WO2016110150A1 - Gpon系统中控制非法厂商onu接入能力的方法及装置 - Google Patents

Gpon系统中控制非法厂商onu接入能力的方法及装置 Download PDF

Info

Publication number
WO2016110150A1
WO2016110150A1 PCT/CN2015/093669 CN2015093669W WO2016110150A1 WO 2016110150 A1 WO2016110150 A1 WO 2016110150A1 CN 2015093669 W CN2015093669 W CN 2015093669W WO 2016110150 A1 WO2016110150 A1 WO 2016110150A1
Authority
WO
WIPO (PCT)
Prior art keywords
onu
manufacturer
capability
feature value
olt
Prior art date
Application number
PCT/CN2015/093669
Other languages
English (en)
French (fr)
Inventor
张勇
王晔
Original Assignee
烽火通信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 烽火通信科技股份有限公司 filed Critical 烽火通信科技股份有限公司
Publication of WO2016110150A1 publication Critical patent/WO2016110150A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and apparatus for controlling an ONU access capability of an illegal manufacturer in a GPON system.
  • GPON Gigabit Passive Optical Network
  • ITU-T G.984.x ITU-T G.984.x standard
  • the main network security problem of the existing GPON system is that the illegal enterprise ONU (Optical Network Unit) spoofs the physical identification, logical identifier, password and logical password of the legal manufacturer, and accesses the OLT (Optical Line Terminal).
  • the system performs authentication. If the ONU authentication of the illegal manufacturer is successful and the OLT does not control the access capability of the illegal manufacturer ONU, the criminals can use this vulnerability to carry out illegal activities and bring network security problems.
  • the technical problem to be solved by the present invention is to solve the problem that the physical identifier, logical identifier, password and logical password of the illegal manufacturer ONU counterfeit legitimate manufacturer are connected to the OLT system, which brings network security.
  • the technical solution adopted by the present invention is to provide a GPON system.
  • the method for controlling the access capability of an illegal manufacturer's ONU includes the following steps:
  • Step 101 The OLT establishes a feature value check table according to the capability characteristic value of the legal manufacturer ONU.
  • Step 102 Set a restriction policy of an illegal manufacturer ONU.
  • Step 103 The OLT detects whether the capability characteristic value of the ONU reported in the ONU authentication process exists in the feature value check table, and determines whether the ONU is an illegal manufacturer ONU. If the ONU is an illegal manufacturer ONU, step 104 is performed. Otherwise, step 105 is performed;
  • Step 104 The OLT controls the access capability of the ONU according to the restriction policy.
  • Step 105 The ONU authentication is successfully activated, and the access capability is normal, without any limitation.
  • the limiting policy includes: failing to register successfully, intermittently registering, registering successfully but not creating a service and creating a service but the service is unreachable.
  • the feature value check table includes multiple entries according to different characteristics of the legal manufacturer ONU, and each entry includes one or more feature values, and the entries and feature values may be added, modified, or deleted. .
  • the feature value check table includes the following items: Version, Equipment id, Vendor product code, ONU MIB upload next entry number, ONU MIB upload first ME, where: Version indicates ONU-G No. 2 attribute The Equipment id indicates the ONU2-G No. 1 attribute, the Vendor product code indicates the ONU2-G No. 3 attribute, and the ONU MIB upload next item number indicates the total number of entries of the MIB upload next message during the ONU MIB upload process, and the ONU MIB upload is the first.
  • the MEs represent the IDs of the first MEs reported during the ONU MIB upload process.
  • the ONU when the ONU is connected to the OLT, the ONU enters the authentication activation process and establishes the OMCC. After the OMCC is successfully established, the ONU reports its own capability characteristic value according to the G.984.4/G.988 standard, and according to the previously established
  • the feature value check table checks the capability feature value reported by the ONU. If the capability feature value reported by the ONU meets the content in the feature value check table, the ONU is considered to be a legitimate manufacturer ONU; otherwise, the ONU is considered to be an illegal manufacturer ONU.
  • the invention also provides a device for controlling an access capability of an illegal manufacturer ONU in a GPON system,
  • the OLT in the GPON system is provided with:
  • a storage unit configured to store a feature value check table established according to a capability characteristic value of a legal manufacturer ONU and a restriction policy of an illegal manufacturer ONU;
  • a detecting unit configured to detect whether the capability characteristic value of the ONU reported in the ONU authentication process exists in the feature value check table, and obtain a determination result of whether the ONU is an illegal manufacturer ONU according to the detection result;
  • the execution unit performs a corresponding operation according to the judgment result.
  • the judgment result indicates that the ONU is an illegal manufacturer ONU
  • the access capability of the ONU is controlled according to the restriction policy;
  • the judgment result indicates that the ONU is
  • the ONU of the legal manufacturer is activated
  • the ONU is activated by the authentication, and the access capability is normal without any restriction.
  • the restriction policy includes: failure to register successfully, intermittent registration, successful registration but no business creation and business creation but no business.
  • the OLT detects whether the capability feature value of the ONU reported in the ONU authentication process exists in the feature by establishing a feature value check table on the OLT according to the capability characteristic value of the legal manufacturer ONU and setting the restriction policy of the illegal manufacturer ONU. In the value check table, it is determined whether the ONU is an illegal manufacturer ONU. If the ONU is an illegal manufacturer ONU, the OLT controls the access capability of the ONU according to the restriction policy. Otherwise, the ONU authentication is successful, and the ONU access capability is successful. Normal, without any restrictions, this method greatly improves the security protection function of the OLT device and enhances the security of the operation of the GPON system.
  • FIG. 1 is a flowchart of a method for controlling an access capability of an illegal manufacturer ONU in a GPON system according to an embodiment of the present invention
  • FIG. 2 is a flowchart of detecting the legality of an ONU according to an embodiment of the present invention
  • FIG. 3 is a flowchart of failure to register successfully according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a successful registration but no service creation according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of creating a service but failing to provide a service according to an embodiment of the present invention.
  • the embodiment of the invention provides a method for controlling an access capability of an illegal manufacturer ONU in a GPON system. As shown in FIG. 1 , the method includes the following steps:
  • Step 101 The OLT establishes a feature value checklist according to the capability characteristic value of the legal manufacturer ONU.
  • Table 1 is a eigenvalue check table. As shown in Table 1, the table sets multiple entries according to different characteristics of the legitimate manufacturer ONU. Each entry contains one or more feature values, for example: Version, Equipment id, Vendor product code. The number of ONU MIB upload next entries, the first ME of the ONU MIB upload, etc., can be added, modified, or deleted. among them:
  • ONU-G is a managed entity (ME) defined in the G.984.4/G.988 standard.
  • the ME has multiple attributes, which are created by the ONU itself, and the ONU is in the MIB upload process.
  • the attribute value of the ME is reported to the OLT, and the attribute No. 2 of the ME is Version, indicating the version information of the ONU.
  • Equipment id indicates the ONU2-G No. 1 attribute.
  • ONU2-G is the ME defined in the G.984.4/G.988 standard.
  • the No. 1 attribute of the ME is the Equipment id, indicating the type identifier of the ONU.
  • Vendor product code indicates ONU2-G No. 3 attribute
  • ONU2-G is the ME defined in the G.984.4/G.988 standard
  • the ME's No. 3 attribute is Vendor product code, indicating the ONU product code.
  • Number of entries in the ONU MIB upload next indicates the total number of entries in the MIB upload next message during the ONU MIB upload.
  • some MEs created by the ONUs are defined.
  • the attributes in these MEs are defined.
  • ONU capability characteristic values, such as ONU-G, ONU2-G The attribute values of these MEs are reported to the OLT through the MIB upload next message during the ONU MIB upload process.
  • Each MIB upload next next can only report the attribute value of 26 bytes. Therefore, all the capability values of the ONU are reported. It needs to be reported in multiple MIB upload next messages.
  • the first ME indicates the ID of the first ME reported during the ONU MIB upload process.
  • the ONU reports the attribute values of multiple MEs during the MIB upload process.
  • the values of the ME values reported by different vendors are inconsistent.
  • the manufacturer will first report the attribute value of ME: ONU-G, and some manufacturers will first report the attribute value of ME: ANI-G.
  • Step 102 Set a restriction policy of an illegal manufacturer ONU.
  • Table 2 shows the ONU restriction policy table. As shown in Table 2, the restriction policy is divided into: failure to register successfully, intermittent registration, successful registration, but no service creation and business creation.
  • the OLT controls the access capability of the ONU according to the set restriction policy of the illegal manufacturer ONU.
  • Step 103 The OLT detects whether the capability characteristic value of the ONU reported in the ONU authentication process exists in the feature value check table, and determines whether the ONU is an illegal manufacturer ONU. If the ONU is an illegal manufacturer ONU, step 104 is performed; otherwise, Go to step 105.
  • Figure 2 is a flow chart for detecting the validity of the ONU. As shown in Figure 2, in the GPON system, when the ONU accesses the OLT, the ONU enters the authentication activation process and establishes the OMCC. After the OMCC is successfully established, according to G.984.4/G.
  • the ONU reports its own capability feature value
  • the OLT stores the capability feature values reported by the ONU, and checks the capability feature values reported by the ONU according to the order of the entries of the previously established feature value check table, if the capability feature value reported by the ONU matches If the content of the eigenvalue check table is that the ONU is a legal manufacturer ONU, step 105 is performed; otherwise, the ONU is considered to be an illegal manufacturer ONU, and step 104 is performed.
  • Step 104 The OLT controls the access capability of the ONU according to the restriction policy.
  • Figure 3 shows the flowchart for the failure to register successfully. As shown in Figure 3, when the ONU is determined to be an illegal manufacturer ONU, the ONU is always in the authentication activation state and cannot be activated successfully.
  • Figure 5 is a successful registration but does not create a service flow diagram. As shown in Figure 5, when the ONU is determined to be an illegal manufacturer ONU, and the registration is successful but the service restriction policy is not valid, the OLT passes the OMCI (ONU Management). And Control Interface, ONU management and control When the channel is used to create an ONU service, the OLT does not deliver the service configuration to the ONU.
  • OMCI ONU Management
  • Figure 6 is a flow chart for creating a service but the service is not working.
  • the OLT creates an ONU service through the OMCI channel after the ONU is successfully registered.
  • the OLT delivers the service to the ONU.
  • the gemport (virtual interface) bound to the ONU service is not created in the OLT PON chip.
  • Step 105 The ONU authentication is successfully activated, and the ONU access capability is normal, without any limitation.
  • the invention establishes a feature value check table on the OLT according to the capability characteristic value of the legal manufacturer ONU, and sets a restriction policy of the illegal manufacturer ONU.
  • the ONU accesses the OLT, the ONU enters the authentication activation process and is in the OMCC. After the establishment is successful, the OLT checks whether the eigenvalue reported by the ONU meets the content of the eigenvalue checklist. If it matches, the ONU authentication is successful, and the ONU access capability is normal without any restriction; otherwise, the ONU is determined.
  • the OLT controls the access capability of the ONU according to the restriction policy. This method greatly improves the security protection function of the OLT device and enhances the security of the GPON system operation.
  • the embodiment of the present invention further provides a device for controlling an access capability of an illegal manufacturer ONU in a GPON system.
  • the OLT in the GPON system is provided with:
  • a storage unit configured to store a feature value check table established according to a capability characteristic value of a legal manufacturer ONU and a restriction policy of an illegal manufacturer ONU;
  • a detecting unit configured to detect whether the capability characteristic value of the ONU reported in the ONU authentication process exists in the feature value check table, and obtain a determination result of whether the ONU is an illegal manufacturer ONU according to the detection result;
  • the execution unit performs a corresponding operation according to the judgment result.
  • the judgment result indicates that the ONU is an illegal manufacturer ONU
  • the access capability of the ONU is controlled according to the restriction policy;
  • the judgment result indicates that the ONU is
  • the ONU of the legal manufacturer is activated
  • the ONU is activated by the authentication, and the access capability is normal without any restriction.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种GPON系统中控制非法厂商ONU接入能力的方法及装置,该方法包括以下步骤：OLT根据合法厂商ONU的能力特征值建立一张特征值检验表；设置非法厂商ONU的限制策略；OLT根据ONU认证过程中上报的ONU的能力特征值确定该ONU是否为非法厂商ONU，如果该ONU是非法厂商ONU，则OLT按照非法厂商ONU的限制策略对ONU的接入能力进行控制；否则，ONU认证激活成功，接入能力正常，不受任何限制。本发明，大大提高了OLT设备的安全防护功能，增强了GPON系统运行的安全性。

Description

GPON系统中控制非法厂商ONU接入能力的方法及装置 技术领域
本发明涉及通信技术领域，具体涉及GPON系统中控制非法厂商ONU接入能力的方法及装置。
背景技术
GPON(Gigabit Passive Optical Network,吉比特/千兆位无源光纤网络)是基于ITU-T G.984.x标准的最新一代宽带无源光综合接入系统，具有高带宽、高效率、高服务质量、大覆盖范围以及用户接口丰富等众多优点，已被大多数运营商视为实现接入网业务宽带化、综合化改造的理想技术。
随着GPON系统的大规模应用，给人们的生活和工作带来了便利，同时也带来了网络安全隐患。网络攻击、网络诈骗以及非法窃取信息等网络安全问题越来越多，因而，加强网络设备的安全防护功能尤为重要。
现有的GPON系统的主要网络安全问题为非法厂商ONU(Optical Network Unit，光网络单元)仿冒合法厂商的物理标识、逻辑标识、密码和逻辑密码，接入OLT(Optical Line Terminal，光线路终端)系统进行认证，若非法厂商ONU认证成功，OLT又未对非法厂商ONU的接入能力进行控制，不法分子便可以利用此漏洞进行非法活动，带来网络安全的问题。
发明内容
本发明所要解决的技术问题是解决非法厂商ONU仿冒合法厂商的物理标识、逻辑标识、密码和逻辑密码接入OLT系统，带来网络安全的问题。
为了解决上述技术问题，本发明所采用的技术方案是提供一种GPON系 统中控制非法厂商ONU接入能力的方法，包括以下步骤：
步骤101:OLT根据合法厂商ONU的能力特征值建立一张特征值检验表；
步骤102:设置非法厂商ONU的限制策略；
步骤103:OLT检测ONU认证过程中上报的ONU的能力特征值是否存在于所述特征值检验表中，并据此判断该ONU是否为非法厂商ONU,如果该ONU是非法厂商ONU，执行步骤104；否则，执行步骤105；
步骤104:OLT按照所述限制策略对ONU的接入能力进行控制；
步骤105:ONU认证激活成功，接入能力正常，不受任何限制。
在上述方法中，所述限制策略包括：不能注册成功、间歇性掉注册、注册成功但不创建业务和创建业务但业务不通。
在上述方法中，所述特征值检验表包含有根据合法厂商ONU不同的特征设定多个条目，每个条目包含一个或多个特征值，可以对这些条目和特征值进行添加、修改或删除。
在上述方法中，所述特征值检验表包含如下条目：Version、Equipment id、Vendor product code、ONU MIB upload next条目数、ONU MIB upload第一个ME，其中：Version表示ONU-G第2号属性，Equipment id表示ONU2-G第1号属性，Vendor product code表示ONU2-G第3号属性，ONU MIB upload next条目数表示ONU MIB upload过程中MIB upload next消息的总条目数，ONU MIB upload第一个ME表示ONU MIB upload过程中上报的第一个ME的ID。
在上述方法中，当ONU接入到OLT时，ONU会进入认证激活进程，建立OMCC,OMCC建立成功后，根据G.984.4/G.988标准，ONU上报自身能力特征值，并根据先前建立的特征值检验表对ONU上报的能力特征值进行检验，如果ONU上报的能力特征值符合特征值检验表中的内容，则认为该ONU为合法厂商ONU；否则，认为该ONU为非法厂商ONU。
本发明还提供了一种GPON系统中控制非法厂商ONU接入能力的装置， GPON系统中的OLT上设有：
存储单元，用于保存根据合法厂商ONU的能力特征值所建立的特征值检验表以及非法厂商ONU的限制策略；
检测单元，用于检测ONU认证过程中上报的ONU的能力特征值是否存在于所述特征值检验表中，并据此获得该ONU是否为非法厂商ONU的判断结果；
执行单元，根据所述判断结果执行相应的操作，当所述判断结果表明该ONU为非法厂商ONU时，按照所述限制策略对ONU的接入能力进行控制；当所述判断结果表明该ONU为合法厂商的ONU时，认证激活该ONU，接入能力正常，不受任何限制。
在上述装置中，所述限制策略包括：不能注册成功、间歇性掉注册、注册成功但不创建业务和创建业务但业务不通。
本发明，通过在OLT上根据合法厂商ONU的能力特征值建立一张特征值检验表，并设置好非法厂商ONU的限制策略，OLT检测ONU认证过程中上报的ONU的能力特征值是否存在于特征值检验表中，并据此判断该ONU是否为非法厂商ONU,若该ONU是非法厂商ONU，则OLT按照限制策略对ONU的接入能力进行控制，否则，ONU认证激活成功，ONU接入能力正常，不受任何限制，此方法大大提高了OLT设备的安全防护功能，增强了GPON系统运行的安全性。
附图说明
图1为本发明实施例提供的一种GPON系统中控制非法厂商ONU接入能力的方法流程图；
图2为本发明实施例提供的检测ONU合法性流程图；
图3为本发明实施例提供的不能注册成功流程图；
图4为本发明实施例提供的间歇性掉注册流程图；
图5为本发明实施例提供的注册成功但不创建业务流程图；
图6为本发明实施例提供的创建业务但业务不通流程图。
具体实施方式
下面结合说明书附图和具体实施方式对本发明做出详细的说明。
本发明实施例提供了一种GPON系统中控制非法厂商ONU接入能力的方法，如图1所示，所述方法包括以下步骤：
步骤101、OLT根据合法厂商ONU的能力特征值建立一张特征值检验表。
表1为特征值检验表，如表1所示，该表根据合法厂商ONU不同的特征设定多个条目，每个条目包含一个或多个特征值，例如：Version、Equipment id、Vendor product code、ONU MIB upload next条目数、ONU MIB upload第一个ME等，可以对这些条目和特征值进行添加、修改或删除。其中：
Version：表示ONU-G第2号属性，ONU-G是G.984.4/G.988标准中定义的受管实体(ME)，该ME有多个属性，由ONU自己创建，ONU在MIB upload过程中上报该ME的属性值给OLT，该ME的第2号属性为Version，表示ONU的版本信息。
Equipment id：表示ONU2-G第1号属性，ONU2-G是G.984.4/G.988标准中定义的ME，该ME的第1号属性为Equipment id，表示ONU的类型标识。
Vendor product code：表示ONU2-G第3号属性，ONU2-G是G.984.4/G.988标准中定义的ME，该ME的第3号属性为Vendor product code，表示ONU的产品码。
ONU MIB upload next条目数：表示ONU MIB upload过程中MIB upload next消息的总条目数，在G.984.4/G.988标准中，规定了一些由ONU自身创建的ME，这些ME中的属性定义了ONU的能力特征值，如ONU-G、ONU2-G 等，这些ME的属性值在ONU MIB upload过程中，会通过MIB upload next消息上报给OLT，每条MIB upload next只能上报26个字节的属性值，所以要上报完ONU的全部能力特征值需分多次MIB upload next消息上报。
ONU MIB upload第一个ME：表示ONU MIB upload过程中上报的第一个ME的ID，ONU在MIB upload过程中会上报多个ME的属性值，不同的厂商上报ME的属性值顺序不一致，有的厂商会先上报ME：ONU-G的属性值，有的厂商会先上报ME：ANI-G的属性值。
表1：特征值检验表
Figure PCTCN2015093669-appb-000001
步骤102、设置非法厂商ONU的限制策略。
表2为ONU限制策略表，如表2所示，限制策略分为：不能注册成功、间歇性掉注册、注册成功但不创建业务和创建业务但业务不通。当ONU被判定为非法厂商ONU时，OLT根据设置的非法厂商ONU的限制策略对ONU的接入能力进行控制。
表2：ONU限制策略表
限制等级 限制策略
1 不能注册成功
2 间歇性掉注册
3 注册成功但不创建业务
4 创建业务但业务不通
空 预留
步骤103、OLT检测ONU认证过程中上报的ONU的能力特征值是否存在于特征值检验表中，并据此判断该ONU是否为非法厂商ONU，如果该ONU是非法厂商ONU，执行步骤104；否则，执行步骤105。
图2为检测ONU合法性流程图，如图2所示，GPON系统中，当ONU接入到OLT时，ONU会进入认证激活进程，建立OMCC,OMCC建立成功后，根据G.984.4/G.988标准，ONU上报自身能力特征值，OLT存储ONU上报的这些能力特征值，并根据先前建立的特征值检验表的条目顺序对ONU上报的能力特征值进行检验，如果ONU上报的能力特征值符合特征值检验表中的内容，则认为该ONU为合法厂商ONU，执行步骤105；否则，认为该ONU为非法厂商ONU，执行步骤104。
步骤104、OLT按照限制策略对ONU的接入能力进行控制。
图3为不能注册成功流程图，如图3所示，当ONU被判定为非法厂商ONU，按不能注册成功限制策略生效时，ONU一直处于认证激活状态，始终不能激活成功。
图4为间歇性掉注册流程图，如图4所示，当ONU被判定为非法厂商ONU，按间歇性掉注册限制策略生效时，OLT会创建一个定时器，用于监控非法厂商ONU的在线时间，设置定时器时间间隔，可以控制非法厂商ONU在时刻A注册成功，在时刻B掉注册，其中，时刻B＝时刻A+时间间隔。
图5为注册成功但不创建业务流程图，如图5所示，当ONU被判定为非法厂商ONU,按注册成功但不创建业务限制策略生效时，ONU注册成功后，OLT通过OMCI(ONU Management and Control Interface，ONU的管理和控 制接口)通道创建ONU业务时，OLT不下发业务配置到ONU。
图6为创建业务但业务不通流程图，如图6所示，当ONU被判定为非法厂商ONU，按创建业务但业务不通限制策略生效时，ONU注册成功后，OLT通过OMCI通道创建ONU业务，OLT下发业务配置到ONU，但是在OLT PON芯片中不创建与ONU业务绑定的gemport(虚拟接口)，业务不通。
步骤105、ONU认证激活成功，ONU接入能力正常，不受任何限制。
本发明，通过在OLT上根据合法厂商ONU的能力特征值建立一张特征值检验表，并设置好非法厂商ONU的限制策略，当ONU接入到OLT时，ONU会进入认证激活进程并在OMCC建立成功后上报自身能力特征值，OLT检验ONU上报的特征值是否符合特征值检验表的内容，若符合，则ONU认证激活成功，ONU接入能力正常，不受任何限制；否则，ONU被判定为非法厂商ONU，OLT按照限制策略对ONU的接入能力进行控制，此方法大大提高了OLT设备的安全防护功能，增强了GPON系统运行的安全性。
在上述方法的基础上，本发明实施例还提供了一种GPON系统中控制非法厂商ONU接入能力的装置，GPON系统中的OLT上设有：
存储单元，用于保存根据合法厂商ONU的能力特征值所建立的特征值检验表以及非法厂商ONU的限制策略；
检测单元，用于检测ONU认证过程中上报的ONU的能力特征值是否存在于所述特征值检验表中，并据此获得该ONU是否为非法厂商ONU的判断结果；
执行单元，根据所述判断结果执行相应的操作，当所述判断结果表明该ONU为非法厂商ONU时，按照所述限制策略对ONU的接入能力进行控制；当所述判断结果表明该ONU为合法厂商的ONU时，认证激活该ONU，接入能力正常，不受任何限制。
本发明不局限于上述最佳实施方式，任何人应该得知在本发明的启示 下作出的结构变化，凡是与本发明具有相同或相近的技术方案，均落入本发明的保护范围之内。

Claims (7)

  1. GPON系统中控制非法厂商ONU接入能力的方法，其特征在于，包括以下步骤：
    步骤101:OLT根据合法厂商ONU的能力特征值建立一张特征值检验表；
    步骤102:设置非法厂商ONU的限制策略；
    步骤103:OLT检测ONU认证过程中上报的ONU的能力特征值是否存在于所述特征值检验表中，并据此判断该ONU是否为非法厂商ONU,如果该ONU是非法厂商ONU，执行步骤104；否则，执行步骤105；
    步骤104:OLT按照所述限制策略对ONU的接入能力进行控制；
    步骤105:ONU认证激活成功，接入能力正常，不受任何限制。
  2. 如权利要求1所述的方法，其特征在于，所述限制策略包括：不能注册成功、间歇性掉注册、注册成功但不创建业务和创建业务但业务不通。
  3. 如权利要求1所述的方法，其特征在于，所述特征值检验表包含有根据合法厂商ONU不同的特征设定多个条目，每个条目包含一个或多个特征值，可以对这些条目和特征值进行添加、修改或删除。
  4. 如权利要求3所述的方法，其特征在于，所述特征值检验表包含如下条目：Version、Equipment id、Vendor product code、ONU MIB upload next条目数、ONU MIB upload第一个ME，其中：Version表示ONU-G第2号属性，Equipment id表示ONU2-G第1号属性，Vendor product code表示ONU2-G第3号属性，ONU MIB upload next条目数表示ONU MIB upload过程中MIB upload next消息的总条目数，ONU MIB upload第一个ME表示ONU MIB upload过程中上报的第一个ME的ID。
  5. 如权利要求3所述的方法，其特征在于，当ONU接入到OLT时，ONU会进入认证激活进程，建立OMCC,OMCC建立成功后，根据G.984.4/G.988标准，ONU上报自身能力特征值，并根据先前建立的特征值检验表对ONU上报的能力特征值进行检验，如果ONU上报的能力特征值符合特征值检验 表中的内容，则认为该ONU为合法厂商ONU；否则，认为该ONU为非法厂商ONU。
  6. GPON系统中控制非法厂商ONU接入能力的装置，其特征在于，GPON系统中的OLT上设有：
    存储单元，用于保存根据合法厂商ONU的能力特征值所建立的特征值检验表以及非法厂商ONU的限制策略；
    检测单元，用于检测ONU认证过程中上报的ONU的能力特征值是否存在于所述特征值检验表中，并据此获得该ONU是否为非法厂商ONU的判断结果；
    执行单元，根据所述判断结果执行相应的操作，当所述判断结果表明该ONU为非法厂商ONU时，按照所述限制策略对ONU的接入能力进行控制；当所述判断结果表明该ONU为合法厂商ONU时，认证激活该ONU，接入能力正常，不受任何限制。
  7. 如权利要求6所述的装置，其特征在于，所述限制策略包括：不能注册成功、间歇性掉注册、注册成功但不创建业务和创建业务但业务不通。
PCT/CN2015/093669 2015-01-06 2015-11-03 Gpon系统中控制非法厂商onu接入能力的方法及装置 WO2016110150A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510004555.8 2015-01-06
CN201510004555.8A CN104469561B (zh) 2015-01-06 2015-01-06 Gpon系统中控制非法厂商onu接入能力的方法及装置

Publications (1)

Publication Number Publication Date
WO2016110150A1 true WO2016110150A1 (zh) 2016-07-14

Family

ID=52914804

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/093669 WO2016110150A1 (zh) 2015-01-06 2015-11-03 Gpon系统中控制非法厂商onu接入能力的方法及装置

Country Status (2)

Country Link
CN (1) CN104469561B (zh)
WO (1) WO2016110150A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108848424A (zh) * 2018-05-21 2018-11-20 烽火通信科技股份有限公司 一种pon系统中动态支持onu能力的方法
CN113490081A (zh) * 2021-06-29 2021-10-08 青岛海信宽带多媒体技术有限公司 一种onu网关及pon状态灯的点亮方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104469561B (zh) * 2015-01-06 2018-01-02 烽火通信科技股份有限公司 Gpon系统中控制非法厂商onu接入能力的方法及装置
WO2016191942A1 (zh) 2015-05-29 2016-12-08 华为技术有限公司 光网络单元认证方法、光线路终端以及光网络单元
CN105049271B (zh) * 2015-09-02 2018-04-06 上海斐讯数据通信技术有限公司 一种光网络终端参数配置方法及系统
CN114302269B (zh) * 2021-12-17 2024-04-09 博为科技有限公司 Onu接入方法、装置、存储介质及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080040604A1 (en) * 2005-12-05 2008-02-14 Electronics & Telecommunications Research Institute System and method for providing authenticated encryption in GPON network
CN101583053A (zh) * 2008-05-13 2009-11-18 信息产业部电信传输研究所 一种由gpon系统处理非法光网络单元的方法
CN102740174A (zh) * 2012-06-06 2012-10-17 烽火通信科技股份有限公司 Gpon系统中管理onu接入的方法
CN104469561A (zh) * 2015-01-06 2015-03-25 烽火通信科技股份有限公司 Gpon系统中控制非法厂商onu接入能力的方法及装置

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7873276B2 (en) * 2007-06-06 2011-01-18 At&T Intellectual Property I, L.P. System and method for registration of network units
CN101267340B (zh) * 2008-03-25 2013-03-20 中兴通讯股份有限公司 一种防序列号盗用认证方法
CN101557288A (zh) * 2008-04-11 2009-10-14 中兴通讯股份有限公司 用于pon系统的onu认证方法
CN101778311A (zh) * 2009-01-08 2010-07-14 中兴通讯股份有限公司 光网络单元标识的分配方法以及光线路终端
CN101577620A (zh) * 2009-04-10 2009-11-11 北京邮电大学 一种以太网无源光网络(epon)系统认证方法
CN101902662B (zh) * 2009-05-26 2015-06-03 中兴通讯股份有限公司 光网络单元注册激活方法及系统
CN102223586B (zh) * 2010-04-13 2015-06-03 中兴通讯股份有限公司 光网络单元的注册激活方法及系统
CN103747370A (zh) * 2013-12-02 2014-04-23 上海斐讯数据通信技术有限公司 一种epon系统中实现onu自动授权的方法
CN103731764B (zh) * 2014-01-21 2020-06-05 上海斐讯数据通信技术有限公司 Pon系统onu认证授权平台及认证授权方法
CN103916271B (zh) * 2014-03-25 2017-04-12 烽火通信科技股份有限公司 用于pon系统中切换多种onu认证方式的方法及装置
CN103873962B (zh) * 2014-04-09 2018-01-16 上海斐讯数据通信技术有限公司 基于单任务管理的onu认证方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080040604A1 (en) * 2005-12-05 2008-02-14 Electronics & Telecommunications Research Institute System and method for providing authenticated encryption in GPON network
CN101583053A (zh) * 2008-05-13 2009-11-18 信息产业部电信传输研究所 一种由gpon系统处理非法光网络单元的方法
CN102740174A (zh) * 2012-06-06 2012-10-17 烽火通信科技股份有限公司 Gpon系统中管理onu接入的方法
CN104469561A (zh) * 2015-01-06 2015-03-25 烽火通信科技股份有限公司 Gpon系统中控制非法厂商onu接入能力的方法及装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108848424A (zh) * 2018-05-21 2018-11-20 烽火通信科技股份有限公司 一种pon系统中动态支持onu能力的方法
CN108848424B (zh) * 2018-05-21 2020-11-06 烽火通信科技股份有限公司 一种pon系统中动态支持onu能力的方法
CN113490081A (zh) * 2021-06-29 2021-10-08 青岛海信宽带多媒体技术有限公司 一种onu网关及pon状态灯的点亮方法
CN113490081B (zh) * 2021-06-29 2024-05-07 青岛海信宽带多媒体技术有限公司 一种onu网关及pon状态灯的点亮方法

Also Published As

Publication number Publication date
CN104469561B (zh) 2018-01-02
CN104469561A (zh) 2015-03-25

Similar Documents

Publication Publication Date Title
WO2016110150A1 (zh) Gpon系统中控制非法厂商onu接入能力的方法及装置
US20230084344A1 (en) Private cloud control
US10880306B2 (en) Verification information update
US11509501B2 (en) Automatic port verification and policy application for rogue devices
US9485278B2 (en) Plug-in based policy evaluation
TWI633775B (zh) 終端識別方法、機器識別碼註冊方法及相應系統、設備
CN100426741C (zh) 一种epon网元设备的自动配置方法
US10581849B2 (en) Data packet transmission method, data packet authentication method, and server thereof
CN104618396A (zh) 一种可信网络接入与访问控制系统及方法
CN106657429A (zh) 一种设备标识符生成方法以及装置
US20080109864A1 (en) System and Method for Detecting and Reporting Cable Modems with Duplicate Media Access Control Addresses
CN104584478B (zh) 无源光网络中的终端认证方法、装置及系统
CN101345743A (zh) 防止利用地址解析协议进行网络攻击的方法及其系统
CN102868702B (zh) 系统登录装置和系统登录方法
US9516059B1 (en) Using mock tokens to protect against malicious activity
CN102752269A (zh) 基于云计算的身份认证的方法、系统及云端服务器
TW201212614A (en) Network devices and authentication protocol methods thereof
CN104901940A (zh) 一种基于cpk标识认证的802.1x网络接入方法
US20120047583A1 (en) Cable fraud detection system
WO2016191942A1 (zh) 光网络单元认证方法、光线路终端以及光网络单元
US9578039B2 (en) OAM security authentication method and OAM transmitting/receiving devices
CN102571353B (zh) 无源光网络中验证家庭网关合法性的方法
CN101656760A (zh) 一种地址分配方法和一种接入控制设备
WO2015169003A1 (zh) 一种账户分配方法和装置
CN104410580A (zh) 可信安全WiFi路由器及其数据处理方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15876650

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15876650

Country of ref document: EP

Kind code of ref document: A1