WO2009089708A1

WO2009089708A1 - Passive optical network system, optical line terminal, and method for generating and authenticating authentication information

Info

Publication number: WO2009089708A1
Application number: PCT/CN2008/073409
Authority: WO
Inventors: Junling Hu; Peilong Tan
Original assignee: Shenzhen Huawei Communication Technologies Co. , Ltd.
Priority date: 2007-12-19
Filing date: 2008-12-10
Publication date: 2009-07-23
Also published as: CN101465694A

Abstract

A passive optical network system, a optical line terminal, a method for generating and authtenticating authentication information are provided. The method for authentifying determines the multiple cyclic ranging results and acquires the multiple cylic ranging between a subscriber end device and an optical line terminal; generating the ranging authentication determining information between the subscriber end device and the optical line terminal according to the cyclic multiple ranging determining results; then obtaining the ranging authentication information for prestored information between the subscriber end device and the optical line terminal; finally, comparing the ranging authentication determining information and the ranging authentication information so as to confirm the authentication results. According to one embodiment of the present invention, enlarging the difference corresponding to the value obtained by multiple ranging, when setting lines in the optical distribution network, avoids the need for ensuring the minimum gap between an optical line terminal offset length, thus simplifying the setting line process.

Description

Passive optical network system, optical line terminal, authentication information generation and authentication method The present application claims to be filed on December 19, 2007, the Chinese Patent Office, the application number is 200710032704.7, and the invention name is "passive optical network system, optical line terminal, The priority of the Chinese patent application of the "Certification Information Generation and Authentication Method" is hereby incorporated by reference in its entirety. Technical field

The present invention relates to the field of PON (Passive Optical Network) technology. More specifically, the present invention relates to a passive optical network system, an optical line terminal, and an authentication information generation and authentication method. Background technique

PON technology is an optical access technology developed to support point-to-multipoint applications. Generally, a PON network usually includes an optical line termination (OLT) at a central office, and a series of user equipments located at the customer premises. , usually an Optical Network Unit/Optical Network Termination (ONU/ONT), and an optical distribution network composed of an optical fiber, a passive optical splitter or a coupler between the OLT and the customer equipment. (ODN, Optical Distribution Network). The essential feature is that the ODN is composed entirely of passive components. The passive optical splitters and couplers only serve to transmit and limit light, without power supply and information processing, and have an unrestricted mean time between failures, passive. The characteristics of the network make the network deployment more flexible, without the need for the equipment room and power supply; the characteristics of the shared optical fiber can save a lot of optical fiber resources, making the access network line cost lower; and the structure of the pure optical medium, the transparent optical fiber broadband network, makes Future business expansion maintains the security of the technology.

Generally, during the service operation of a PON network, the operator wants to limit the scope of use of the user equipment. That is, if the relocation procedure is not performed, the user equipment used under one port of the PON network cannot be migrated to another port. in use.

However, due to its point-to-multipoint nature, the current PON network system is difficult to perform line bonding like Digital Subscriber Line (DSL). When the client equipment moves to other branches of the passive optical splitter, the OLT is very Hard to detect. For this reason, the prior art utilizes the ranging function unique to the PON network to identify the user equipment. The ranging function provided by the PON network refers to: the distance between the user equipment and the central office OLT device can be measured through the interaction of the related packets. In general, the error is around 3-10 meters. This distance is proportional to the value of the round trip time (RTT, Round Trip Time) of the client device. With this function, you can log in to the PON network for the first time after the user opens an account, or specify the RTT value of the user equipment measured by the PON network in the central office OLT device, and the user. The authentication information of the end device is bound as a fixed identification information of the user.

When an illegal user steals another person's authentication information and logs in to the PON network from another place, the OLT device of the local end OLT device can discover the RTT value of the user's current login, and the previously bound RTT. The value is inconsistent. According to this, the user can be denied login or an alarm is generated to remind the maintenance personnel to pay attention to protect the network user right of the legitimate user.

However, the length of each branch of the PON required in the above solution is different, and for example, the minimum gap of each branch may be required to be about 10 m, which complicates the wiring engineering. Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a passive optical network system, an optical line terminal, and an authentication information generation and authentication method, so that the PON client device can be bound to a line, and the wiring process is relatively simple.

A method for generating authentication information, including:

Round trip multiple distances between each client device and the optical line terminal and obtain the authentication ranging result of multiple round trips; the ranging authentication information between the terminals.

An authentication method, including:

Round-trip multiple ranging between the user equipment and the optical line terminal and obtain round-trip multiple authentication decision ranging results;

Generating ranging authentication decision information between the user equipment and the optical line terminal according to the round trip multiple authentication decision ranging result; The ranging authentication decision information is compared with the ranging authentication information to determine an authentication result. An optical line terminal includes:

a ranging execution unit, configured to perform ranging between the user equipment and the optical line terminal;

The ranging authentication information generating unit is configured to generate ranging authentication information between the user equipment and the optical line terminal according to the ranging result of the ranging execution unit to the plurality of ranging when the ranging authentication information is generated;

a ranging authentication decision information generating unit, configured to generate ranging authentication decision information between the user equipment and the optical line terminal according to the authentication decision ranging result of the round trip ranging from the ranging execution unit when the authentication decision is initiated;

The authentication decision unit is configured to compare the ranging authentication determination information generated by the ranging authentication decision information generating unit with the ranging authentication information stored by the authentication information storage unit to determine an authentication result.

A passive optical network system, comprising: a client equipment and an optical line terminal, wherein the optical line terminal comprises:

According to the passive optical network system, the optical line terminal, the authentication information generation and the authentication method of the foregoing embodiment, the PON client device and the line can be bound, and when the bound user equipment is authenticated, Performing round trip multiple ranging between the user equipment and the optical line terminal and obtaining a round trip multiple authentication decision ranging result; generating measurement information between the user equipment and the optical line terminal according to the round trip multiple authentication decision ranging result; Finally, the ranging authentication decision information is compared with the ranging authentication information to determine an authentication result. Through the differential amplification process of the values obtained by multiple ranging, the requirement of ensuring the minimum gap between the lengths of the branches of the ONT during the ODN wiring is avoided, and the wiring engineering is relatively simpler. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in the drawings Other drawings can also be obtained from these drawings on the premise of creative labor.

1 is a flowchart of an authentication method according to an embodiment of the present invention;

2 is a schematic structural diagram of an embodiment of a passive optical network system according to an embodiment of the present invention; and FIG. 3 is a schematic structural diagram of an embodiment of an authentication decision unit in the user equipment shown in FIG. detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of the present invention.

In a PON network system, when different branches are not far from the length of the OLT, it will be difficult to perform authentication based on the ranging result. To solve this problem, it can be used when implementing PON client equipment and line binding. The authentication is performed according to the round trip result of the round trip, and the authentication is no longer performed according to the back and forth ranging result, so that the length of the different branch distances of the OLT is differentiated and amplified by the values obtained by multiple ranging. It avoids the requirement of ensuring the minimum gap between the lengths of the branches of the ONT during ODN wiring, making the wiring engineering relatively simpler.

Referring to FIG. 1, the figure is a main flowchart of an authentication method according to an embodiment of the present invention. In this embodiment, the PON client device and the line binding depend on the unauthentication process between each branch line and the OLT, including the following steps:

Step S101: Round-trip multiple ranging between the optical network terminal and the optical line terminal, and obtain a round-trip multiple authentication decision ranging result. For specific implementation, for example, testing N round-trips to obtain N round-trip authentication decision ranging results; The authentication decision ranging result may be a distance of multiple round trips, or may be a round trip time of multiple round trips;

Step S102: Generate ranging authentication decision information between the optical network terminal and the optical line terminal according to the round-trip multiple authentication decision ranging result, where the distance between the optical network terminal and the optical line terminal is differentiated and amplified. Performing a function operation on the authentication decision ranging result to expand the line length difference, for example, adding or multiplying the round-trip multiple authentication decision ranging result; wherein, the ranging authentication decision information may It is the distance authentication information of the round trip multiple ranging, and may also be the round trip time information of the round trip multiple ranging;

It is necessary to generate multiple rounds of ranging, that is, to differentiate and amplify the distance between the optical network terminal and the optical line terminal. The specific implementation may include:

Round-trip multiple distance measurement between each optical network terminal and the optical line terminal, and obtain ranging authentication information between the authentication and ranging terminals that are repeated multiple times, and finally save the ranging authentication information. The ranging authentication information is ranging authentication information that is differentiated and amplified by a distance between the user equipment and the optical line terminal.

It should be noted that, if the round trip multiple authentication ranging result is a distance from multiple round trips, the ranging authentication information is distance authentication information for round trip multiple ranging; The secondary authentication ranging result is a round trip time of round trip multiple ranging, and the ranging authentication information is round trip time authentication information of round trip multiple ranging.

Step S104, comparing the ranging authentication decision information with the ranging authentication information to determine an authentication result. For specific implementation, for example, comparing the ranging authentication decision information with the ranging authentication information; determining whether the comparison result is Within the scope of certification, if the judgment result is yes, it is determined that the certification is passed, and no, it is determined that the certification has not passed. The authentication information may be obtained by multiple ranging when the user equipment is first logged in, for example, after the ONT is opened, or may be obtained by multiple ranging after the user equipment, for example, the ONT is opened online (not the first time after the account is opened). In addition, the number of times of ranging ranging information and ranging authentication decision information is preferably the same for multiple ranging to ensure a small error.

In order to implement the above method provided by the embodiments of the present invention, it is required to expand the functions of the existing network system and equipment accordingly.

Referring to FIG. 2, this figure is a schematic structural diagram of a passive optical network system according to an embodiment of the present invention.

The passive optical network system of the present embodiment mainly includes: a user equipment 1 and an optical line terminal 2, wherein the user equipment 1 may be an optical network terminal or an optical network unit;

In order to implement the binding of the user equipment and the line, the optical line terminal 2 in this embodiment may include:

The ranging execution unit 21 is configured to perform ranging between the user equipment and the optical line terminal;

The ranging authentication information generating unit 22 is configured to generate ranging authentication information between the user equipment and the optical line terminal according to the ranging result of the ranging execution unit to the plurality of ranging when the ranging authentication information is generated, for example, reference In the foregoing description, the ranging authentication information may be ranging authentication information of a distance difference amplification process between the user equipment and the optical line terminal;

The authentication information storage unit 23 is configured to store ranging authentication information that is different from the distance between the user equipment and the optical line terminal;

The ranging authentication decision information generating unit 24 is configured to generate a distance-differentiated ranging between the user equipment and the optical line terminal according to the authentication decision ranging result of the round-trip multiple ranging of the ranging performing unit 21 when the authentication decision is initiated. The authentication decision information, for example, referring to the foregoing description, the ranging authentication decision information may be ranging authentication decision information of a distance difference amplification process between the user equipment and the optical line terminal; and an authentication decision unit 25, configured to use the ranging The ranging authentication decision information generated by the authentication decision information generating unit 24 is compared with the ranging authentication information stored by the authentication information storage unit 23 to determine an authentication result. For specific implementation, for example, referring to FIG. 3, the authentication determining unit 25 A specific embodiment can include:

The comparing unit 251 is configured to compare the ranging authentication decision information with the ranging authentication information; The determining unit 252 is configured to determine whether the comparison result is within the authentication range. If the determination result is yes, it is determined that the authentication is passed. Otherwise, it is determined that the authentication fails, the online can be rejected, or an alarm log is generated, and the maintenance personnel is prompted to perform the confirmation processing. Etc., no longer detailed here.

In addition, referring to the foregoing description, in the embodiment, if the round trip multiple authentication decision ranging result of the ranging execution unit 21 is the distance of the round trip multiple ranging, the ranging authentication judgment information generating unit 24 generates the measurement. The authentication judgment information may be distance authentication judgment information for round trip multiple ranging.

On the other hand, if the round trip multiple authentication decision ranging result of the ranging execution unit 21 is a round trip time of round trip multiple ranging, the ranging authentication judgment information generated by the ranging authentication decision information generating unit 24 may be more round trips. Round trip time authentication decision information for secondary ranging.

In summary, the passive optical network system, the optical line terminal, the authentication information generation and the authentication method of the embodiment can be used to bind the PON client device and the line, and when the user equipment is authenticated, the user terminal is authenticated. Round-trip multiple ranging between the device and the optical line terminal and obtain a round-trip multiple authentication decision ranging result; generating a ranging authentication decision for the distance difference between the user equipment and the optical line terminal according to the round-trip multiple authentication decision ranging result And obtaining the distance-authenticated ranging authentication information of the pre-stored user equipment and the optical line terminal; and finally comparing the ranging authentication decision information with the ranging authentication information to determine an authentication result. Through the differential amplification process of the values obtained by multiple ranging, the requirement of ensuring the minimum gap between the lengths of the ONT branches during ODN wiring is avoided, and the wiring engineering is relatively simpler.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. In execution, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). Although the present invention has been described in detail with reference to the embodiments of the present invention, it will be understood by those skilled in the art that the present invention may be modified or equivalently substituted without departing from the spirit and scope of the invention. The technical solutions and their improvements are intended to be included in the scope of the claims of the present invention.

Claims

Rights request

A method for generating authentication information, comprising:

The ranging authentication information is obtained by performing round trip multiple ranging between each client device and the optical line terminal and acquiring the authentication ranging result that is repeated multiple times.

2. The authentication information generating method according to claim 1, further comprising: storing ranging authentication information between each client device and the optical line terminal.

The authentication information generating method according to claim 1, wherein the ranging authentication information is ranging authentication information that is differentiated and amplified by a distance between the user equipment and the optical line terminal.

The authentication information generating method according to any one of claims 1 to 3, wherein the round trip multiple authentication ranging result is a distance from a plurality of round trips;

The ranging authentication information is distance authentication information for round trip multiple ranging.

The authentication information generating method according to any one of claims 1 to 3, wherein the round trip multiple authentication ranging result is a round trip time of round trip multiple ranging;

The ranging authentication information is round-trip time authentication information for round trip multiple ranging.

6. An authentication method, characterized in that it comprises:

Round-trip multiple distance measurement between the user equipment and the optical line terminal and obtain a round-trip authentication decision _5 giant result;

Generating ranging authentication decision information between the user equipment and the optical line terminal according to the round trip multiple authentication decision ranging result; comparing the ranging authentication decision information with the ranging authentication information to determine an authentication result.

7. The authentication method according to claim 6, wherein comparing the ranging authentication decision information with the ranging authentication information to determine an authentication result comprises:

Comparing the ranging authentication decision information with the ranging authentication information;

It is judged whether the comparison result is within the authentication range. If the judgment result is yes, it is determined that the authentication is passed, otherwise, it is determined that the authentication has not passed.

The authentication method according to claim 6, wherein the ranging authentication information is ranging authentication information that is differentially amplified by the user equipment and the optical line terminal, and the ranging authentication decision information is a user. The distance authentication authentication information of the distance between the end device and the optical line terminal is amplified.

The authentication method according to any one of claims 6 to 8, wherein the authentication decision ranging result is a distance from a plurality of round trips;

The ranging authentication decision information is a distance authentication decision information of a round trip multiple ranging.

The authentication method according to any one of claims 6-8, wherein the authentication decision ranging result is a round trip time of round trip multiple ranging;

The ranging authentication decision information is round-trip time authentication decision information for round trip multiple ranging.

11. An optical line terminal, comprising:

The authentication decision unit is configured to compare the ranging authentication decision information generated by the ranging authentication decision information generating unit with the ranging authentication information stored by the authentication information storage unit to determine an authentication result.

The optical line terminal according to claim 11, wherein the authentication decision unit comprises:

a comparing unit, configured to compare the ranging authentication decision information with the ranging authentication information;

The determining unit is configured to determine whether the comparison result is within the authentication range. If the determination result is yes, it is determined that the authentication is passed, otherwise, the authentication is determined to have failed.

The optical line terminal according to claim 11, wherein the ranging authentication information generated by the ranging authentication information generating unit is ranging authentication information that is differentiated and amplified by a distance between the user equipment and the optical line terminal. The ranging authentication decision information generated by the ranging authentication decision information generating unit is ranging authentication decision information in which the distance between the user equipment and the optical line terminal is differentiated and amplified.

The optical line terminal according to any one of claims 11 to 13, wherein the distance measurement result of the round trip ranging from the ranging execution unit is a distance of multiple round trips;

The ranging authentication decision information generated by the ranging authentication decision information generating unit is distance authentication judgment information for round trip multiple ranging.

The optical line terminal according to any one of claims 11 to 13, wherein the distance determination result of the round trip multiple ranging ranging from the ranging execution unit is a round trip time of round trip multiple ranging;

The ranging authentication decision information generated by the ranging authentication decision information generating unit is round-trip time authentication decision information for round-trip multiple ranging.

A passive optical network system, comprising: a client device and an optical line terminal, wherein the optical line terminal comprises:

a ranging authentication decision information generating unit, configured to execute the unit according to the ranging when the authentication decision is initiated The authentication decision ranging result of the round trip multiple ranging determines the ranging authentication decision information between the user equipment and the optical line terminal;

The passive optical network system according to claim 16, wherein the ranging authentication information generated by the ranging authentication information generating unit is a distance authentication for differentiating the distance between the user equipment and the optical line terminal. The ranging authentication decision information generated by the ranging authentication decision information generating unit is ranging authentication decision information that is differentiated and amplified by the distance between the user equipment and the optical line terminal.