - A method for controlling and managing an optical network unit / optical network terminal

Info

Publication number: WO2009033335A1
Application number: PCT/CN2007/003379
Authority: WO
Inventors: Jinshu Lu; Qing Li
Original assignee: Zte Corporation
Priority date: 2007-09-14
Filing date: 2007-11-29
Publication date: 2009-03-19
Also published as: CN101388725B; CN101388725A

Abstract

A method for controlling and managing an optical network unit / optical network terminal is provided, including the following steps: step one, after the optical network unit / optical network terminal has registered successfully, the optical line terminal obtains the management and control information of the optical network unit / optical network terminal (S102); step two, the optical line terminal configures the authority information of management for the optical network unit / optical network terminal, and sends it to the optical network unit / optical network terminal to modify the management authority of the optical network unit / optical network terminal (S104). By applying this invention, therefore, only through the authorization of the optical line terminal can operation, management and maintenance of the optical network unit / optical network terminal data be permitted, and accordingly can legitimate managing operations be enabled and operational security ensured.

Description

TECHNICAL FIELD The present invention relates to an optical network unit (ONU)/optical network terminal (optical network terminal) in a passive optical network (PON) Terminal, ONT) A method of security management. BACKGROUND OF THE INVENTION In many current settings, for example, DSL (Digital Subscriber Line) terminal devices, various home gateways, wireless routers, and defective terminal devices, etc., almost all support direct login from the local to Configuration management of data in the device, etc. Since an OLT (Optical Line Terminal) is connected to a plurality of ONTs/ONUs through an Optical Distribution Network (ODN) in an ΡΟΝ system, there are generally 1:32, 1:64 or 1:128. , is a natural broadcast tree structure, the data sent from the OLT can be received by each ONT/ONU, except that in the PON system, different GEMs are allocated by ^^ ONT/ONUs (G-PON Encapsulation Method) , GPON encapsulation method) PORT ID (GEM port identification), etc. The ONT/ONU distinguishes whether the delivered data stream belongs to itself according to the GEM PORT ID assigned by the OLT, and if it is its own, accepts the data, if not Discard your own. If an ONT/ONU is not implemented according to the standard process, or it creates a GEM PORT ID that is not its own, it can accept data that is not its own. For the uplink data, the OLT is authorized to each ONT/ONU, and then the ONT/ONU is allowed to send data in its authorized time slot. If an ONT/ONU does not send data according to the authorization of the OLT, it will cause uplink data conflict. , affecting normal use. In addition, in the PON system, the ONT/ONU is completely passively responding, and is in a subordinate state. All configuration data is sent by the OLT; and the OLT is in an active position to initiate all configuration data. Therefore, if you can log in to the ONT/ONU device from the ONT/ONU at any time and operate the ONT/ONU settings, the data configured to the ONT/ONU is likely to be modified, and the data of the entire PON system is etc. The security of this will be a great threat, and even the entire PON system will be paralyzed. SUMMARY OF THE INVENTION In view of the above problems in the prior art, the present invention proposes a scheme for controlling and managing an optical network unit/optical network terminal, which is practical and feasible to implement an optical network unit/light in a passive optical network. Security management of network terminals. The present invention provides a method for controlling optical network unit/optical network terminal management, including the following steps: Step 1: After the optical network unit/optical network terminal registers successfully, the optical line terminal acquires the management of the optical network unit/optical network terminal. Control information; and step 2, the optical line terminal configures management rights information for the optical network unit/optical network terminal, and sends the information to the optical network unit/optical network terminal, thereby modifying the optical network unit/light Administrative rights of the network terminal. According to the method of the present invention, before the step 1, the management control 4 is configured on the optical network unit/optical network terminal by: loading or unloading the management module; or controlling by using a variable manner. The management control information includes: information indicating an in-band and/or out-of-band management mode supported by the optical network unit/optical network terminal; indicating whether the optical network unit/optical network terminal is allowed to open its in-band and/or Information about the outband management mode; indicates the information of the uplink port and/or user port management mode supported by the optical network unit/optical network terminal; indicates whether the optical network unit/optical network terminal is allowed to open its uplink port and/or user port. The information of the management mode; the information indicating the specific management mode supported by the optical network unit/optical network terminal; the information indicating whether the optical network unit/optical network terminal is allowed to open its specific management mode; Username and password. Among them, the specific management methods include: local serial port login connection, remote login connection, browser interface login connection, simple network management protocol connection, operation and maintenance management in Ethernet passive optical network (EPON) OAM channel management mode, Gigabit no Optical Network Terminal Management Control Interface (OMCI) protocol mode, Physical Layer OAM (PLOAM) message mode, or custom management i" mode in the source optical network (GPON). Method according to the present invention The way in which the optical line terminal obtains the management control information includes: uploading or direct query. In the EPON system, a branch/leaf: method can be adopted, and a managed entity (Managed Entity, ME) can be adopted in the GPON system. In the EPON system, the PLOAM query/setting through the OAM channel can be adopted, and in the GPON system, the query/setting through the OMCI channel or the PLOAM message can be adopted. According to the method of the present invention, the following processing is included in the second step: configuring whether to allow management control of the optical network unit/optical network terminal according to the network management command; according to the optical network unit/optical network termination; whether to open the optical network The unit/optical network terminal performs uplink port and/or user port management; and sets a mode for allowing the optical network unit/optical network terminal to log in. The actual situation of the optical network unit/optical network terminal includes at least: an optical network unit/optical network terminal; a location and a type. The method according to the present invention further includes the following steps: the optical line terminal or the network management device modifies the management authority information of the optical network unit/optical network terminal configuration as needed, thereby ensuring the security of the passive optical network. Therefore, with the method of the present invention, the ONT/ONU management can be securely controlled, and the ONT/ONU connected to the PON system can be operated only under the control of the OLT. Security and assurance that the management of the ONT/ONU can be managed in a variety of ways, thus ensuring the security of the entire PON system. Other features and advantages of the present invention will be set forth in the subsequent description and, in part, from It will be apparent from the description, or be understood by <RTIgt;</RTI><RTIgt;</RTI><RTIgt;</RTI><RTIgt;</RTI><RTIgt; And get. The drawings are intended to provide a further understanding of the invention, and are intended to be a part of the description of the invention. In the drawings: FIG. 1 is a flowchart of a method for managing an optical network unit/optical network terminal according to the present invention; and FIG. 2 is a flowchart of a method for managing an optical network unit/optical network terminal according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings, which should be understood The preferred embodiments are merely illustrative and illustrative of the invention and are not intended to limit the invention. 1 is a flow chart of a method of managing an optical network unit/optical network terminal in accordance with the present invention. As shown in FIG. 1 , the method includes the following steps: Step S102: After the optical network unit/optical network terminal registers successfully, the optical line terminal acquires management control information of the optical network unit/optical network terminal; Step S104, light The line terminal configures the management authority information for the optical network unit/optical network terminal, and sends the information to the optical network unit/optical network terminal, thereby modifying the management authority of the optical network unit/optical network terminal. Step S102 further includes: Configuring management control information on the optical network unit/optical network terminal: loading or unloading the management module; or controlling by variable mode, wherein the management control information includes: indicating in-band and/or out-of-band supported by the optical network unit/optical network terminal Management mode information; indicates whether the optical network unit/optical network terminal is allowed to open its in-band and/or out-of-band management mode, that is, whether the outside world is allowed to be accessed in the in-band and/or out-of-band manner; Information about the uplink port and/or user port management mode supported by the optical network terminal; indicates whether the optical network list is allowed. The optical network terminal opens the information of the management mode of the uplink port and/or the user port, that is, whether the management channel is allowed to access through the uplink port and/or the user port; indicating the specific management supported by the optical network unit/optical network terminal Information of the mode; indicates whether the optical network unit/optical network terminal is allowed to open the information of its specific management mode, that is, whether the external environment is allowed to be accessed in some way, such as TELNET, etc.; the user name and password in the management mode are specified. Management methods include: local serial port login connection, remote login connection, browser interface login connection, simple network management protocol connection, OAM channel management mode in EPON, OMCI management mode in GPON, PLOAM message mode, or custom management protocol, etc. The way in which the optical line terminal obtains the management control information includes: uploading or direct query. In the EPON system, the Branch/Leaf mode can be adopted, and in the GPON system, the ME mode can be implemented. In the EPON system, the OAM channel can be used. Query/Setup, can be adopted in the GPON system through the OMCI channel or The PLOAM message is queried/set. The following processing is included in step S104: configuring whether to allow management control of the optical network unit/optical network terminal according to the network management command; according to the actual situation of the optical network unit/optical network terminal The optical network unit/optical network terminal performs uplink port and/or user port management; and sets a mode for allowing the optical network unit/optical network terminal to log in. The actual situation of the optical network unit/optical network terminal includes at least: the location and type of the optical network unit/optical network terminal. The method according to the present invention further includes the following steps: the optical line terminal or the network management modifies the management and authority information of the optical network unit/optical network terminal configuration as needed, thereby ensuring the security of the passive optical network. 2 is a flow chart of a method of managing an optical network unit/optical network terminal according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps: S202: Supporting control of various management modes on the ONT/ONU, that is, the connection can be allowed and the connection is not allowed in some manner, for example, loading or unloading can be adopted. The way to manage the module is implemented, variables can also be used to control its implementation, and so on;

S204, the OLT acquires the management control capability of the ONT/ONU, for example, in the EPON system, by using a Branch/Leaf method, and by an OLT active query method; in the GPON system, the MIB UPLOAD (MIB management object) Upload), or directly query to obtain;

S206, the OLT sets the management authority of the ONT/ONU according to the requirement, wherein the network management can configure whether to allow the management control thereof, and whether the actual ONT/ONU condition (for example, the placed location, the type of the ONT/ONU) is set Allow in-band/out-of-band management; whether to allow management through its upper port or user port; set the way it allows login, for example, just open some of them, for example, WEB, all other methods are prohibited;

S208, the OLT modifies the management authority of the ONT/ONU and the user name and password of the login as needed, and in order to be more secure, the management authority and the login username and password can be modified at any time. The following is an example of the OLT obtaining management control information in ME mode. The ME is used to describe the ONT management control attributes and to control the management attributes of the ONT. An ONT has an attribute entity that defines the following attributes: Managed Entity id: This attribute provides a unique number identifier for each instance of this ME. There is only one instance of this entity, its number is 0x0000, (R) (mandatory) (2 bytes). Management mode: This attribute is a bit field attribute used to describe the management mode supported by the ONT. A bit value of 1 indicates that the corresponding option is supported, and a bit value of 0 indicates that the corresponding option is not supported. These options are as follows: 0x1=in-band management mode, 0x2=out-of-band management mode, 0x4=uplink mode, 0x8=user side management mode, Ox 10-0x80=reserve future use, (R) (mandatory) (1 word Section). Management mode control: This attribute is a bit field attribute used to control (enable or disable) the management mode options supported by the ONT. A bit value of 1 indicates that the corresponding option is enabled, and a bit value of 0 indicates that the corresponding option is disabled. If the ONT does not support the set options, it will not take effect after the setting. These options are as follows: 0x1=in-band management mode, 0x2=out-of-band management mode, 0x4=uplink mode, 0x8=user side management mode, Ox 10-0x80=reserved future use, (R, W) (mandatory) 1 byte). Management Method: This attribute is a bit field attribute used to describe the management method supported by the ONT. A bit value of 1 indicates that the corresponding option is supported, and a bit value of 0 indicates that the corresponding option is not supported. These options are as follows: 0x1=Serial (CONSOLE), 0x2=Telnet (TELNET), 0x4=Browser (WEB), 0x8=Simple Network Management (SNMP), 0xl0=ONT Management Control Interface (OMCI), 0x20-0x80= Reserved for future use, (R) (mandatory) (1 byte). Management Method Control: This attribute is a bit field attribute used to control (enable or disable) management method options supported by the ONT. A bit value of 1 indicates that the corresponding option is enabled, and a bit value of 0 indicates that the corresponding option is disabled. If the ONT does not support the set options, it will not do anything after the settings. These options are as follows: 0x1=Serial (CONSOLE), 0x2=Remote Login (TELNET), 0x4=Browser (WEB), 0x8=Simple Network Management (SNMP), 0xl0=ONT Management Control Interface (OMCI), 0x20-0x80= Reserved for future use, (R, W) (mandatory) (1 byte). Remote login user name: This attribute contains a 25-byte ASCII code that describes the username for remote login. A string of less than 25 bytes adds a null character to the end. If the ONT does not support remote login, it is an empty string and will not have any effect after setting, (R, W) (mandatory) (25 bytes). Remote login password: This attribute contains a 25-byte ASCII code that describes the password for remote login. A string smaller than 25 bytes adds a null character to the end. If the ONT does not support remote login, it is an empty string and will not have any effect after setting, (R, W) (mandatory) (25 bytes). Browser Login User Name: This attribute contains a 25-byte ASCII code for describing browsing. User name for login, a string of less than 25 bytes adds a null character at the end. If the ONT does not support remote login, it is an empty string and will not have any effect after setting, (R, W) (mandatory) (25 bytes). Browser Login Password: This attribute contains a 25-byte ASCII code that describes the password for the browser login. A string less than 25 bytes adds a null character to the end. If the ONT does not support browser login, it is an empty string and will not have any effect after setting, (R, W) (mandatory) (25 bytes). Simple Network Management Community: This attribute contains a 25-byte ASCII encoding that describes the community in the SNMP protocol. Strings smaller than 25 bytes are added with null characters at the end. If the ONT does not support SNMP management, it is an empty string and will not have any effect after setting, (R, W) (mandatory) (25 bytes). Actions include: Get ( GET ): Get one or more properties; Set (SET): Set one or more properties. Notification Package 4: Attribute Value Change: This notification is used for automatic update of managed entity management control attributes; The notification should be able to identify the attribute and its new value. The AVC (Attribute Value Change) list managed by the managed entity is shown in Table 1. Management controlled AVC list

Wherein, if the current OMCI method is forbidden, the ONT cannot respond to any other ME, any other operation except the operation (acquisition or setting) of the ME--management control. When the OLT has not set the attributes 5 to 9, the ONT can change the attribute and simultaneously the corresponding AVC. If an attribute has been set, the ONT is not allowed to change its attribute value. In summary, the present invention is mainly directed to the management security of the ONT/ONU in the PON system. When the ONT/ONU accesses the PON system, the management authority is first controlled. Therefore, the present invention is only adopted. After the authorization of the optical line terminal, the operation management and maintenance of the data on the optical network unit/optical network terminal can be allowed to operate, so that legal management operations and security of operation can be guaranteed. The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A method for controlling and managing an optical network unit/optical network terminal for implementing management of an optical network unit/optical network terminal in a passive optical network, comprising the steps of:

Step 1: After the optical network unit/optical network terminal is successfully registered, the optical line terminal acquires management control information of the optical network unit/optical network terminal; and step 2, the optical line terminal is the optical network unit/light The network terminal configures management, rights information, and sends the information to the optical network unit/optical network terminal, thereby changing the management of the optical network unit/optical network terminal;

The method according to claim 1, wherein before the step 1, the method further comprises: configuring the management control information on the optical network unit/optical network terminal by: loading or unloading a management module; Or

Controlled by variables.

The method according to claim 1 or 2, wherein the management control information comprises: information indicating an in-band and/or out-of-band management mode supported by the optical network unit/optical network terminal; ^ ί 言;

Information indicating an uplink port and/or a user port management mode supported by the optical network unit/optical network terminal;

Determining whether the optical network unit/optical network terminal is allowed to open information of its upper port and/or user port management mode;

Information indicating a specific management mode supported by the optical network unit/optical network terminal; information indicating whether the optical network unit/optical network terminal is allowed to open its specific management mode;

Indicates the username and password in the specific management mode.

The method according to claim 3, wherein the specific management mode comprises at least: a local serial port login connection, a remote login connection, a browser interface login connection, a simple network connection, a connection connection, and an Ethernet passive connection. Operation and maintenance management channel management mode in optical network, optical network terminal management control interface protocol mode in Gigabit passive optical network, or custom management protocol mode.

The method according to claim 1, wherein the manner in which the optical line terminal acquires the management control information comprises: uploading or directly querying.

The method according to claim 1 or 5, wherein the optical line terminal acquires the management control information, and adopts a branch/leaf mode in the Ethernet passive optical network system, and The managed entity mode is adopted in the gigabit passive optical network system.

The method according to claim 1 or 5, wherein the optical line terminal acquires the management control information, and accesses the maintenance and management channel in the Ethernet passive optical network system. Query/setting, and in the gigabit passive optical network system, the optical network terminal management control interface channel or physical layer operation management and maintenance physical layer operation management maintenance message is queried/set.

8. The method according to claim 1, wherein the step 2 includes the following processing:

Configuring whether to allow management of the optical network unit/optical network terminal according to the network management command;

Whether to enable in-band and/or out-of-band management of the optical network unit/optical network terminal according to the actual situation of the optical network unit/optical network terminal, whether to open the optical network unit/optical network terminal Perform uplink and/or user port management;

A way of allowing the optical network unit/optical network terminal to log in is set.

The method according to claim 8, wherein the actual situation of the optical network unit/optical network terminal comprises at least: a placement location and a type of the optical network unit/optical network terminal.

The method according to claim 1, wherein the optical line terminal or the network management modifies the management authority information of the optical network unit/optical network terminal configuration as needed, thereby ensuring the security of the passive optical network. .