Method and apparatus for secure communication in a passive optical network

Abstract

A secure communication method of a PON system. First, the OLT sends a first message to the ONU, the first message comprising a first key algorithm, a certificate of the OLT and a public key of the OLT, the first key algorithm being a key algorithm supported by both the OLT and the ONU. The ONU verifies the certificate of the OLT, and after verification, determines a shared key according to the first key algorithm and the public key of the OLT. Then, the ONU sends a second message to the OLT, the second message comprising a certificate of the ONU and a public key of the ONU. After receiving the second message, the OLT verifies the certificate of the ONU, and after verification, determines a shared key according to the first key algorithm and the public key of the ONU. Further, the ONU and the OLT can use the shared key to encrypt the messages and data of the session or communication. The method realizes the bidirectional authentication of the OLT and the ONU without introducing other devices or entities, not only improves the security of the system and reduces the difficulty of operation and maintenance, but also strengthens the security protection of the data and improves the security level of the communication.

Description

Technical Field

[0001] This application relates to the field of optical communication, and more specifically, to a secure communication method and apparatus for a passive optical network (PON). Background Technology

[0002] Passive Optical Network (PON) technology is a point-to-multipoint fiber optic access technology. A PON system may include an Optical Line Terminal (OLT), an Optical Distribution Network (ODN), and at least one Optical Network Unit (ONU). The OLT connects to multiple ONUs through the ODN.

[0003] To ensure communication security, the OLT needs to perform security authentication on the ONU. Currently, common authentication methods include authentication based on the ONU serial number (SN), authentication based on the ONU Media Access Control (MAC) address, and authentication based on a password. Based on these methods, the OLT can authenticate the legitimacy of the ONU. However, because the SN, password, and other information are transmitted in plaintext in these authentication methods, there is a risk of leakage. Furthermore, since these methods are one-way authentication, the ONU cannot authenticate the OLT. If a counterfeit OLT configures and controls the ONU, it will have a significant impact on the end-user's services, posing a substantial security risk.

[0004] Therefore, there is an urgent need for a more secure communication method for PON systems. Summary of the Invention

[0005] This application proposes a method for secure communication in a PON system, as well as an apparatus and system for implementing the method.

[0006] Firstly, this application proposes a secure communication method for a PON system. Firstly, the OLT sends a first message to the ONU, which includes a first key algorithm, the OLT's certificate, and the OLT's public key. This first key algorithm is one supported by both the OLT and the ONU. The ONU verifies the OLT's certificate; upon successful verification, it determines a shared key based on the first key algorithm and the OLT's public key. Then, the ONU sends a second message to the OLT, which includes the ONU's certificate and public key. Upon receiving the second message, the OLT verifies the ONU's certificate; upon successful verification, it determines the shared key based on the first key algorithm and the ONU's public key. It should be noted that the shared key determined by the ONU and the shared key determined by the OLT are identical, based on the first key algorithm. Furthermore, the ONU and OLT can use this shared key to encrypt messages and data in sessions or communications.

[0007] The method described in the first aspect not only enables the OLT to authenticate the ONU, but also allows the ONU to authenticate the legitimacy of the OLT. This achieves two-way authentication between the OLT and ONU without introducing other devices or entities, improving system security and reducing maintenance complexity. Furthermore, after authentication, a shared key is negotiated, and communication between the OLT and ONU is encrypted using this shared key, strengthening data security and enhancing the overall security level of communication.

[0008] In one possible implementation of the first aspect, the OLT can obtain the key algorithms supported by the ONU. For example, the OLT first sends an authentication request to the ONU, the ONU sends a third message containing the key algorithms supported by the ONU to the OLT, and the OLT then determines the first key algorithm based on the key algorithms supported by the ONU and the key algorithms supported by the OLT. This implementation does not require pre-configuring the key algorithms supported by the ONU in the OLT, reducing operation and maintenance costs.

[0009] In one possible implementation of the first aspect, the first message also includes a set of key parameters, which includes one or more key parameters. The OLT transmits the key parameters it uses to the ONU via a message. The ONU and OLT use the same parameters during the calculation and generation of the key, ensuring the consistency of the shared key ultimately calculated by the ONU and OLT.

[0010] In one possible implementation of the first aspect, the OLT uses a random number as its private key, and the OLT determines its public key according to a first key algorithm, a first key parameter, and the OLT's private key. The first key parameter is one or more key parameters in a set of key parameters. The ONU uses a random number as its private key, and the ONU determines its public key according to the first key algorithm, the first key parameter, and the ONU's private key.

[0011] In one possible implementation of the first aspect, the ONU determines a shared key based on the first key algorithm, the second key parameter, the OLT's public key, and the ONU's private key, wherein the second key parameter is one or more key parameters in a set of key parameters; the OLT determines the shared key based on the first key algorithm, the second key parameter, the ONU's public key, and the OLT's private key.

[0012] As described above, the OLT and ONU use the same key algorithm and key parameters during the calculation process. The OLT and ONU exchange publicly available information without relying on a secure channel, negotiating a key known only to each other. The entire process requires no participation from third-party devices or network elements, nor does it require prior negotiation and establishment of a secure channel. This not only enhances the security of communication between the OLT and ONU but also reduces the difficulty and cost of implementation compared to existing technologies.

[0013] In one possible implementation of the first aspect, to further enhance security, the OLT can also use the private key corresponding to the OLT's certificate to digitally sign the first message; correspondingly, the ONU uses the private key corresponding to the ONU's certificate to digitally sign the second message.

[0014] In one possible implementation of the first aspect, after receiving the registration message from the ONU, the OLT initiates an authentication request to the ONU.

[0015] In one possible implementation of the first aspect, messages related to OLT and ONU security authentication, such as the first message, second message, third message, and authentication request, are transmitted via the Optical Network Terminal Management and Control Interface (OMCI). For example, the authentication message and the first message are implemented using OMCI SET messages; the second and third messages are implemented using OMCI Attribute Value Change (AVC) messages. Alternatively, additional OMCI message types can be added, corresponding to the first message, second message, third message, and authentication request, respectively.

[0016] Secondly, this application proposes a PON system device. The device includes a processor, a memory, and a transceiver. The transceiver is used for transmitting and receiving signals and data; the memory is used for storing program instructions; and the processor is used for executing the program stored in the memory. When the program is executed, the device performs methods related to the OLT or ONU as described in the first aspect.

[0017] Thirdly, this application provides a PON secure communication system, which includes the OLT and ONU as described above.

[0018] Fourthly, this application provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by hardware, it is capable of implementing some or all of the steps related to the OLT or ONU in the first aspect described above. Attached Figure Description

[0019] Figure 1 A schematic diagram of a PON system architecture provided in this application embodiment;

[0020] Figure 2 A schematic diagram of a secure communication method for a PON system provided in an embodiment of this application;

[0021] Figure 3 A schematic diagram of another secure communication method for a PON system provided in this application embodiment;

[0022] Figure 4 This is a schematic diagram of the structure of an OLT or ONU device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0024] The technical solutions of this application can be applied to various passive optical network systems, such as next-generation PON (NG-PON), NG-PON1, NG-PON2, gigabit-capable PON (GPON), 10 gigabit per second PON (XG-PON), 10-gigabit-capable symmetric passive optical network (XGS-PON), Ethernet PON (EPON), 10 gigabit per second EPON (10G-EPON), next-generation EPON (NG-EPON), wavelength-division multiplexing (WDM) PON, time-division wavelength-division multiplexing (TWDM) PON, and point-to-point (P2P) WDM PON (P2P-WDM). PON, Asynchronous Transfer Mode PON (APON), Broadband PON (BPON), etc., as well as 25 gigabit per second PON (25G-PON), 50 gigabit per second PON (50G-PON), 100 gigabit per second PON (100G-PON), 25 gigabit per second EPON (25G-EPON), 50 gigabit per second EPON (50G-EPON), 100 gigabit per second EPON (100G-EPON), and other rates such as GPON and EPON.

[0025] Figure 1 The schematic diagrams are of the architecture of the PON system applicable to various embodiments of the present invention, such as... Figure 1As shown, the PON system 100 includes at least one OLT 110, at least one ODN 120, and multiple ONUs 130. The OLT 110 provides a network-side interface for the PON system 100, and the ONUs 130 provide user-side interfaces for the PON system 100 and are connected to the ODN 120. If the ONU 130 directly provides user port functionality, it is called an Optical Network Terminal (ONT). For ease of description, the ONU 130 mentioned below refers to both ONTs that can directly provide user port functionality and ONUs that provide user-side interfaces. The ODN 120 is a network composed of optical fibers and passive optical splitters, used to connect the OLT 110 and ONU 130 devices, and to distribute or multiplex data signals between the OLT 110 and ONU 130.

[0026] In this PON system 100, the direction from OLT 110 to ONU 130 is defined as the downlink direction, while the direction from ONU 130 to OLT 110 is defined as the uplink direction. In the downlink direction, OLT 110 broadcasts downlink data to multiple ONUs 130 managed by OLT 110 using Time Division Multiplexing (TDM), with each ONU 130 only receiving data carrying its own identifier. In the uplink direction, multiple ONUs 130 communicate with OLT 110 using Time Division Multiple Access (TDMA), with each ONU 130 sending uplink data according to the time domain resources allocated to it by OLT 110. Using this mechanism, the downlink optical signal transmitted by OLT 110 is a continuous optical signal, while the uplink optical signal transmitted by ONU 130 is a bursty optical signal.

[0027] The OLT 110 is typically located in the Central Office (CO) and can centrally manage at least one ONU 130 and transmit data between the ONU 130 and the upper-layer network. Specifically, the OLT 110 can act as a medium between the ONU 130 and the upper-layer network (such as the Internet or Public Switched Telephone Network, PSTN), forwarding data received from the upper-layer network to the ONU 130 and forwarding data received from the ONU 130 to the upper-layer network. The specific structural configuration of the OLT 110 may vary depending on the specific type of the PON system 100. For example, in one embodiment, the OLT 110 may include a transmitter for sending downlink continuous optical signals to the ONU 130 and a receiver for receiving uplink burst optical signals from the ONU 130, wherein the downlink and uplink optical signals can be transmitted through the ODN 120, but the embodiments of the present invention are not limited thereto.

[0028] The ONU 130 can be distributed and deployed at user-side locations (such as user premises). The ONU 130 can be a network device used to communicate with the OLT 110 and users. Specifically, the ONU 130 can act as a medium between the OLT 110 and users. For example, the ONU 130 can forward data received from the OLT 110 to users and forward data received from users to the OLT 110.

[0029] The ODN 120 can be a data distribution network and may include optical fibers, optical couplers, optical splitters, or other devices. In one embodiment, the optical fiber, optical coupler, optical splitter, or other device may be a passive optical device; specifically, it may be a device that does not require power support when distributing data signals between the OLT 110 and ONU 130. Specifically, taking an optical splitter as an example, the optical splitter can be connected to the OLT 110 via a trunk optical fiber and connected to multiple ONU 130 via multiple branch optical fibers, thereby realizing a point-to-multipoint connection between the OLT 110 and ONU 130. In other embodiments, the ODN 120 may also include one or more processing devices, such as optical amplifiers or relay devices. Furthermore, the ODN 120 may specifically extend from the OLT 110 to multiple ONU 130, but it can also be configured in any other point-to-multipoint structure; the embodiments of the present invention are not limited thereto.

[0030] In PON systems, a typical security threat is that an illegitimate ONU impersonates a legitimate ONU to send and receive data, consuming excessive bandwidth, wasting network resources, and preventing legitimate users from registering; or an illegitimate ONU impersonates a successfully registered ONU to steal users' important information. In addition, the OLT is a crucial central office device in the PON system, responsible for the control and management of ONU devices. If an attacker impersonates the OLT and gains control over the numerous ONUs it connects to and manages, it poses a significant security threat to end users.

[0031] Below, based on Figure 1 The PON system 100 shown herein, along with specific embodiments, will be used to describe the secure communication method and apparatus proposed in this application.

[0032] Figure 2 The diagram shown is a flowchart of a secure communication method proposed in this application.

[0033] 210: The OLT sends the first message to the ONU, which includes the first key algorithm, the OLT's certificate, and the OLT's public key.

[0034] The first key algorithm can be information pre-configured on the OLT, or it can be selected and determined by the OLT based on its own algorithm capabilities and the ONU's algorithm capabilities. For example, before performing this step, the OLT first obtains the algorithms supported by the ONU, such as key algorithms, hash algorithms, signature algorithms, or one or more other algorithms. The OLT can obtain the algorithms supported by the ONU in various ways, such as pre-configuring the algorithms supported by the ONU on the OLT, or the OLT initiating an authentication request to the ONU before this step, and the ONU sending its supported algorithms to the OLT. The OLT determines the first key algorithm based on its own supported algorithms and the algorithms supported by the ONU; this first key algorithm is a key algorithm supported by both the OLT and the ONU. The OLT can also determine hash algorithms and signature algorithms supported by both the OLT and the ONU based on configuration information or information obtained from the ONU.

[0035] An OLT certificate is a digital certificate pre-installed on the OLT device or obtained in advance from a certificate server. OLT certificates are issued by the certificate server and are used for authentication, digital signatures, etc. It's important to note that a certificate corresponds to a private key and a public key. The certificate contains the public key information, while the private key is stored on the device holding the certificate. The device can use the private key to sign sent messages, and the receiving end can use the public key to verify the signature.

[0036] The public key of an OLT is typically obtained by the OLT through a key algorithm. For example, the OLT determines the key parameters (p and g) corresponding to the first key algorithm and generates a random number Ys_a as its private key. Then, using the OLT's private key Ys_a and the key parameters (p and g) as input, the OLT's public key Yc_a is calculated according to the first key algorithm. For example, the OLT calculates the public key Yc_a using the following formula:

[0037] Yc_a=g^Ys_a mod p

[0038] It should be noted that the public and private keys of the OLT are two sets of keys, while the public and private keys corresponding to the OLT certificate are two sets of keys.

[0039] In addition, the OLT can also send one or more of the following information in the first message: a set of key parameters used by the OLT, and the hash and signature algorithms determined by the OLT. To enhance security, the OLT can also digitally sign the first message using the private key corresponding to its certificate, ensuring the security and integrity of the first message. It should be noted that the OLT uses specific hash and signature algorithms supported by both the ONU and the OLT to sign the message.

[0040] 220: After the ONU verifies the OLT's certificate, it determines the shared key based on the first key algorithm and the OLT's public key.

[0041] Upon receiving the first message from the OLT, the ONU verifies the validity of the OLT's certificate contained within the message. This verification includes checking if the OLT's certificate has expired, verifying the OLT's secondary certificate, and verifying if the OLT's certificate has been revoked, among other things. If the OLT's certificate verification fails, a failure message is returned to the OLT. Optionally, if the first message contains the OLT's digital signature, the ONU first verifies the OLT's signature information using the public key contained in the OLT's certificate before verifying the OLT's certificate. If the signature verification fails, a failure message is sent back to the OLT; if the signature verification succeeds, the validity of the OLT's certificate is further verified. It should be noted that the ONU can verify the OLT's signature information based on pre-configured signature algorithm information or the signature algorithm information carried in the first message.

[0042] After the ONU successfully verifies the OLT's certificate, it determines the shared key based on the first key algorithm and the OLT's public key. Specifically, the ONU determines the key parameters (p and g) corresponding to the first key algorithm and generates a random number Ys_b as its private key. Then, using the ONU's private key Ys_b and the key parameters (p and g) as input, it calculates the ONU's public key Yc_b according to the first key algorithm. Then, using the key parameter p, the ONU's private key Ys_b, and the OLT's public key Yc_a as input, the ONU calculates the shared key SK according to the first key algorithm. For example, the ONU calculates Yc_b and SK using the following formula:

[0043] Yc_b = g^Ys_b mod p;

[0044] SK = Yc_a^Ys_b mod p

[0045] The shared key SK is used for encryption and security protection of communication between the OLT and ONU. It should be noted that the ONU can determine the key parameters (p and g) corresponding to the first key algorithm in several ways, such as based on pre-configured parameters or based on the set of key parameters used by the OLT carried in the first message.

[0046] 230: The ONU sends a second message to the OLT, the second message including the ONU's certificate and the ONU's public key.

[0047] The ONU's certificate is either pre-installed in the ONU device or is a digital certificate that the ONU device applies for in advance from a certificate server. The ONU's certificate is issued by the certificate server and is used for authentication, digital signatures, etc. Similar to the OLT's certificate, the ONU's certificate also corresponds to a private key and a public key, and the private key and public key corresponding to the ONU's certificate are two separate sets of keys from the ONU's private key and public key.

[0048] To enhance security, the ONU can also digitally sign the second message using the private key corresponding to its certificate, ensuring the security and integrity of the second message. Optionally, the ONU can also include information indicating that it has determined a shared key in the second message.

[0049] 240: After the OLT successfully authenticates the ONU's certificate, it determines the shared key based on the first key algorithm and the ONU's public key.

[0050] Upon receiving the second message from the ONU, the OLT verifies the validity of the ONU's certificate contained in the second message. The verification includes checking if the ONU's certificate has expired, verifying the ONU's secondary certificate, or verifying if the ONU's certificate has been revoked, among other things. If the ONU's certificate verification fails, a failure message is returned to the ONU. Optionally, if the first message contains the ONU's digital signature, the OLT first verifies the ONU's signature information using the public key contained in the ONU's certificate before verifying the ONU's certificate. If the signature verification fails, a failure message is sent back to the ONU; if the signature verification succeeds, the validity of the ONU's certificate is further verified.

[0051] After the OLT successfully verifies the ONU's certificate, it determines the shared key based on the first key algorithm and the ONU's public key. Specifically, the ONU takes the key parameter p, the OLT's private key Ys_a, and the ONU's public key Yc_b as input and calculates the shared key SK using the first key algorithm. For example, the OLT calculates SK using the following formula:

[0052] SK = Yc_b^Ys_a mod p

[0053] Based on the theorem of modular arithmetic (a^b mod P = (a mod P)^b mod P), it can be proven that OLT and ONU can obtain the same shared key by calculating it in the above way.

[0054] Yc_b^Ys_a mod p

[0055] =(g^Ys_b mod p)^Ys_a mod p

[0056] =(g^Ys_b^Ys_a)mod p

[0057] =(g^Ys_a mod p)^Ys_b mod p

[0058] =Yc_a^Ys_b mod p

[0059] Optionally, after determining the shared key, the OLT can also send a message to the ONU, with the message name or message content indicating that the OLT has determined the shared key.

[0060] 250. The ONU and OLT use a shared key for encryption and decryption during communication between the two parties.

[0061] visible, Figure 2The method shown not only enables the OLT to authenticate the ONU, but also allows the ONU to authenticate the legitimacy of the OLT. This achieves two-way authentication between the OLT and ONU without introducing other devices or entities, improving system security and reducing maintenance complexity. Furthermore, after authentication, a shared key is negotiated, and communication between the OLT and ONU is encrypted using this shared key, strengthening data security and enhancing the overall security level of communication.

[0062] based on Figure 2 The method shown is conceptual. Figure 3 An example of implementing this method in a GPON system based on the Optical Network Unit Management and Control Interface (OMCI) is given. The OLT and ONT are information exchange protocols defined in the GPON standard, used for OLT management of ONT in the GPON network, including configuration management, fault management, performance management, and security management.

[0063] 301: The OLT sends a request to the ONU to initiate authentication. The OLT can send this message after receiving the ONU's registration message and completing the ONU's ranging. This message can be implemented using the OMCI protocol's SET message, which carries the OMCI attribute "Initiate two-way certificate authentication".

[0064] 302: After receiving the authentication request from the OLT, the ONU sends an ONU handshake message to the OLT. This message can be implemented by modifying the OMCI attribute value in the AVC message, that is, the AVC message carries the OMCI attribute "ONU handshake"; the ONU handshake specifically includes algorithms supported by the ONU, such as key algorithms (e.g., DH), signature algorithms (e.g., RSA), hash algorithms (e.g., SHA256), etc.

[0065] 310: This message corresponds to Figure 2 The example shown is message 210. Specifically, this can be implemented using the OMCI protocol's SET message, which carries the OMCI attributes "OLT Handshake," "OLT Authentication," and "OLT Key Exchange." The "OLT Handshake" includes the first key algorithm determined by the OLT; "OLT Authentication" includes the OLT's certificate; and "OLT Key Exchange" includes the OLT's public key.

[0066] 320: See step [link / reference] Figure 2 The 220 steps shown will not be repeated here.

[0067] 330: This message corresponds to Figure 2The example shown is message 230. Specifically, this can be achieved by modifying the attribute values ​​of the OMCI protocol in the AVC message. The AVC message carries the OMCI attributes "ONU Authentication" and "ONU Key Exchange". "ONU Authentication" includes the ONU's certificate, and "ONU Key Exchange" includes the ONU's public key.

[0068] 340: See this step. Figure 2 The 240 steps shown will not be repeated here.

[0069] 350: See this step. Figure 2 The 250 steps shown will not be repeated here.

[0070] It should also be noted that the OMCI protocol abstracts the various resources and services managed by the OLT and ONT into a protocol-independent Management Information Base (MIB). The basic information unit of the MIB is the management entity. Under the control of the OLT, the ONT implements the configuration management functions of each ME. Therefore, this embodiment adds a new OMCI entity type, "Authentication Security Entity". Figure 3 The OMCI messages related to authentication and key negotiation carry this "authentication security entity" and the corresponding OMCI attributes. In another embodiment, this can also be achieved by adding a new OMCI message type. Figure 2 The method flow shown includes adding message types such as "ONU Authentication", "ONU Key Exchange", "OLT Handshake", "OLT Authentication" and "OLT Key Exchange".

[0071] This application also provides a device 400. Device 400 can specifically be used to implement the functions of OLT 110 or ONU 130 in the embodiments of this application. For example... Figure 4 As shown, the device includes a processor 401, a memory 402, and a transceiver 403, which are interconnected by lines.

[0072] The processor 401 can be a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), or at least one integrated circuit to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention. The processor can independently possess the function of medium access control (MAC) for PON-related protocols, or it can implement the PON protocol MAC function through an external chip to achieve communication with OLT110 and ONU103. Device 400 may include multiple processors, and each processor may include one or more CPUs. The processor 401 is specifically responsible for executing the methods related to OLT110 or ONU130 in this application and communicating with OLT110 or ONU130 through transceiver 403.

[0073] The memory 402 is used to store program instructions and data. The memory can be a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). When the technical solutions provided in the embodiments of this invention are implemented through software or firmware, the program code used to implement the technical solutions provided in the embodiments of this invention is stored in the memory 402 and executed by the processor 401. The memory 402 can also be used to store information such as algorithms, parameters, and keys described in the embodiments of this application.

[0074] In one embodiment, processor 401 may include memory 402. In another embodiment, processor 401 and memory 402 are two separate structures.

[0075] Transceiver 403 is used to perform the operations of transmitting and receiving signals or data in the above embodiments. Transceiver 403 includes an optical transmitter and / or an optical receiver. The optical transmitter can be used to transmit optical signals, and the optical receiver can be used to receive optical signals. The optical transmitter can be implemented using a light-emitting device, such as a gas laser, a solid-state laser, a liquid laser, a semiconductor laser, a directly modulated laser, etc. The optical receiver can be implemented using a photodetector, such as a photodetector or a photodiode (such as an avalanche diode). Transceiver 403 may also include a digital-to-analog converter and an analog-to-digital converter. Transceiver 403 may also include a wavelength division multiplexer for multiplexing and demultiplexing optical signals of different wavelengths.

[0076] The embodiments of the present invention also have the various beneficial effects described in the above-described method embodiments, which will not be repeated here.

[0077] The present invention also provides a PON secure communication system, which includes the optical line terminal OLT 110 described above and one or more optical network units ONU 130.

[0078] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

Claims

1. A secure communication method, characterized by, The method comprises: The OLT sends a first message to the ONU, the first message comprising a first key algorithm, a key parameter set, a certificate of the OLT and a public key of the OLT, the first key algorithm being a key algorithm supported by both the OLT and the ONU, the key parameter set comprising one or more key parameters; After the certificate of the OLT is verified by the ONU, the ONU determines a shared key according to the first key algorithm, a second key parameter and the public key of the OLT, the second key parameter being one or more key parameters in the key parameter set; The ONU sends a second message to the OLT, the second message comprising a certificate of the ONU and a public key of the ONU; After the certificate of the ONU is verified by the OLT, the OLT determines the shared key according to the first key algorithm, the second key parameter and the public key of the ONU, the shared key determined by the ONU being the same as the shared key determined by the OLT; The ONU and the OLT use the shared key to encrypt communication between the ONU and the OLT.

2. The method of claim 1, wherein, The method further comprises: The ONU receives an authentication request sent by the OLT; The ONU sends a third message to the OLT, the third message comprising a key algorithm supported by the ONU; The OLT determines a first key algorithm according to the key algorithm supported by the ONU and a key algorithm supported by the OLT.

3. The method of claim 1, wherein, The method further comprises: The OLT uses a random number as a private key of the OLT, and the OLT determines a public key of the OLT according to the first key algorithm, a first key parameter and the private key of the OLT, the first key parameter being one or more key parameters in the key parameter set; The ONU uses a random number as a private key of the ONU, and the ONU determines a public key of the ONU according to the first key algorithm, the first key parameter and the private key of the ONU.

4. The method of claim 1, wherein The ONU determines a shared key according to the first key algorithm, a second key parameter and the public key of the OLT, and the method further comprises: The ONU determines the shared key according to the first key algorithm, the second key parameter, the public key of the OLT and the private key of the ONU; and The OLT determines a shared key according to the first key algorithm, the second key parameter and the public key of the ONU, and the method further comprises: The OLT determines the shared key according to the first key algorithm, the second key parameter, the public key of the ONU and the private key of the OLT.

5. The method of claim 1, wherein, The OLT digitally signs the first message using a private key corresponding to the certificate of the OLT, and the ONU digitally signs the second message using a private key corresponding to the certificate of the ONU.

6. The method of claim 1, wherein, The OLT sends the first message to the ONU after receiving the registration message of the ONU.

7. The method of claim 2, wherein, The first message, the second message, the third message and the authentication request are transmitted by optical network terminal management and control interface (OMCI) messages.

8. The method of claim 7, wherein, The authentication message and the first message are OMCI SET messages, and the second message and the third message are OMCI Attribute Value Change (AVC) messages.

9. The method of claim 7, wherein, The first message, the second message, the third message and the authentication request correspond to different message types of OMCI respectively.

10. The method of claim 7, wherein, An identity of the security authentication management entity is further included in the OMCI messages used for transmitting the first message, the second message, the third message and the authentication request.

11. The method according to any one of claims 1 to 10, characterized in that, The second message further includes indication information indicating that the shared key has been generated; after determining the shared key, the OLT further sends the indication information to the ONU, indicating that the shared key has been generated.

12. A secure communication method, characterized by, The method comprises the following steps: The OLT sends a first message to the ONU, wherein the first message includes a first key algorithm, a key parameter set, a certificate of the OLT and a public key of the OLT, the first key algorithm is a key algorithm supported by both the OLT and the ONU, and the key parameter set includes one or more key parameters; The OLT receives a second message from the ONU, wherein the second message includes a certificate of the ONU and a public key of the ONU; After the certificate of the ONU is verified, the OLT determines a shared key according to the first key algorithm, a second key parameter and the public key of the ONU, the second key parameter is one or more key parameters in the key parameter set, the shared key is used for encrypting a session between the OLT and the ONU, and the shared key determined by the ONU is the same as the shared key determined by the OLT.

13. The method of claim 12, wherein, Before the OLT sends the first message, the method further comprises the following steps: The OLT sends an authentication request to the ONU; The OLT receives a third message sent by the ONU, wherein the third message includes a key algorithm supported by the ONU; The OLT determines the first key algorithm according to the key algorithm supported by the ONU and the key algorithm supported by the OLT.

14. The method of claim 12, wherein, The method further comprises the following steps: The OLT uses a random number as a private key of the OLT, and determines the public key of the OLT according to the first key algorithm, a first key parameter and the private key of the OLT, the first key parameter is one or more key parameters in the key parameter set.

15. The method of claim 12, wherein, The OLT determines the shared key according to the first key algorithm, a second key parameter and the public key of the ONU, and specifically comprises the following steps: The OLT determines the shared key according to the first key algorithm, the second key parameter, the public key of the ONU and the private key of the OLT.

16. The method of claim 12, wherein, The OLT digitally signs the first message by using a private key corresponding to the certificate of the OLT.

17. The method of claim 12, wherein, The OLT sends the first message to the ONU after receiving the registration message of the ONU.

18. The method of claim 13, wherein, The first message, the second message, the third message and the authentication request are transmitted through optical network terminal management and control interface (OMCI) messages.

19. The method of claim 18, wherein, The authentication message and the first message are OMCI SET messages; the second message and the third message are OMCI attribute value change (AVC) messages.

20. The method of claim 18, wherein, The first message, the second message, the third message and the authentication request correspond to different message types of OMCI respectively.

21. The method of claim 18, wherein, The OMCI messages used for transmitting the first message, the second message, the third message and the authentication request further comprise an identifier of a security authentication management entity.

22. The method according to any one of claims 12-21, characterized in that, The second message further comprises indication information indicating that a shared key has been generated; after determining the shared key, the OLT further sends the indication information to the ONU, indicating that the shared key has been generated.

23. A method of secure communication, characterized by The method comprises: The ONU receives the first message sent by the OLT, wherein the first message comprises a first key algorithm, a key parameter set, a certificate of the OLT and a public key of the OLT, the first key algorithm is a key algorithm supported by the OLT and the ONU, and the key parameter set comprises one or more key parameters; After the certificate of the OLT is verified, the ONU determines a shared key according to the first key algorithm, a second key parameter and the public key of the OLT, the second key parameter is one or more key parameters in the key parameter set, and the shared key is used for encrypting a session between the OLT and the ONU; The ONU sends a second message to the OLT, wherein the second message comprises a certificate of the ONU and a public key of the ONU, the public key of the ONU is used for enabling the OLT to determine the shared key, and the shared key determined by the ONU is the same as the shared key determined by the OLT.

24. The method of claim 23, wherein, The method further comprises: The ONU receives an authentication request sent by the OLT; The ONU sends a third message to the OLT, wherein the third message comprises a key algorithm supported by the ONU.

25. The method of claim 23, wherein, The method further comprises: The ONU takes a random number as a private key of the ONU, and determines the public key of the ONU according to the first key algorithm, a first key parameter and the private key of the ONU, the first key parameter being one or more key parameters in the key parameter set.

26. The method of claim 23, wherein The ONU determines the shared key according to the first key algorithm, a second key parameter and the public key of the OLT, and specifically comprises: The ONU determines the shared key according to the first key algorithm, the second key parameter, the public key of the OLT and the private key of the ONU.

27. The method of claim 23, wherein, The ONU digitally signs the second message using a private key corresponding to a certificate of the ONU.

28. The method of claim 23, wherein, The ONU receives the first message after sending the registration message to the OLT.

29. The method of claim 24, wherein, The first message, the second message, the third message and the authentication request are transmitted through optical network terminal management and control interface (OMCI) messages.

30. The method of claim 29, wherein, The authentication message and the first message are OMCI SET messages, and the second message and the third message are OMCI attribute value change (AVC) messages.

31. The method of claim 29, wherein, The first message, the second message, the third message and the authentication request correspond to different message types of the OMCI respectively.

32. The method of claim 29, wherein, An identifier of the security authentication management entity is further included in the OMCI messages used to transmit the first message, the second message, the third message and the authentication request.

33. The method of any one of claims 23-32, wherein, The second message further includes indication information indicating that the shared key has been generated.

34. An optical line termination, comprising: The OLT comprises a processor, a memory and a transceiver, wherein, The transceiver is configured to transceive signals or data; The memory is configured to store program instructions; The processor is configured to execute the program instructions stored in the memory, and when the program is executed, the OLT performs the method according to any one of claims 12-22.

35. An optical network unit, comprising: The ONU comprises a processor, a memory and a transceiver, wherein, The transceiver is configured to transceive signals or data; The memory is configured to store program instructions; The processor is configured to execute the program instructions stored in the memory, and when the program is executed, the ONU performs the method according to any one of claims 23-33.

36. A PON secure communication system, comprising: The PON secure communication system comprises the OLT according to claim 34 and the ONU according to claim 35.

Images