A management method of a secure cloud OLT device

Abstract

The application discloses a kind of management methods of secure cloud OLT equipment, it is related to equipment management field, and the specific management method of the secure cloud OLT equipment is as follows: S1, OLT equipment sends encrypted discovery message;S2, after client receives the discovery message of OLT equipment, decryption discovery message;The management method of the secure cloud OLT equipment, through OLT equipment sends encrypted discovery message, after client receives the discovery message of OLT equipment, decryption discovery message, can guarantee that the equipment of access client is all permitted equipment, avoid the equipment of access is not permitted equipment to cause system damage, by checking whether the MAC address of equipment is bound by user can avoid the waste of resources due to the empty equipment sent, by generating through tunnel can be accessed OLT equipment by user, simultaneously by setting the inspection function of adjacent through tunnel overlapping area, can guarantee the signal pass rate of adjacent through tunnel, avoid causing signal interference.

Description

TECHNICAL FIELD

[0001] The present application relates to a device management technology, in particular to a management method of a secure cloud OLT device. BACKGROUND

[0002] Under the fiber access networking architecture, there are a large number of optical network unit or optical network terminal devices in the access network, which are collectively referred to as optical network units (ONUs) for convenience of description. In order to manage the ONU devices, the current implementation scheme is that the optical line terminal manages the ONU through the operation management and maintenance or the ONT management control interface proxy.

[0003] The specific implementation of the scheme is as follows: the OLT publishes a unified public network management IP address to the outside, and can access the ONU carried by the OLT through the public network management IP address and perform simple management protocol management business management system sends an SNMP message to access the ONU according to the public network management IP address of the ONU in the OLT, and the SNMP message carries the frame number / slot number / port optical network terminal identification information of the OLT. The OLT receives the SNMP message forwarded through the public network, obtains the OLT / frame / slot / port / ONT ID information in the SNMP message, and converts the SNMP message into an OAM / OMCI message (OAM is used in the EPON system, and OMCI is used in the GPON system), and sends it to the corresponding ONU device through the passive optical network line management channel.

[0004] The existing OLT device is difficult to troubleshoot when used with the sinking OLT on the access network side, and the adjacent two communication lines exist mutual interference when the existing OLT device is connected to the network. SUMMARY

[0005] The purpose of the present application is to provide a management method of a secure cloud OLT device to solve the above-mentioned deficiencies in the prior art.

[0006] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme: a management method of a secure cloud OLT device, the specific management method of the secure cloud OLT device is:

[0007] S1, the OLT device sends an encrypted discovery message;

[0008] S2, after the client receives the discovery message of the OLT device, the discovery message is decrypted;

[0009] S3, check whether the MAC address of the device is bound by the user, if the check result is that the MAC address is not bound by the user, discard the message sent in S1;

[0010] S4, if the result of step S3 is that the MAC address is bound by the user equipment, then key negotiation is performed;

[0011] S5, if the key negotiation in step S4 is passed, a through tunnel is dynamically generated, and the user can access the OLT device through the generated through tunnel.

[0012] Further, the specific way in which the OLT device encrypts the packet is as follows:

[0013] A1, after the client scans the packet to be encrypted, the client passes the original packet and the packet path of the new packet to the packet filtering driver, and the packet filtering driver calls a self-defined function StaticFileEncrypt for processing;

[0014] A2, the IoCreatFile function is called to open the original packet, the packet handle is obtained, and the rdbuf function is called to obtain the byte stream of the packet;

[0015] A3, the client calls a key generation function to generate a symmetric encryption key for the packet, and uses the public key to complete asymmetric encryption and then passes it to the packet filtering driver, and the packet filtering driver combines the key and other information to construct an encryption identifier and write it into the header of the byte stream;

[0016] A4, the byte stream is redirected to the new packet, that is, the original packet content is written into the new packet, in the process, the IRP_MJ_WRITE message of the IO manager is triggered, the packet filtering driver intercepts and enters the PreWrite callback routine, first preprocesses the IRP, and filters out the IRP that does not meet the encryption condition;

[0017] A5, the buffer where the data to be encrypted is located is obtained through the iopb in the callback information;

[0018] A6, the encryption and decryption key in the form of ciphertext is obtained from the EncryptKey parameter of the encryption identifier, and the private key is used for asymmetric decryption to obtain the key in the form of plaintext;

[0019] A7, the ExAllocatePoolWithTag function is called to apply a data buffer with a length of iopb->Parameters.Write.Length in the kernel space;

[0020] A8, the RtlCopyMemory function is called to copy the data in the buffer obtained in step A2 to the newly applied buffer;

[0021] A9, the File_EncryptBuffer function is used to encrypt the data in the buffer using the AES encryption algorithm and the key.

[0022] Further, the specific method for cloud decryption message is:

[0023] B1, enter the PreWrite callback routine, first preprocess the IRP, filter out the IRP that does not meet the decryption condition;

[0024] B2, the IRP that meets the decryption condition will be sent to the message system driver, and when the message system driver reads out the message ciphertext data and returns the request to the IO manager, the message filter driver intercepts the request and enters the PostRead callback routine;

[0025] B3, obtain the buffer where the data to be decrypted is located through iopb in the callback information, which can be obtained through two ways, judge whether iopb->Parameters.Read.MdlAddress is empty;

[0026] B4, obtain the data length of the message, judge whether the data length is 0 through Data->IoStatus.Information, if the read data length is 0, do not perform any processing, return the request to the I / O manager;

[0027] B5, obtain the decryption identifier of the message, analyze the decryption identifier, and determine whether the message needs to be decrypted according to the flag bit in the identifier;

[0028] B6, obtain the ciphertext form of the encryption and decryption key from the EncryptKey parameter of the decryption identifier, and use the private key to perform asymmetric decryption to obtain the plaintext form of the key;

[0029] B7, call the ExAllocatePoolWithTag function to allocate a data buffer with a length of iopb->Parameters.Read.Length in the kernel space;

[0030] B8, use the AES decryption algorithm and the key to decrypt the data in the original buffer through the File_EncryptBuffer function and put it into the new buffer;

[0031] B9, copy the message plaintext data in the kernel buffer to the buffer in the monitoring layer space;

[0032] B10, release the memory space storing the plaintext form of the key, and release the buffer storing the message plaintext data, complete the PostRead callback routine, return the request, and end the decryption process.

[0033] Further, the preparation step for key negotiation is:

[0034] C1, public key generation:

[0035] Determine the security parameter l, select the cyclic group G, wherein the order of G is a large prime number q, the generator is P, wherein q>2 l , the receiving end selects a private key s∈Z q * , calculates P pub =sP, selects a hash function H1;{0,1} LU ×G 2 →Z q * , H2;{0,1} LU ×{0,1} LU ×G 2 →Z q * , H3;{0,1} LU ×{0,1} LU ×G 5 →{0,1} K , wherein L U is the number of identity identification, the MAC address is set as user A, and the user equipment is set as user B;

[0036] C2, node registration:

[0037] 1, secret value generation: user A selects X A ∈Z q * , calculates X A =x A P:

[0038] 2, partial private key generation; A sends X A , ID A to the receiving end through a secure channel, and the receiving end selects a random number r A ∈Z q *， calculates R A =r A P, generates a user partial private key D A =sH1(ID A , R A , X A )+r A , and the system sends D A , R A to user A, wherein D A , R A are sent by a public channel:

[0039] 3, partial private key legality verification: through D A P n =R A +H1(ID A , RA , X A )P pub ;

[0040] C3, the complete public key of node A after node registration is composed of <X A , R A >, and the complete private key is composed of <x A , D A >.

[0041] Further, the specific way of performing key agreement is:

[0042] D1, the user A selects a random temporary private key a∈Z q * , calculates T A =aP, signs g A =a+H2(ID A , ID B , X B , T A ), and sends g A , ID A , R A , T A , X A to the user B;

[0043] D2, verify whether the equation g A P n =T A +H2(ID A , ID B , X B , T A )(R A +H1(ID A , R A , X A )P pub ) is established;

[0044] D3, if the equation in step D2 is established, the key agreement is passed.

[0045] Further, the generation way of the tunnel is:

[0046] E1, calculate the received power of the through tunnel, and the specific calculation formula is as follows:

[0047] ,

[0048] Where P r and P i represent the received and transmitted power of the through tunnel respectively, Gi is the signal gain, Gr is the signal loss on the radius, and l is the distance between the through channel side wall and the signal;

[0049] E2, calculate the distance l of the adjacent two through channels r , the specific calculation formula is as follows:

[0050] ;

[0051] E3, calculate the half central angle theta of the intersection point of the intersecting through tunnel and the signal center, and the specific calculation formula is as follows:

[0052] ;

[0053] E4, calculate the sector area on one side, and the specific calculation formula is as follows:

[0054] ;

[0055] E5, calculate the overlapping area of the adjacent through tunnels in the same plane, and the specific calculation formula is as follows:

[0056] .

[0057] Compared with the prior art, the management method of the safe cloud OLT device provided by the application can ensure that the devices accessed by the client are all permitted devices, avoid system damage caused by unpermitted devices, avoid resource waste caused by empty devices by checking whether the MAC address of the device is bound by the user, and ensure the signal passing rate of the adjacent through tunnels by setting the overlapping area checking function of the adjacent through tunnels, and avoid signal interference. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below, and obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art according to these drawings.

[0059] Figure 1 The overall flow structure schematic diagram provided by the embodiments of the present application. DETAILED DESCRIPTION

[0060] In order to make those skilled in the art better understand the technical solutions of the present application, the present application will be further described in detail below with reference to the drawings.

[0061] Please refer to Figure 1A kind of management method of secure cloud OLT device, the specific management method of secure cloud OLT device is:

[0062] S1, OLT device sends encrypted discovery message;

[0063] S2, after client receives the discovery message of OLT device, the discovery message is decrypted;

[0064] S3, check whether the MAC address of the device is bound by user, if the check result is that MAC address is not bound by user, then the message sent in S1 is discarded;

[0065] S4, if the check result of step S3 is that MAC address is bound by user device, then key negotiation is carried out;

[0066] S5, if the key negotiation in step S4 is passed, then dynamic generation is passed through tunnel, and the user can access OLT device through the generated pass-through tunnel.

[0067] Thus the specific management method of secure cloud OLT device is that encrypted discovery message is sent by OLT device, and after client receives the discovery message of OLT device, the discovery message is decrypted, which can ensure that the devices accessed by client are allowed devices, avoid system damage caused by unallowed devices, check whether the MAC address of the device is bound by user, if the check result is that MAC address is not bound by user, then the message sent is discarded, if the check result is that MAC address is bound by user device, which can ensure that OLT device is all bound by user, avoid resource waste caused by empty device, then key negotiation is carried out, if the key negotiation is passed, then dynamic generation is passed through tunnel, and the user can access OLT device through the generated pass-through tunnel, and the check function of overlapping area of adjacent pass-through tunnel can ensure the signal passing rate of adjacent pass-through tunnel, avoid signal interference.

[0068] The specific way of OLT device encrypted message is:

[0069] A1, after client executes to be encrypted message scanning, the message path of original message and newly-built message is passed to message filtering driver, and message filtering driver calls a self-defined function StaticFileEncrypt for processing;

[0070] A2, open original message by calling IoCreatFile function, obtain message handle, and call rdbuf function to obtain message byte stream;

[0071] A3, the client calls the key generation function to generate the symmetric encryption key for the message encryption, and uses the public key to complete the asymmetric encryption and then passes it to the message filtering driver, the message filtering driver combines the key and other information to construct the encryption identifier and writes it into the header of the byte stream;

[0072] A4, the byte stream is redirected to the new message, i.e. the original message content is written into the new message, in this process, the IRP_MJ_WRITE message of the IO manager is triggered, the message filtering driver intercepts it and enters the PreWrite callback routine, first preprocesses the IRP, and filters out the IRP that does not meet the encryption condition;

[0073] A5, the buffer where the data to be encrypted is located is obtained through iopb in the callback information;

[0074] A6, the encryption and decryption key in the form of ciphertext is obtained from the EncryptKey parameter of the encryption identifier, and the private key is used for asymmetric decryption to obtain the key in the form of plaintext;

[0075] A7, the ExAllocatePoolWithTag function is called to apply a data buffer with a length of iopb->Parameters.Write.Length in the kernel space;

[0076] A8, the RtlCopyMemory function is called to copy the data in the buffer obtained in step A2 to the newly applied buffer;

[0077] A9, the data in the buffer is encrypted by using the AES encryption algorithm and the key through the File_EncryptBuffer function.

[0078] In this way

[0079] The specific method of decrypting the message in the cloud is as follows:

[0080] B1, enter the PreWrite callback routine, first preprocess the IRP, and filter out the IRP that does not meet the decryption condition;

[0081] B2, the IRP that meets the decryption condition will be sent to the message system driver, when the message system driver reads out the message ciphertext data and returns the request to the IO manager, the message filtering driver intercepts the request and enters the PostRead callback routine;

[0082] B3, the buffer where the data to be decrypted is located is obtained through iopb in the callback information, the buffer can be obtained through two ways, whether iopb->Parameters.Read.MdlAddress is empty is determined;

[0083] B4, get the data length of the message, judge whether the data length is 0 by Data->IoStatus.Information, if the data length read is 0, do not perform any processing, return the request to the I / O manager;

[0084] B5, get the decryption identification of the message, parse the decryption identification, and determine whether the message needs to be decrypted according to the flag bit in the identification;

[0085] B6, get the encryption key in the form of ciphertext from the EncryptKey parameter of the decryption identification, and perform asymmetric decryption using the private key to obtain the key in the form of plaintext;

[0086] B7, call the ExAllocatePoolWithTag function to apply a data buffer with a length of iopb->Parameters.Read.Length in the kernel space;

[0087] B8, use the AES decryption algorithm and the key to decrypt the data in the original buffer by the File_EncryptBuffer function and put it into a new buffer;

[0088] B9, copy the message plaintext data in the kernel buffer to the buffer in the monitoring layer space;

[0089] B10, release the memory space storing the key in the form of plaintext, and release the buffer storing the message plaintext data, complete the PostRead callback routine, return the request, and end the decryption process.

[0090] Thus, the setting

[0091] The preparation step for key negotiation is:

[0092] C1, public key generation:

[0093] Determine the security parameter l, select the cyclic group G, where the order of G is a large prime number q, and the generator is P, where q>2 l , the receiving end selects the private key s∈Z q * , calculate P pub =sP, select a hash function H1;{0,1} LU ×G 2 →Z q * , H2;{0,1} LU ×{0,1} LU ×G 2 →Z q * , H3;{0,1} LU ×{0,1}LU x G 5 → {0, 1} K where L U is the number of bits of the identity, the MAC address is set as user A, and the user equipment is set as user B;

[0094] C2, node registration:

[0095] 1, secret value generation: user A selects X A ∈ Z q * , calculates X A = x A P:

[0096] 2, partial private key generation; A sends X A , ID A to the receiving end through a secure channel, and the receiving end selects a random number r A ∈ Z q *， calculates R A = r A P, generates a user partial private key D A = sH1(ID A , R A , X A ) + r A , and the system sends D A , R A to user A, wherein D A , R A are sent by a public channel:

[0097] 3, partial private key legality verification: through D A P n = R A + H1(ID A , R A , X A )P pub ;

[0098] C3, after the node registration is completed, the complete public key of node A is composed of <X A , R A >, and the complete private key is composed of <x A , D A >.

[0099] The specific way of key negotiation is:

[0100] D1, user A selects a random temporary private key a q ∈ Z * , calculates T A = aP, and signs g A = a + H2(IDA , ID B , X B , T A ), sends g A , ID A , R A , T A , X A to user B;

[0101] D2, verifies g A P n = T A + H2(ID A , ID B , X B , T A )(R A + H1(ID A , R A , X A )P pub ) whether the equation is correct;

[0102] D3, if the equation in step D2 is correct, the key agreement is passed.

[0103] The generation mode of the tunnel is:

[0104] E1, calculate the received power through the tunnel, the specific calculation formula is as follows:

[0105] ,

[0106] Where P r and P i represent the received and transmitted power through the tunnel respectively, Gi is the signal gain, Gr is the signal loss on the radius, and l is the distance between the passenger channel side wall and the signal;

[0107] E2, calculate the distance l r between the two adjacent passenger channels, the specific calculation formula is as follows:

[0108] ;

[0109] E3, calculate the half central angle θ of the intersection point of the intersecting tunnel and the signal center, the specific calculation formula is as follows:

[0110] ;

[0111] E4, calculate the sector area on one side, the specific calculation formula is as follows:

[0112] ;

[0113] E5, calculate the overlapping area of adjacent through tunnels on the same plane, the specific calculation formula is as follows:

[0114] ,

[0115] In the generation process of through tunnels, only need to ensure that S is the minimum value, the mutual interference of adjacent through tunnels can be ensured to be minimum.

[0116] Working principle: when using, the encrypted discovery packet is sent through the OLT device, and the client receives the discovery packet of the OLT device, and decrypts the discovery packet, so that the device accessed by the client is the allowed device, avoiding the system damage caused by the device not allowed to access, checking whether the MAC address of the device is bound by the user, if the check result is that the MAC address is not bound by the user, the sent packet is discarded, if the check result is that the MAC address is bound by the user device, such setting can ensure that the OLT device is the device bound by the user, avoiding the waste of resources caused by the empty device, then the key negotiation is carried out, if the key negotiation is passed, the through tunnel is dynamically generated, the user can access the OLT device through the generated through tunnel, and the signal passing rate of adjacent through tunnels can be ensured through the setting of the overlapping area checking function of adjacent through tunnels, avoiding signal interference.

[0117] The above only describes some exemplary embodiments of the present application in a descriptive manner, without doubt, for ordinary skilled in the art, the described embodiments can be modified in various ways without departing from the spirit and scope of the present application. Therefore, the above drawings and description are illustrative in nature, and should not be understood as limiting the scope of protection of the claims of the present application.

Claims

1. A management method for a secure cloud OLT device, characterized in that, The specific management method for the aforementioned secure cloud OLT device is as follows: S1, the OLT device sends an encrypted discovery message; S2, after receiving the discovery message from the OLT device, the client decrypts the discovery message; S3, check whether the device's MAC address is bound by the user. If the check result is that the MAC address is not bound by the user, then discard the message sent in S1. S4. If the result of step S3 is that the MAC address is bound to the user equipment, then key negotiation is performed. S5. If the key negotiation in step S4 is successful, a tunnel is dynamically generated, which allows users to access the OLT device. The method for generating the tunnel is as follows: E1, calculate the received power through the tunnel, the specific calculation formula is as follows: , Where P r and P i G represents the power received and transmitted through the tunnel, respectively. i For signal gain, G r The signal loss is denoted by l, where l is the distance between the passenger passage sidewall and the signal. E2, calculate the distance l between two adjacent passenger passages. r The specific calculation formula is as follows: ; E3, calculate the half-central angle θ between the intersection point passing through the tunnel and the center of the signal circle. The specific calculation formula is as follows: ; E4, calculate the area of ​​one side of the sector. The specific calculation formula is as follows: ; E5, calculate the overlapping area of ​​adjacent tunnels on the same plane. The specific calculation formula is as follows: ; During the tunnel generation process, S is at its minimum value, and the mutual interference between adjacent tunnels is minimized.

Images