WO2012097601A1

WO2012097601A1 - Method, system and device for distributing safely a multicast key

Info

Publication number: WO2012097601A1
Application number: PCT/CN2011/079917
Authority: WO
Inventors: 李琴; 铁满霞; 胡亚楠; 杜志强; 王轲
Original assignee: 西安西电捷通无线网络通信股份有限公司
Priority date: 2011-01-20
Filing date: 2011-09-21
Publication date: 2012-07-26
Also published as: CN102055583B; CN102055583A

Abstract

A method for distributing safely a multicast key, which comprises: 1) an Optical Network Unit (ONU) establishes a Unicast Key (USK) with an Optical Line Terminal (OLT); 2) the ONU transmits a multicast key request message to the OLT; 3)the OLT constructs a multicast key notification message and transmits it to the ONU; 4) the ONU performs decryption, or decryption and extension, to obtain a Multicast Key (MSK) corresponding to each multicast service identifier (MSID) in a field of the multicast service identifier list information List_MSID. The method overcomes the defects that the bandwidth is wasted when a multi-copy mode is utilized, and the bandwidth is saved but unsafe when a single-copy mode is utilized in the downlink direction multicast service of an Ethernet Passive Optical Network (EPON) in the prior art.Also disclosed in the present invention are a system for distributing safely the multicast key, an OLT and an ONU corresponding to the method.

Description

The present invention claims to be submitted to the Chinese Patent Office on January 20, 2011, and the application number is 201110023141.1. The invention name is "a multicast key security distribution method and system and The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference.

Technical field

The present invention belongs to the field of network security, and relates to a method, system and device for securely distributing a multicast key.

Background technique

EPON (Ethernet Passive Optical Network) is a new type of optical access network technology. It realizes integrated data, voice and video access through a single fiber access system, and has good performance. Economic.

EPON is an access network technology that combines the advantages of Ethernet and passive optical network PON. It is a medium for media sharing. The EPON equipment at the central office is called Optical Network Terminal (OLT); the system at the user end is Called the Optical Network Unit (ONU). The uplink data transmission of the ONU to the OLT is performed according to the principle of time division multiplexing. The data of each frame is scheduled to be transmitted in a specific time slot, and the uplink data does not reach other ONUs; but the downlink data transmitted from the OLT to the ONU The transmission is broadcast, and the passive optical splitter simultaneously transmits the data packet to all ONUs. The downlink channel of the EPON system adopts the broadcast mode. When the ONU is in the promiscuous mode, all the terminal stations that are intentionally received can receive the downlink transmission information.

In the EPON network, multicast service packets from the OLT to the ONU are sent by broadcast, and the ONU performs selective reception. The OLT node has two modes for processing multicast services, one is single-copy multicast; the other is multi-copy multicast. The single-copy multicast mode can effectively save the bandwidth between the OLT and the ONU. The OLT does not need to send a unicast packet to the ONUs belonging to the multicast service group. Instead, it sends a multicast packet. The ONU of the multicast service group receives the packet, but does not prevent the ONU that does not belong to the multicast group from receiving the multicast service packet. In the multi-copy multicast mode, the OLT node generates one for each ONU belonging to the multicast service group. The multicast service packet, the ONU that is not in the multicast service group in the promiscuous mode can still receive the multicast service packet; even if the OLT sends the multicast service packet to each In the ONU, the encryption is used to ensure that the multicast service group is in the promiscuous mode.

Although the ONU can receive but cannot parse the multicast service packet, there is still a problem of wasting bandwidth between the OLT and the ONU.

Therefore, an effective method is needed to overcome the shortcomings of the prior art in which the multicast service in the downlink direction of the EPON network wastes bandwidth in the multi-copy mode, and the single-copy mode saves bandwidth but is not secure. Summary of the invention

In order to solve the above technical problems in the prior art, the present invention provides a method, system and device for securely distributing a multicast key.

The invention provides a method for securely distributing a multicast key:

The method includes the following steps:

1) The optical network unit ONU establishes a unicast key with the optical line terminal OLT USK;

2) The optical network unit ONU sends a multicast key request packet to the optical line terminal OLT, and the packet includes: a multicast service identifier list information List _MSID field and a random number N _0NU field of the optical network unit ONU; wherein: the optical network unit ONU Random number N _0NU field: used to identify the freshness of the multicast key request packet; multicast service identification list information List _MSID field: contains one or more multicast service identifiers MSID, which is the group that the optical network unit ONU requests to distribute a multicast service identifier MSID list corresponding to the broadcast key;

3) After receiving the multicast key request packet from the optical network unit ONU, the optical line terminal OLT constructs a multicast key advertisement packet and sends it to the optical network unit ONU; the optical line terminal OLT advertises the packet using the optical line through the multicast key. The unicast key USK between the terminal OLT and the optical network unit ONU sets the multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSID field in the form of an advertisement master key data list List _{E (NMK} ). Secret notification to the optical network unit ONU;

4) After receiving the multicast key advertisement packet from the optical line terminal OLT, the optical network unit ONU decrypts or decrypts and expands the multicast key corresponding to each multicast service identifier MSID in the multicast service identifier list information List _MSro field. MSK;

The present invention also includes a secure distribution system for a multicast key, the multicast key distribution system comprising: an optical line terminal OLT and an optical network unit ONU, the optical network unit ONU being in an optical line After the terminal OLT establishes the unicast key, when the multicast key needs to be requested, the multicast key request packet is sent to the optical line terminal OLT; after the optical line terminal OLT receives the multicast key request packet, constructs the multicast. The key advertisement packet sends the corresponding multicast service announcement master key NMK list to the optical network unit ONU in cipher text; after receiving the multicast key advertisement packet, the optical network unit ONU decrypts or decrypts and expands to obtain a corresponding The multicast key MSK of the multicast service.

The present invention also includes an optical line termination OLT, the optical line termination OLT comprising:

a unicast key establishment module, configured to establish a unicast key with the ONU of the optical network unit USK;

a multicast key distribution module, configured to receive a multicast key request packet sent by the optical network unit ONU, and extract the multicast service identifier list information corresponding to the multicast key requested by the optical network unit ONU in the multicast key request packet; The multicast advertisement master key NMK corresponding to each multicast service identifier is encrypted with a unicast key between the optical network unit ONU, and the multicast key advertisement packet is constructed and sent to the optical network unit ONU; The module secretly advertises the multicast advertisement master key NMK list corresponding to the multicast service identifier list requested by the optical network unit ONU to the optical network unit ONU through the multicast key advertisement packet.

The present invention also includes an optical network unit ONU, the optical network unit ONU includes: a unicast key establishment module, configured to establish a unicast key USK with the optical line terminal OLT;

a multicast key requesting module, configured to send a multicast key request packet to the optical line terminal OLT; the multicast key requesting module requests the optical network unit ONU to obtain a group corresponding to the multicast key by using the multicast key request packet The broadcast service identification list information is sent to the optical line terminal OLT;

a multicast key response module, configured to receive a multicast key advertisement packet sent by the optical line terminal OLT, and decrypt the multicast advertisement master key NMK list secretly advertised in the multicast key advertisement packet, and notify each multicast advertisement The key NMK is directly used as a multicast key MSK or a unidirectional hash algorithm for each multicast advertisement master key NMK to obtain a corresponding multicast key MSK.

The advantages of the invention are:

1) Different multicast keys can be assigned to multiple multicast service groups supported by EPON products; ensure that multicast message downlink data is transmitted in broadcast mode in EPON, and only optical network with corresponding multicast key MSK The unit ONU can receive the correct information and obtain the plaintext information of the multicast message. 2) Make full use of the unidirectionality of the EPON uplink data. For the multicast key request packet, the integrity check is not calculated. The optical line terminal OLT does not need to verify the integrity check for each multicast key, and reduce the density. The computational complexity of key distribution;

3) Random numbers are carried in the multicast key request packet, the multicast key advertisement packet, and the multicast key advertisement packet, which ensures the freshness of the message during the multicast key distribution process;

4) The optical network unit ONU can be implemented in one process. The ONU requests the optical line terminal OLT to acquire a multicast key corresponding to multiple multicast services.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention and the prior art, the following description of the embodiments and the drawings used in the prior art will be briefly described. It is obvious that the drawings in the following description are only Some embodiments of the invention may also be used to obtain other figures from these figures without departing from the art.

1 is a schematic diagram of a process of a multicast key distribution process without an acknowledgment packet according to the present invention; FIG. 2 is a schematic diagram of a process of a multicast key distribution process with an acknowledgment packet according to the present invention; FIG. 3 is a group provided by the present invention; Schematic diagram of a secure distribution method of a multicast key corresponding to a secure distribution method of a multicast key;

4 is a schematic diagram of an optical line terminal OLT according to a method for securely distributing a multicast key according to the present invention;

FIG. 5 is a schematic diagram of an ONU of an optical network unit corresponding to a method for securely distributing a multicast key according to the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1 and FIG. 2, the present invention provides a method for securely distributing a multicast key, the method comprising the following steps: 1) The optical network unit ONU establishes a unicast key USK with the optical line terminal OLT; in a preferred embodiment of the invention, both parties derive a key encryption key KEK and an integrity check key according to the unicast key USK MAK;

2) The optical network unit ONU sends a multicast key request packet to the optical line terminal OLT, where the packet includes: a multicast service identifier list information List _MSID field and a random number N _0NU field of the optical network unit ONU;

among them:

The random number of the optical network unit ONU N _0NU field: used to identify the freshness of the multicast key request packet;

Multicast service identification list information List _MSID field: Contains one or more multicast service identifiers

The MSID is a multicast service identifier MSID list corresponding to the multicast key that the ONU requests to distribute. In the specific implementation, the multicast service identifier MSID may be a multicast logical link identifier LLID.

3) After receiving the multicast key request packet from the optical network unit ONU, the optical line terminal OLT constructs a multicast key advertisement packet and sends it to the optical network unit ONU; the optical line terminal OLT advertises the packet using the optical line through the multicast key. The unicast key USK between the terminal OLT and the optical network unit ONU _sets the multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSro field in the form of an advertisement master key data list List _{E (NMK} ). Secret notification to the optical network unit ONU;

4) After receiving the multicast key advertisement packet from the optical line terminal OLT, the optical network unit ONU decrypts or decrypts and expands the multicast key corresponding to each multicast service identifier MSID in the multicast service identifier list information List _MSro field. MSK.

If the optical line terminal OLT local policy does not require the optical network unit ONU to feed back the multicast key confirmation packet (see Figure 1), the specific processing procedure of step 3) is as follows:

3.1) The optical line terminal OLT locally searches for the multicast service identifier list information. The multicast advertisement master key NMK corresponding to each multicast service identifier MSID in the _MSro field, constructs a multicast advertisement master key list ListNMK; if there is no List _MSID field locally A multicast advertisement master key NMK corresponding to the MSID of the multicast service identifier is generated as a multicast advertisement master key NMK corresponding to the multicast service identifier MSID, and the multicast advertisement master key is locally saved. NMK; 3.2) The optical line termination OLT utilizes a unicast key USK with the optical network unit ONU (in a preferred embodiment of the invention, the optical line termination OLT utilizes a key encryption key derived from the unicast key USK) KEK) encrypting the multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSID field to obtain an advertisement master key data list List _E(N MK);

3.3) an OLT configured multicast key announcement packet, the packet comprising a multicast service identifier list _List MSro information field, the optical network unit ONU N _0NU random number field, a data announcement master key list List _{E (NMK),} And an integrity check MIC1 field; wherein the MIC1 field is a unicast key USK between the optical line terminal OLT and the optical network unit ONU (in a preferred embodiment of the invention, the optical line terminal OLT utilizes according to unicast The integrity check key MAK derived by the key USK) the hash value calculated by all the fields except the MIC1 field in the multicast key advertisement packet;

3.4) Optical line terminal The OLT sends the constructed multicast key advertisement packet to the optical network unit ONU;

If the optical line terminal OLT local policy requires the optical network unit ONU to feed back the multicast key confirmation packet (as shown in Figure 2), the specific processing procedure in step 3) is as follows:

3.1) The optical line terminal OLT locally searches for the multicast service identification list information in the _MSID field. The multicast advertisement master key NMK corresponding to each multicast service identifier MSID constructs a multicast advertisement master key list ListNMK; if there is no List _MSro field locally A multicast advertisement master key NMK corresponding to the MSID of the multicast service identifier is generated as a multicast advertisement master key NMK corresponding to the multicast service identifier MSID, and the multicast advertisement master key is locally saved. NMK;

3.2) The optical line termination OLT utilizes a unicast key USK with the optical network unit ONU (in a preferred embodiment of the invention, the optical line termination OLT utilizes a key encryption key derived from the unicast key USK) KEK) encrypting the multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSro field to obtain an advertisement master key data list List _E(N MK);

3.3) Optical line terminal The OLT locally generates a random number as the random number NOLT field of the optical line terminal OLT, which is used to identify the freshness of the key announcement;

3.4) The optical line terminal OLT constructs a multicast key advertisement packet, which includes a multicast service identifier list information List _MSID field, a random number NOLT field of the optical line terminal OLT, and an optical network unit ONU The random number NONU field, the advertised master key data list List _{E (NMK} ), and the integrity check MIC2 field; wherein the MIC2 field is the unicast key USK between the optical line terminal OLT and the optical network unit ONU ( In a preferred embodiment of the present invention, the MIC1 field is an optical line termination OLT that uses the integrity check key MAK derived from the unicast key USK to calculate all fields except the MIC2 field in the multicast key advertisement packet. The resulting hash value;

3.5) Optical line terminal The OLT sends the constructed multicast key announcement packet to the optical network unit ONU.

If the optical network unit ONU does not need to send a multicast key confirmation packet after receiving the multicast key advertisement packet (as shown in Figure 1), the specific processing procedure of step 4) is as follows:

4.1) The optical network unit ONU extracts the N _0NU field in the multicast key advertisement packet and the multicast service identifier list information List _MSID field, and compares whether the two fields are consistent with corresponding fields in the previously generated multicast key request packet. If yes, go to step 4.2); otherwise, discard the packet;

4.2) The optical network unit ONU utilizes a unicast key USK with the optical line terminal OLT (in a preferred embodiment of the invention, the optical network unit ONU utilizes an integrity check key derived from the unicast key USK) MAK) Verifies the correctness of the MIC1 field in the received multicast key advertisement packet. If yes, perform step 4.3); otherwise, discard the packet;

4.3) The optical network unit ONU utilizes a unicast key USK with the optical line terminal OLT (in a preferred embodiment of the invention, the optical network unit ONU utilizes a key encryption key KEK derived from the unicast key USK) Decrypting the advertised master key data list List _{E (NMK} ) field, and then obtaining the multicast advertised master key NMK corresponding to each multicast service identifier MSID in the multicast service identifier list information List _MSro field, according to the system policy optical network unit The ONU uses the one-way hash algorithm to directly forward the multicast announcement master key NMK as the multicast key MSK or the multicast advertisement master key NMK to obtain the multicast key MSK.

If the ONU of the optical network unit needs to send a multicast key to confirm the packet after receiving the multicast key advertisement packet (as shown in Figure 2), the specific processing procedure of step 4) is as follows:

4.1) The optical network unit ONU extracts the N _0NU field in the multicast key advertisement packet and the multicast service identifier list information List _MSID field, and compares the two fields with the previously generated multicast key request packet. Whether the corresponding fields in the field are consistent, if they are consistent; then perform step 4.2); otherwise, discard the packet;

4.2) The optical network unit ONU utilizes a unicast key USK with the optical line terminal OLT (in a preferred embodiment of the invention, the optical network unit ONU utilizes an integrity check key derived from the unicast key USK) MAK) verifying the correctness of the MIC2 field in the received multicast key advertisement packet, if yes, performing step 4.3); otherwise, discarding the packet;

4.3) The optical network unit ONU utilizes a unicast key USK with the optical line terminal OLT (in a preferred embodiment of the invention, the optical network unit ONU utilizes a key encryption key KEK derived from the unicast key USK) Decrypting the advertised master key data list List _{E (NMK} ) field, and then obtaining the multicast advertised master key NMK corresponding to each multicast service identifier MSID in the multicast service identifier list information List _MSID field, according to the system policy optical network unit The ONU uses the one-way hash algorithm to directly forward the multicast announcement master key NMK as the multicast key MSK or the multicast advertisement master key NMK to obtain the multicast key MSK.

If the optical network unit ONU receives the multicast key advertisement packet, it needs to send a multicast key confirmation packet. Step 4) further includes steps 5) and 6):

5) Optical network unit The ONU sends a multicast key confirmation packet to the optical line terminal OLT. Step 5) The specific processing is as follows:

5.1) The optical network unit ONU constructs a multicast key acknowledgement packet, the packet comprising a multicast service identifier list information List _MSID field, a random number N _0IjT field of the optical line terminal OLT, and an integrity check _MIC3 field; wherein the MIC3 field is light The network element ONU utilizes a unicast key USK with the optical line termination OLT (in a preferred embodiment of the invention, the MIC1 field is an integrity check key derived by the optical line termination OLT using the unicast key USK) MAK) the hash value calculated in all the fields except the MIC3 field in the multicast key confirmation packet;

5.2) Optical network unit The ONU sends the constructed multicast key acknowledgement packet to the optical line terminal OLT.

6) The optical line terminal OLT receives the multicast key confirmation packet from the optical network unit ONU, and confirms that the optical network unit ONU receives the multicast key, and completes the distribution process of the multicast key. The specific processing of step 6) is as follows: 6.1) The optical line terminal OLT extracts the N _0IjT field in the multicast key acknowledgement packet and the multicast service identifier list information List _MSID field, and compares whether the two fields are consistent with corresponding fields in the previously generated multicast key advertisement packet. If yes, go to step 6.2); otherwise, discard the packet;

6.2) The optical line terminal OLT verifies the correctness of the MIC3 field in the received multicast key by using the unicast integrity check key with the optical network unit ONU, and if correct, confirms the optical network unit ONU Receive the multicast key and complete the secure distribution process of the multicast key; otherwise, discard the packet.

In the subsequent multicast service communication phase, the multicast message sent by the optical line terminal OLT to the optical network unit ONU corresponding to the multicast service identifier MSID is transmitted by using the established multicast key MS P; the optical network unit ONU receives Then, the plaintext information of the multicast message is obtained by using the corresponding established multicast key MSK.

The present invention also provides a secure distribution system for a multicast key corresponding to the foregoing method for securely distributing a multicast key. Referring to FIG. 3, the multicast key distribution system includes an optical line terminal OLT 301 and an optical network unit. The ONU 302, after establishing the unicast key with the optical line terminal OLT 301, the optical network unit ONU 302 sends a multicast key request packet to the optical line terminal OLT 301 when the multicast key needs to be requested; After receiving the multicast key request packet, the line terminal OLT 301 constructs the multicast key advertisement packet to send the corresponding multicast service announcement master key NMK list to the optical network unit ONU 302 in cipher text; the optical network unit After receiving the multicast key advertisement packet, the ONU 302 decrypts or decrypts and expands the multicast key MSK of the corresponding multicast service; in the secure distribution system of the multicast key, the optical network unit ONU 302 optionally constructs the multicast The key confirmation packet is sent to the optical line terminal OLT 301; after receiving the multicast key confirmation packet, the optical line terminal OLT 301 confirms that the optical network unit ONU 302 receives the multicast key MSK, and completes the Sowing security key distribution process.

The present invention also provides an optical line terminal OLT corresponding to the foregoing method for securely distributing a multicast key. Referring to FIG. 4, the optical line terminal OLT includes:

The unicast key establishment module 401 is configured to establish a unicast key with the optical network unit ONU, USK;

The multicast key distribution module 402 is configured to receive a multicast key request packet sent by the optical network unit ONU, and extract a multicast industry corresponding to the multicast key requested by the optical network unit ONU in the multicast key request packet. The identifier information of the multicast network is encrypted by using the unicast key between the multicast public key and the ONU of the optical network unit, and the multicast key advertisement packet is sent to the optical network unit ONU; The multicast key distribution module secretly advertises the multicast advertisement master key NMK list corresponding to the multicast service identifier list requested by the optical network unit ONU to the optical network unit ONU through the multicast key advertisement packet;

The optical line terminal OLT further includes a multicast key confirmation module 403, configured to receive the multicast key confirmation packet sent by the optical network unit ONU, and confirm that the optical network unit ONU has received the optical line terminal OLT multicast key distribution. a list of multicast announcement master keys NMK secretly advertised by the module;

The present invention further provides an optical network unit ONU corresponding to the foregoing method for securely distributing a multicast key. Referring to FIG. 5, the special feature is that: the optical network unit ONU includes:

a unicast key establishment module 501, configured to establish a unicast key with the optical line terminal OLT USK;

The multicast key requesting module 502 is configured to send a multicast key request packet to the optical line terminal OLT. The multicast key requesting module needs to obtain the multicast key required by the optical network unit ONU through the multicast key request packet. The multicast service identification list information is sent to the optical line terminal OLT;

The multicast key response module 503 is configured to receive a multicast key advertisement packet sent by the optical line terminal OLT, decrypt the multicast advertisement master key NMK list secretly advertised in the multicast key advertisement packet, and notify each multicast The master key NMK is directly used as a multicast key MSK or a unidirectional hash algorithm for each multicast advertisement master key NMK to obtain a corresponding multicast key MSK;

The multicast key response module 503 of the ONU of the optical network unit may further send a multicast key confirmation packet to the optical line terminal OLT, and notify the optical line terminal that the optical network unit ONU has received the group secretly notified by the optical line terminal OLT. Broadcast the master key NMK list.

In summary, according to the present invention, different multicast keys can be assigned to multiple multicast service groups supported by the EPON product; ensuring that the downlink data of the multicast message is transmitted in the EPON, and only has the corresponding group. The optical network unit ONU of the broadcast key MSK can receive the correct information and obtain the plaintext information of the multicast message. The invention fully utilizes the unidirectionality of the EPON uplink data. For the multicast key request packet, the integrity check is not calculated, and the optical line terminal OLT does not need to request the verification integrity check for each multicast key, and reduce the density. The computational complexity of key distribution. The invention requests multicast and multicast in multicast key Both the key advertisement packet and the multicast key advertisement packet carry a random number, which ensures the freshness of the message during the multicast key distribution process. In addition, the present invention can be used in the form of a list to complete the optical network unit ONU requesting the optical line terminal OLT to obtain a multicast key corresponding to multiple multicast services in one process.

Claims

Rights request

A method for securely distributing a multicast key, characterized in that: the method comprises the following steps:

2) The optical network unit ONU sends a multicast key request packet to the optical line terminal OLT, where the packet includes: a multicast service identifier list information List _MSID field and a random number N _0NU field of the optical network unit ONU; wherein, the optical network unit ONU The random number N _0NU field is used to identify the freshness of the multicast key request packet; the multicast service identifier list information List _MSID field contains one or more multicast service identifiers MSID, which is the multicast secret that the optical network unit ONU requests to distribute. a list of multicast service identifier MSIDs corresponding to the key;

3) After receiving the multicast key request packet from the optical network unit ONU, the optical line terminal OLT constructs a multicast key advertisement packet and sends it to the optical network unit ONU; the optical line terminal OLT advertises the packet using the optical line through the multicast key. The unicast key USK between the terminal OLT and the optical network unit ONU _sets the multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSro field to advertise the master key data list List _E(NMK ). Secret notification to the optical network unit ONU;

4) After receiving the multicast key advertisement packet from the optical line terminal OLT, the optical network unit ONU decrypts or decrypts and expands the multicast key corresponding to each multicast service identifier MSID in the multicast service identifier list information List _MSID field. MSK.

The method for securely distributing a multicast key according to claim 1, wherein in step 1), the optical network unit ONU establishes a unicast key USK with the optical line terminal OLT, both according to the unicast key. USK derives the key encryption key KEK and the integrity check key MAK;

Step 3) The specific processing process includes:

3.1.1) The optical line terminal OLT locally searches for the multicast service identification list information. The multicast advertisement master key NMK corresponding to each multicast service identifier MSID in the _MSID field constructs a multicast advertisement master key list ListNMK; The multicast advertisement master key NMK corresponding to the MSID of the multicast service identifier in the _MSro field generates a random number as the multicast advertisement master key NMK corresponding to the multicast service identifier MSID, and locally saves the multicast advertisement master. Key NMK;

3.1.2) The optical line terminal OLT utilizes a key encryption key KEK with the optical network unit ONU The multicast advertisement master key list ListNMK corresponding to the multicast service identifier list information List _MSID field is encrypted to obtain an advertisement master key data list List _E(NMK );

3.1.3) The OLT configured multicast key announcement packet, the packet comprising a multicast service identifier list _List MSro information field, the optical network unit ONU N _0NU random number field, a data announcement master key list List _{E (NMK} And the integrity check MIC1 field; wherein the MIC1 field is the MIC 1 field in the multicast line advertisement packet of the optical line terminal OLT using the unicast integrity check key MAK between the optical network unit and the ONU The hash value calculated by all fields;

3.1.4) Optical line terminal The OLT sends the constructed multicast key advertisement packet to the optical network unit ONU;

Step 4) The specific processing process includes:

4.1.1) N _0NU field optical network unit ONU extracts the multicast key announcement packet and a multicast service identifier list information ListMSID field, the multicast key comparison of these two fields before the occurrence of the corresponding field of the request packet whether Consistent, if consistent; then perform step 4.1.2); otherwise, discard the packet;

4.1.2) The optical network unit ONU verifies the correctness of the MIC1 field in the received multicast key advertisement packet by using the unicast integrity check key MAK with the optical line terminal OLT. If correct, step 4.1 is performed. .3); otherwise, discard the packet;

4.1.3) The optical network unit ONU decrypts the advertised master key data list List _E(NMK ) field by using the key encryption key KEK with the optical line terminal OLT to obtain the multicast service identification list information.

The multicast advertisement master key NMK corresponding to the multicast service identifier MSID in the field of the 1/1⁄2 ₈₁₁₃ field directly uses the multicast advertisement master key NMK as the multicast key MSK or the multicast advertisement master according to the system policy optical network unit ONU. The key NMK is extended using a one-way hash algorithm to obtain a multicast key MSK.

The method for securely distributing a multicast key according to claim 1, wherein: in step 1), the unicast key USK is established by the optical network unit ONU and the optical line terminal OLT according to the unicast key USK. Key encryption key KEK and integrity check key MAK;

The specific processing of step 3) includes:

3.2.1) The optical line terminal OLT locally searches for the multicast service identifier list information. The multicast advertisement master key NMK corresponding to each multicast service identifier MSID in the _MSID field, constructs a multicast advertisement master key list. If there is no multicast advertisement master key NMK corresponding to the MSID of the multicast service identifier in the List _MSID field, a random number is generated as the multicast advertisement master key NMK corresponding to the multicast service identifier MSID, and is locally Saving the multicast announcement master key NMK;

3.2.2) The optical line terminal OLT encrypts the multicast advertisement master key list ListNMK corresponding to the multicast service identification list information List _MSID field by using the key encryption key KEK with the optical network unit ONU to obtain the notification main secret. Key data list List _E(NMK );

3.2.3) The optical line terminal OLT locally generates a random number as a random number N _0IjT field of the optical line terminal OLT, which is used to identify the freshness of the key announcement;

3.2.4) The optical line terminal OLT constructs a multicast key advertisement packet, which includes a multicast service identifier list information List _MSID field, a random number of the optical line terminal OLT ( _Τ field, a random number of the optical network unit ONU N _0NU a field, an announcement master key data list List _{E (NMK} ), and an integrity check MIC2 field; wherein the MIC2 field is a unicast integrity check key MAK pair between the optical line terminal OLT and the optical network unit ONU The hash value calculated by all fields except the MIC2 field in the multicast key advertisement packet;

3.2.5) Optical line terminal The OLT sends the constructed multicast key announcement packet to the optical network unit.

ONU;

The specific processing of step 4) includes:

4.2.1) The optical network unit ONU extracts the N _0NU field in the multicast key advertisement packet and the multicast service identifier list information List _MSID field, and compares the corresponding fields in the two fields with the previously generated multicast key request packet. Whether they are consistent, if they are consistent; then perform step 4.2.2); otherwise, discard the packet;

4.2.2) The optical network unit ONU verifies the correctness of the MIC2 field in the received multicast key advertisement packet by using the unicast integrity check key MAK with the optical line terminal OLT. If correct, step 4.2 is performed. .3); otherwise, discard the packet;

4.2.3) The optical network unit ONU decrypts the announcement master key data list List _{E (NMK} ) field by using the key encryption key KEK with the optical line terminal OLT, and then obtains the multicast service identification list information 1^1⁄2 ₈₁₁₃ The multicast advertisement master key NMK corresponding to each multicast service identifier MSID in the field, according to the system policy optical network unit ONU, directly uses the multicast advertisement master key NMK as the multicast key MSK or the multicast The announcement master key NMK is extended using a one-way hash algorithm to obtain a multicast key MSK.

The method for securely distributing a multicast key according to claim 3, wherein: step 4) further comprises the step of: 5) the optical network unit ONU transmitting the multicast key confirmation packet to the optical line terminal OLT; and the step 6) The optical line terminal OLT receives the multicast key confirmation packet from the optical network unit ONU, and confirms that the optical network unit ONU receives the multicast key, and completes the distribution process of the multicast key;

Step 5) includes:

5.1) The optical network unit ONU constructs a multicast key acknowledgement packet, the packet comprising a multicast service identifier list information List _MSID field, a random number NOLT field of the optical line terminal OLT, and an integrity check MIC3 field; wherein the MIC3 field is an optical network The unit ONU uses the unicast integrity check key MAK with the optical line terminal OLT to confirm the hash value calculated in all the fields except the MIC3 field in the multicast key;

5.2) Optical network unit ONU sends the constructed multicast key acknowledgement packet to the optical line terminal

OLT;

Step 6) includes:

6.1) The optical line terminal OLT extracts the N _0IjT field in the multicast key acknowledgement packet and the multicast service identifier list information List _MSID field, and compares whether the two fields are consistent with corresponding fields in the previously generated multicast key advertisement packet. If yes, go to step 6.2); otherwise, discard the packet;

A security distribution system for a multicast key, characterized in that: the multicast key distribution system includes an optical line terminal OLT and an optical network unit ONU, and the optical network unit ONU is established with an optical line terminal OLT. After the unicast key, when the multicast key needs to be requested, the multicast key request packet is sent to the optical line terminal OLT; after receiving the multicast key request packet, the optical line terminal OLT constructs the multicast key advertisement. The packet sends the corresponding multicast service announcement master key NMK list to the optical network unit ONU in cipher text; after receiving the multicast key advertisement packet, the optical network unit ONU decrypts or decrypts The multicast key MSK of the corresponding multicast service is extended.

The multicast key security distribution system according to claim 5, wherein: in the secure distribution system of the multicast key, the optical network unit ONU constructs a multicast key confirmation packet and sends the multicast key confirmation packet to the optical line terminal OLT; After receiving the multicast key confirmation packet, the optical line terminal OLT confirms that the optical network unit ONU receives the multicast key MSK.

An optical line terminal OLT, wherein: the optical line terminal OLT comprises: a unicast key establishment module, configured to establish a unicast key USK with the optical network unit ONU;

8. The optical line terminal OLT according to claim 7, wherein: said optical line terminal

The OLT further includes a multicast key confirmation module, configured to receive the multicast key confirmation packet sent by the optical network unit ONU, and confirm that the optical network unit ONU has received the multicast advertisement that is secretly advertised by the optical line terminal OLT multicast key distribution module. Master key NMK list.

An optical network unit ONU, wherein: the optical network unit ONU includes: a unicast key establishment module, configured to establish a unicast key USK with the optical line terminal OLT;

The optical network unit ONU according to claim 9, wherein: the multicast key response module of the optical network unit ONU further sends a multicast key confirmation packet to the optical line terminal OLT to notify the optical line terminal. The OLT optical network unit ONU has received a list of multicast announcement master keys NMK secretly advertised by the optical line terminal OLT.