Gateway management method, device and system in FTTR network

Abstract

A gateway management method, device and system in an FTTR network, the method is applied to a main gateway, and the method comprises the following steps: after a sub-gateway carries out authentication by using standard authentication information which is allowed to be shared by a plurality of devices and the authentication is passed, controlling a bandwidth value allocated by the sub-gateway to be less than a preset maximum value, obtaining private authentication information independently used by the sub-gateway; and if the private authentication information of the sub-gateway is obtained and the authentication of the private authentication information is passed, controlling the bandwidth value allocated to the sub-gateway to be the maximum value.

Description

Technical Field

[0001] The present invention relates to optical fiber communication technology, and more particularly to a method, device and system for managing gateways in an FTTR network. Background Art

[0002] Fiber to the Room (FTTR) is a home all-optical network that lays optical fiber to every room and interconnects with the home gateway by deploying edge optical network units (ONUs), thus ensuring the high-quality development of new business applications such as online education, home office, and home entertainment. The FTTR network consists of a main gateway, a sub-gateway, and an optical network, and has the advantages of high bandwidth, true gigabit to the room, seamless roaming, and imperceptible switching.

[0003] In the FTTR application scenario, the sub-gateway is required to have the plug-and-play feature, and the main gateway is required to have interoperability with sub-gateways from different manufacturers. The sub-gateway is connected to the passive optical network (Passive Optical Network, PON) interface of the main gateway through an optical link, and the standard PON network registration and authentication process is used between the main gateway and the sub-gateway. In the prior art, the authentication information used by the sub-gateway can be easily obtained, so there are illegal optical network devices (Optical Network Terminal, ONT) that use this authentication information to successfully register with the main gateway, consuming the bandwidth of the main gateway and causing a waste of the bandwidth resources of the main gateway. Summary of the invention

[0004] The embodiments of the present application provide a method, device and system for managing gateways in an FTTR network.

[0005] A method for managing a gateway in an FTTR network, applied to a main gateway, the method comprising:

[0006] After the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, controlling the bandwidth value allocated to the sub-gateway to be less than a preset maximum value, and obtaining private authentication information used solely by the sub-gateway;

[0007] If the private authentication information of the sub-gateway is acquired and the private authentication information is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value.

[0008] A method for managing a gateway in an FTTR network, applied to a sub-gateway, the method comprising:

[0009] Authenticate to the main gateway using standard authentication information that allows multiple devices to share;

[0010] After detecting that the standard authentication information is authenticated, the private authentication information of the sub-gateway is used to perform an authentication operation on the main gateway, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

[0011] A management device for a gateway in an FTTR network, applied to a main gateway, the device comprising:

[0012] A first management module, configured to control the bandwidth value allocated to the sub-gateway to be less than a preset maximum value after the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, and to obtain private authentication information used solely by the sub-gateway;

[0013] The second management module is configured to control the bandwidth value allocated to the sub-gateway to be the maximum value if the private authentication information of the sub-gateway is acquired and the private authentication information is authenticated.

[0014] A management device for a gateway in an FTTR network, applied to a sub-gateway, the device comprising:

[0015] A first authentication module, used to perform an authentication operation on the main gateway using standard authentication information that allows multiple devices to share;

[0016] The second authentication module is used to perform an authentication operation on the main gateway using the private authentication information of the sub-gateway after detecting that the standard authentication information is authenticated, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

[0017] A management system for gateways in an FTTR network comprises the main gateway described above and at least one sub-gateway described above.

[0018] In the embodiment of the present application, after the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, the bandwidth value allocated to the sub-gateway is controlled to be less than a preset maximum value, and then the private authentication information of the sub-gateway is authenticated, so as to correctly identify the sub-gateway with legal access. After the private authentication information of the sub-gateway is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value, ensuring that the sub-gateway with legal access can use the bandwidth of the main gateway to the maximum extent, thereby ensuring the rational use of bandwidth resources.

[0019] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained by the schemes described in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0021] Figure 1 A schematic diagram of a flow chart of a method for managing a gateway in an FTTR network provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of the structure of a data field in an Ethernet frame provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of the interaction of the main gateway with respect to the sub-gateway during the identity authentication process provided in the embodiment of the present application;

[0024] Figure 4 A schematic diagram of a flow chart of a method for managing a sub-gateway by a main gateway provided in an embodiment of the present application;

[0025] Figure 5 A flowchart of another method for managing a gateway in an FTTR network provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of a gateway management device in an FTTR network provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of another gateway management device in an FTTR network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0029] The present application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features and elements disclosed in the present application may also be combined with any conventional features or elements to form a unique invention scheme. Any features or elements of any embodiment may also be combined with features or elements from other invention schemes to form another unique invention scheme. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the attached claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the attached claims.

[0030] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0031] Figure 1 The present invention provides a flow chart of a method for managing a gateway in an FTTR network. Figure 1 As shown, the method is applied to the main gateway, and the method includes:

[0032] Step 101: After the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, the bandwidth value allocated to the sub-gateway is controlled to be less than a preset maximum value, and private authentication information used solely by the sub-gateway is obtained;

[0033] For gateways, standard authentication information is the authentication information provided by the gateway, which is used for authentication operations by multiple devices such as terminals and sub-gateways. The standard authentication information is usually an account number and password, which is recorded on the nameplate of the gateway product. Therefore, there is a risk of information leakage in the standard authentication information.

[0034] In view of the security risks of standard authentication information, after the sub-gateway uses the standard authentication information that allows multiple devices to be shared for authentication and the authentication is passed, based on information security considerations, the main gateway cannot rule out the possibility of illegal access to the sub-gateway. Therefore, the main gateway cannot fully authorize the sub-gateway based on the standard authentication information. Therefore, the main gateway controls the bandwidth value allocated to the sub-gateway to be less than the preset maximum value, for example, the allocated bandwidth value is the preset minimum value; on the one hand, it can temporarily provide data transmission services for the sub-gateway, and on the other hand, it limits the use of bandwidth resources by the sub-gateway to a certain extent, ensuring the normal use of bandwidth resources by fully authorized devices accessing the main gateway.

[0035] Since the main gateway has not completed the authorization of the sub-gateway, the main gateway needs to perform a second authentication on the sub-gateway. The second authentication uses the private authentication information used by the sub-gateway alone. Since the private authentication information is only used by the sub-gateway alone, the risk of information leakage is reduced, and data support is provided for the main gateway to determine whether the sub-gateway can obtain full authorization.

[0036] Step 102: If the private authentication information of the sub-gateway is obtained and the private authentication information is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value;

[0037] Optionally, if the private authentication information of the sub-gateway is not obtained, or the private authentication information of the sub-gateway is obtained but the private authentication information fails to be authenticated, the bandwidth value allocated to the sub-gateway is controlled to be a preset minimum value.

[0038] Specifically, if the private authentication information of the sub-gateway can be obtained, the sub-gateway has the authentication information required to perform the second authentication, indicating that the sub-gateway has the possibility of obtaining full authorization; otherwise, the sub-gateway cannot perform the second authentication operation, indicating that the sub-gateway is a device that illegally accesses the main gateway.

[0039] Furthermore, if the private authentication information of the sub-gateway is authenticated, it means that there is no possibility of illegal access to the sub-gateway, and the main gateway can fully authorize the sub-gateway, indicating that the sub-gateway is a device that legally accesses the main gateway; otherwise, it means that there is a possibility of illegal access to the main gateway by the sub-gateway, so the sub-gateway cannot obtain full authorization from the main gateway.

[0040] For a sub-gateway that is legally connected to the main gateway, the main gateway controls the bandwidth value allocated to the sub-gateway to be the maximum value to ensure that the sub-gateway can use the bandwidth of the main gateway to the maximum extent.

[0041] For a sub-gateway that illegally accesses the main gateway and a sub-gateway that may illegally access the main gateway, since the sub-gateway can complete the first authentication through standard authentication information, the sub-gateway is allowed to continue to access the main gateway in accordance with the principle of complying with the standard authentication process of PON. However, by controlling the bandwidth value allocated to the sub-gateway to a preset minimum value, the use of bandwidth resources by the sub-gateway is limited to the greatest extent, thereby ensuring the normal use of bandwidth resources by legal access devices accessing the main gateway.

[0042] Through the above analysis, it can be seen that the method provided in the embodiment of the present application, after the sub-gateway uses the standard authentication information that allows multiple devices to be shared for authentication and the authentication is passed, the bandwidth value allocated to the sub-gateway is controlled to be less than the preset maximum value, and then the private authentication information of the sub-gateway is authenticated, so as to correctly identify the sub-gateway with legal access. After the private authentication information of the sub-gateway is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value, ensuring that the sub-gateway with legal access can use the bandwidth of the main gateway to the maximum extent, and ensuring the rational use of bandwidth resources.

[0043] In addition, for illegally accessed sub-gateways, under the principle of complying with the standard authentication process of PON, the sub-gateway is allowed to access the main gateway, but by controlling the bandwidth value allocated to the sub-gateway to a preset minimum value, the use of bandwidth resources by the sub-gateway is limited to the greatest extent, ensuring the normal use of bandwidth resources by other devices accessing the main gateway, and avoiding illegal use of the main gateway by illegally accessed sub-gateways.

[0044] The method provided in the embodiment of the present application is described below:

[0045] In one implementation, private authentication information of the sub-gateway is manually created on the main gateway, and corresponding private authentication information is manually input on the sub-gateway, so that the sub-gateway completes the second authentication operation by sending the private authentication information to the main gateway.

[0046] Since the above implementation method requires the participation of operators, it cannot meet the plug-and-play requirements of the sub-gateway. In response to this technical problem, this application proposes the following solutions, including:

[0047] Before acquiring the private authentication information used solely by the sub-gateway, the main gateway generates the private authentication information of the sub-gateway and sends the private authentication information to the sub-gateway.

[0048] In the above implementation, since the private authentication information of the sub-gateway is generated by the main gateway, the operating steps of the operator to create the private authentication information of the sub-gateway on the main gateway are omitted; in addition, the private authentication information is sent to the sub-gateway through the main gateway, which eliminates the operating steps of the operator entering the corresponding private authentication information on the sub-gateway, thereby meeting the plug-and-play usage requirements of the sub-gateway.

[0049] Furthermore, in order to ensure the legal issuance of private authentication information and avoid issuing private authentication information to illegal devices, the identity of the sub-gateway may be authenticated before the private authentication information is sent to the sub-gateway.

[0050] In one implementation, the protocol stack of OMCI (ONU Management and Control Interface) is customized to construct a private data format for identity authentication.

[0051] Since this method is only applicable to sub-gateways that have the processing capability of the private data format, such as the main gateway and sub-gateways of the same manufacturer, it is not applicable to devices from different manufacturers or older versions of the same manufacturer, as they do not have the processing capability of the private data format. Therefore, the above method is not universal.

[0052] To solve the above technical problems, this application proposes the following solutions, including:

[0053] The identity authentication of the sub-gateway is completed by exchanging data with the sub-gateway using a layer 2 message. After the identity authentication is passed, private authentication information of the sub-gateway is generated, and a layer 2 message carrying the private authentication information is sent to the sub-gateway.

[0054] Layer 2 messages are usually transmission units working at the data link layer, among which Ethernet frames are the most common Layer 2 message format. The basic structure of an Ethernet frame includes fields such as destination address, source address, type (Type), data (Data), and cyclic redundancy check (CRC). Among them, the Ethernet layer of an Ethernet frame includes a destination address, a source address, and a protocol number. In an embodiment of the present application, the protocol number of a Layer 2 message can be customized, for example, the protocol number is 0x9666. The data layer includes type (Type) and data (Data).

[0055] Since the Layer 2 message is a message working at the data link layer, network devices (such as the main gateway and the sub-gateway) have the data processing capability for the Layer 2 message. Therefore, using the Layer 2 message to carry the interactive data required for identity authentication has high versatility.

[0056] Furthermore, the data field of the layer 2 message can accommodate enough bytes of data. For example, the data field of the Ethernet frame is 46 to 1500 bytes of data, and padding is required when it is less than 46 bytes. Therefore, the number of bytes in the digital field of the layer 2 message can carry the interactive data in the identity authentication operation. Therefore, the private authentication information generated by the main gateway and the interactive data between the sub-gateway and the main gateway during the identity authentication process are all carried by the data field of the layer 2 message.

[0057] Since both the main gateway and the sub-gateway have high data processing capabilities for Layer 2 messages, without changing the existing communication protocol, the data field of the Layer 2 message is used to carry the interactive data in the identity authentication operation, and the identity authentication operation can be performed while ensuring the universality of the solution.

[0058] In addition, in the communication protocol, the length of the Ethernet frame Type is 2 bytes, which can be used to distinguish the types of Ethernet frames, such as IPv4, IPv6, etc. Different from the general protocol, in the embodiment of the present application, the type field of the layer 2 message is used to distinguish the content carried by the data field in the layer 2 message.

[0059] During the identity authentication process, there may be multiple rounds of data interaction between the main gateway and the sub-gateway, and the effect of each round of data interaction may be different. Therefore, the value of the type field can be used to represent the content carried by the data field, thereby effectively distinguishing the content carried in the data field.

[0060] Optionally, in addition to the interaction data, the data field also carries at least one of a source MAC address and an operation code (opFlag) so that the receiver can quickly complete the parsing of the content.

[0061] Figure 2 The structure diagram of the data field in the Ethernet frame provided by the embodiment of the present application is as follows. Figure 2 As shown, the data field includes source MAC, opFlag and data; the source MAC is consistent with the content carried by the source MAC address field in the Ethernet frame; the default value of opFlag is 0, which can be set as needed; the data is the interaction content between the main gateway and the sub-gateway.

[0062] In order to improve the security of data transmission, the above data fields can be encrypted for transmission.

[0063] The following is an explanation of the identity authentication process:

[0064] Figure 3 The interactive diagram of the main gateway performing identity authentication on the sub-gateway provided in the embodiment of the present application. Figure 3 As shown, the identity authentication process includes:

[0065] Step 303: receiving a registration request message sent by the sub-gateway and carrying a serial number (SN) of the sub-gateway;

[0066] Step 304: Generate a challenge code (challengeCode), and send a registration response message carrying the challenge code to the sub-gateway;

[0067] Step 305: Receive the authentication request information carrying the summary data of the SN and the challenge code sent by the sub-gateway; for example, the summary data can be obtained by processing using the MD5 Message-Digest Algorithm;

[0068] Step 306: If the challenge code in the authentication request information is the same as the locally generated challenge code, and the summary data generated for the SN in the locally received registration request information is the same as the summary data in the authentication request information, send an authentication response message indicating that the authentication result is passed to the sub-gateway.

[0069] Optionally, before step 303, the method further includes:

[0070] Step 301: receiving broadcast search information sent by the sub-gateway and carrying the MAC address of the sub-gateway;

[0071] Step 302: Send a broadcast response message carrying the MAC address of the main gateway to the sub-gateway.

[0072] Among them, step 301 and step 302 are executed after the sub-gateway is powered on for the first time; after the sub-gateway is powered on, when it tries to go online again after being offline due to an abnormal situation, if the main gateway in the FTTR network has not changed, steps 301 and 302 do not need to be executed between the sub-gateway and the main gateway.

[0073] Optionally, after step 306, before the main gateway sends the private authentication information to the sub-gateway, the method further includes:

[0074] Step 307: Receive a heartbeat request message sent by the sub-gateway and carrying the MAC address of the sub-gateway;

[0075] Step 308: Send a heartbeat response message carrying the MAC address of the main gateway to the sub-gateway.

[0076] Among them, step 307 and step 308 can be periodically executed before the sub-gateway sends the private authentication information to ensure that the communication between the sub-gateway and the main gateway is not interrupted, and provide support for the sub-gateway to safely perform the second authentication.

[0077] exist Figure 3 In the process shown, the broadcast search information, the broadcast response information, the registration request information, the registration response information, the authentication request information, the authentication response information, the heartbeat request information and the heartbeat response information are all carried through the data field of the layer 2 message.

[0078] In the embodiment of the present application, the private authentication information can be generated according to the SN of the sub-gateway to improve the uniqueness of the private authentication information, reduce the probability of the private authentication information being cracked, and improve the security of the data.

[0079] Optionally, the authentication request information also includes an encryption key; preferably, the encryption key is a symmetric key so as to establish encrypted transmission between the sub-gateway and the main gateway.

[0080] The authentication response information also includes control information for enabling the encryption key; wherein, after the control information indicates the use of the encryption key, encrypted transmission is implemented between the sub-gateway and the main gateway, wherein the encrypted content may include the authentication result and private authentication information.

[0081] For example, the sending of the layer 2 message carrying the private authentication information to the sub-gateway includes:

[0082] The generated private authentication information is encrypted using the encryption key to obtain an encryption result, and the encryption result is sent.

[0083] Transmitting private authentication information in an encrypted manner can effectively improve the security of information transmission.

[0084] Figure 3 The Type and opFlag settings in the Layer 2 messages used in the interaction process are as follows:

[0085] The value of the Type field is 1, indicating that the sub-gateway broadcasts interactive data of the search operation. When the value of opFlag is 0, it indicates that the sub-gateway issues a master gateway search request when the sub-gateway is powered on and started; when the value of opFlag is 1, it indicates that under abnormal conditions such as sub-gateway registration failure or heartbeat interruption, the sub-gateway re-issues the master gateway search request;

[0086] The value of the Type field is 2, indicating the registration interaction data of the sub-gateway;

[0087] The value of the Type field is 3, indicating the authentication interaction data of the sub-gateway;

[0088] The value of the Type field is 4, indicating the heartbeat data of the sub-gateway;

[0089] The value of the Type field is 5, which means that the main gateway sends the private authentication information of the sub-gateway;

[0090] When the value of the Type field is 2 to 5, the value of opFlag may be 0 by default, or the value of opFlag may be set according to actual needs.

[0091] Based on the settings of Type and opFlag above, Figure 3 The data format of each information in the data layer of the second layer message is described as follows:

[0092] The data format of the broadcast search information in step 301 is shown in Table 1:

[0093] Parameter name type describe type unsigned char The value is 1 apMac string(6) Sub-gateway's MAC address opFlag unsigned char The value is 0 or 1 searchKey string(16) Search target, such as filling in RC_AP

[0094] Table 1

[0095] The data format of the broadcast response information in step 302 is shown in Table 2:

[0096] Parameter name type describe type Unsigned char The value is 1 acMac string(6) MAC address of the primary gateway opFlag unsigned char The value is 0 searchAck string(16) Response field, such as filling in RC_AC

[0097] Table 2

[0098] The data format of the registration request information in step 303 is shown in Table 3:

[0099]

[0100]

[0101] The data format of the registration response information in step 304 of Table 3 is shown in Table 4:

[0102] Parameter name type describe type unsigned char The value is 2 acMac string(6) MAC address of the primary gateway opFlag unsigned char The value is 0 challengeCode string(16) 16-bit random string; for example, uppercase 0 to F

[0103] Table 4 The data format of the authentication request information in step 305 is shown in Table 5:

[0104] Parameter name type describe type unsigned char The value is 3 apMac string(6) Sub-gateway's MAC address opFlag unsigned char The value is 0 checkCode string(16) MD5 result of challengeCode and SN devKey unsigned char Symmetric encryption keys

[0105] Table 5 The data format of the authentication response information in step 306 is shown in Table 6:

[0106] Parameter name type describe type unsigned char The value is 3 acMac string(6) MAC address of the primary gateway opFlag unsigned char The value is 0 respCode unsigned int Device authentication result, 0 means passed, 1 means failed encrypt unsigned char 0 means no encryption, 1 means encryption

[0107] The data format of the heartbeat request information in step 307 of Table 6 is shown in Table 7:

[0108]

[0109]

[0110] Table 7

[0111] The data format of the heartbeat response information in step 308 is shown in Table 8:

[0112] Parameter name type describe type unsigned char The value is 4 acMac string(6) MAC address of the primary gateway opFlag unsigned char The value is 0 respKey string(16) Agreed fields, such as PONG interval unsigned int Heartbeat interval, the default minimum interval is 10 seconds timestamp unsigned int Timestamp

[0113] Table 8

[0114] The data format of the private authentication information sent by the main gateway is shown in Table 9:

[0115] Parameter name type describe type unsigned char The value is 5 acMac string(6) MAC address of the primary gateway opFlag unsigned char The value is 0 encrypt unsigned char Whether to encrypt, 0 means not to encrypt, 1 means to encrypt checkCode string(256) Private authentication information

[0116] Table 9

[0117] The parameters in Tables 1 to 9 above are essential parameters. In practical applications, other parameters can be added according to actual needs.

[0118] Figure 4 The flowchart of the method for managing the sub-gateway by the main gateway provided in the embodiment of the present application is as follows. Figure 4 As shown, the method includes:

[0119] Step 401: After the sub-gateway is powered on for the first time, the main gateway receives standard authentication information sent by the sub-gateway;

[0120] Step 402: The main gateway uses standard authentication information to authenticate the PON network and determines whether the authentication operation of the sub-gateway is passed;

[0121] If it passes, continue to execute step 403 to step 409; if it fails, it means that the sub-gateway is an illegal sub-gateway, the main gateway refuses the sub-gateway to go online, and the process ends.

[0122] Step 403: The main gateway allocates a default small bandwidth, such as 128 Kbps bandwidth, to the sub-gateway;

[0123] Step 404: The main gateway uses a layer 2 message to authenticate the sub-gateway; for example, Figure 3 The authentication process shown.

[0124] Step 405: After the identity authentication is successful, the main gateway generates private authentication information according to the GPON SN information of the sub-gateway, and encrypts the private authentication information and sends it to the sub-gateway;

[0125] Step 406: The main gateway receives the private authentication information sent by the sub-gateway;

[0126] Step 407: The main gateway uses the private authentication information to authenticate the PON network and determines whether the authentication operation of the sub-gateway is passed;

[0127] If passed, continue to step 408; otherwise, execute step 409;

[0128] Step 408: The main gateway controls the bandwidth used by the sub-gateway to be a preset maximum value, and the process ends.

[0129] Step 409: Control the bandwidth used by the sub-gateway to be a preset minimum value, and the process ends.

[0130] exist Figure 4 In the illustrated embodiment, a judgment logic for fully authorizing the sub-gateway in the FTTR scenario is provided, and the plug-and-play usage requirements of the sub-gateway are realized by automatically generating private authentication information through the main gateway. For the fully authorized sub-gateway, the bandwidth of the main gateway can be used to the maximum extent without the participation of management personnel; for the sub-gateway that is not fully authorized, a low bandwidth is allocated to ensure the rational use of bandwidth resources.

[0131] Furthermore, Figure 4 The management method of the main gateway when the sub-gateway is powered on for the first time is given. After the sub-gateway is powered on again after being offline due to an abnormality, if the sub-gateway already has private authentication information, it can use the private authentication information to authenticate the main gateway first, so as to apply for the maximum bandwidth usage permission as soon as possible.

[0132] Figure 5 A flowchart of another method for managing a gateway in an FTTR network provided in an embodiment of the present application. Figure 5 As shown, the method is applied to a sub-gateway, and the method includes:

[0133] Step 501: Perform authentication operation on the main gateway using standard authentication information that allows multiple devices to share;

[0134] Step 502: After detecting that the standard authentication information is authenticated, use the private authentication information of the sub-gateway to perform an authentication operation on the main gateway, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

[0135] The method provided in the embodiment of the present application controls the bandwidth value allocated to the sub-gateway to be less than a preset maximum value after the sub-gateway uses standard authentication information that allows multiple devices to share authentication and the authentication is passed, and then authenticates the private authentication information of the sub-gateway, thereby correctly identifying the legally connected sub-gateway. After the private authentication information of the sub-gateway is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value, ensuring that the legally connected sub-gateway can use the bandwidth of the main gateway to the maximum extent, thereby ensuring the reasonable use of bandwidth resources.

[0136] Figure 6 The present invention provides a schematic diagram of a management device for a gateway in an FTTR network. Figure 6As shown, the device is applied to a main gateway, and the device includes:

[0137] The first management module 601 is used to control the bandwidth value allocated to the sub-gateway to be less than a preset maximum value after the sub-gateway uses the standard authentication information that allows multiple devices to share and the authentication is passed, and obtain the private authentication information used by the sub-gateway alone;

[0138] The second management module 602 is configured to control the bandwidth value allocated to the sub-gateway to be the maximum value if the private authentication information of the sub-gateway is acquired and the private authentication information is authenticated.

[0139] The device provided in the embodiment of the present application controls the bandwidth value allocated to the sub-gateway to be less than the preset maximum value after the sub-gateway uses the standard authentication information that allows multiple devices to be shared for authentication and the authentication is passed, and then authenticates the private authentication information of the sub-gateway, so as to correctly identify the sub-gateway with legal access. After the private authentication information of the sub-gateway is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value, ensuring that the sub-gateway with legal access can use the bandwidth of the main gateway to the maximum extent, thereby ensuring the reasonable use of bandwidth resources.

[0140] Figure 7 This is a schematic diagram of the structure of another gateway management device in an FTTR network provided in an embodiment of the present application. Figure 7 As shown, the device is applied to a sub-gateway, and the device includes:

[0141] The first authentication module 701 is used to perform an authentication operation on the main gateway using standard authentication information that allows multiple devices to share;

[0142] The second authentication module 702 is used to perform an authentication operation on the main gateway using the private authentication information of the sub-gateway after detecting that the standard authentication information is authenticated, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

[0143] The device provided in the embodiment of the present application controls the bandwidth value allocated to the sub-gateway to be less than the preset maximum value after the sub-gateway uses the standard authentication information that allows multiple devices to be shared for authentication and the authentication is passed, and then authenticates the private authentication information of the sub-gateway, so as to correctly identify the sub-gateway with legal access. After the private authentication information of the sub-gateway is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value, ensuring that the sub-gateway with legal access can use the bandwidth of the main gateway to the maximum extent, thereby ensuring the reasonable use of bandwidth resources.

[0144] In addition, an embodiment of the present application provides a management system for gateways in an FTTR network, including the main gateway described above and at least one sub-gateway described above.

[0145] In summary, the embodiments of the present application propose a solution that can solve the plug-and-play of sub-gateways and identify unauthorized sub-gateways in FTTR scenarios. The solution automatically completes the full authorization of the sub-gateway without modifying the original PON registration and authentication protocol. For illegal sub-gateways, even if they can be registered to the main gateway using easily available standard authentication information, they cannot obtain full authorization. While meeting interoperability requirements, sub-gateways that have not obtained full authorization can only use the minimum bandwidth of the main gateway and will not occupy the bandwidth of fully authorized sub-gateways. At the same time, it supports managers to fully authorize sub-gateways manually. Due to the method of the present application, the existing protocol is not modified. Compared with directly modifying the OMCI protocol stack of PON registration and authentication, the design complexity is lower, and the stability and versatility are better.

[0146] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A method for managing a gateway in an FTTR network, characterized in that: Applied to the main gateway, the method includes: After the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, controlling the bandwidth value allocated to the sub-gateway to be less than a preset maximum value, and obtaining private authentication information used solely by the sub-gateway; If the private authentication information of the sub-gateway is acquired and the private authentication information is authenticated, the bandwidth value allocated to the sub-gateway is controlled to be the maximum value.

2. The method according to claim 1, characterized in that The method further comprises: If the private authentication information of the sub-gateway is not obtained, or the private authentication information of the sub-gateway is obtained but the authentication of the private authentication information fails, the bandwidth value allocated to the sub-gateway is controlled to be a preset minimum value.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: Before obtaining the private authentication information used solely by the sub-gateway, a layer 2 message is used to interact with the sub-gateway to complete the identity authentication of the sub-gateway. After the identity authentication is passed, the private authentication information of the sub-gateway is generated, and a layer 2 message carrying the private authentication information is sent to the sub-gateway.

4. The method according to claim 3, characterized in that: The private authentication information generated by the main gateway and the interaction data between the sub-gateway and the main gateway during the identity authentication process are both carried through the data field of the layer 2 message.

5. The method according to claim 4, characterized in that The type field of the layer 2 message is used to distinguish the content carried by the data field, and / or the data field also carries at least one of a source MAC address and an operation code.

6. The method according to claim 4, characterized in that The method of using a layer 2 message to perform data interaction with the sub-gateway to complete identity authentication of the sub-gateway includes: Receiving a registration request message sent by the sub-gateway and carrying the serial number SN of the sub-gateway; Generate a challenge code, and send a registration response message carrying the challenge code to the sub-gateway; Receiving the authentication request information carrying the summary data of the SN and the challenge code sent by the sub-gateway; If the challenge code in the authentication request information is the same as the locally generated challenge code, and the summary data generated for the SN in the locally received registration request information is the same as the summary data in the authentication request information, an authentication response message indicating that the authentication result is passed is sent to the sub-gateway.

7. The method according to claim 6, characterized in that The method further comprises: Before receiving the registration request information carrying the SN of the sub-gateway sent by the sub-gateway, the broadcast search information carrying the MAC address of the sub-gateway is received from the sub-gateway, and a broadcast response information carrying the MAC address of the main gateway is sent to the sub-gateway.

8. The method according to claim 6, characterized in that The private authentication information is generated according to the SN of the sub-gateway.

9. The method according to claim 6, characterized in that The authentication request information also includes an encryption key; The sending of the layer 2 message carrying the private authentication information to the sub-gateway includes: Using the encryption key to encrypt the generated private authentication information to obtain an encryption result; The encryption result is sent.

10. A method for managing a gateway in an FTTR network, characterized in that: Applied to a sub-gateway, the method comprises: Authenticate to the main gateway using standard authentication information that allows multiple devices to share; After detecting that the standard authentication information is authenticated, the private authentication information of the sub-gateway is used to perform an authentication operation on the main gateway, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

11. A management device for a gateway in an FTTR network, characterized in that: Applied to a main gateway, the device comprises: A first management module, configured to control the bandwidth value allocated to the sub-gateway to be less than a preset maximum value after the sub-gateway is authenticated using standard authentication information that allows multiple devices to share and the authentication is passed, and to obtain private authentication information used solely by the sub-gateway; The second management module is configured to control the bandwidth value allocated to the sub-gateway to be the maximum value if the private authentication information of the sub-gateway is acquired and the private authentication information is authenticated.

12. A management device for a gateway in an FTTR network, characterized in that: Applied to a sub-gateway, the device comprises: A first authentication module, used to perform an authentication operation on the main gateway using standard authentication information that allows multiple devices to share; The second authentication module is used to perform an authentication operation on the main gateway using the private authentication information of the sub-gateway after detecting that the standard authentication information is authenticated, wherein the private authentication information is used to request the main gateway to increase the bandwidth value allocated by the sub-gateway to a preset maximum value.

13. A management system for gateways in an FTTR network, characterized in that: It comprises the main gateway as claimed in claim 11 and at least one sub-gateway as claimed in claim 12.

Images