A Dynamic Authentication Method for a Communication Device and an Optical Module

Abstract

The present invention discloses a dynamic authentication method for a communication device and an optical module, which includes the following steps: The communication device determines whether an optical module is accessed; when the communication device determines that an optical module is accessed, it reads the first information of the optical module and generates dynamic encryption data according to the first information; the communication device writes the dynamic encryption data into the optical module in a preset format; the communication device reads the backup verification data generated by the optical module after writing the dynamic encryption data; the communication device verifies according to the backup verification data to determine whether the optical module is a legal optical module; the communication device records and stores the first information of the legal optical module to complete the dynamic authentication. The present invention adopts a dynamic authentication method. While the authentication data is closely related to the key information of the device and the optical module, the authentication data is dynamically generated and is difficult to be cracked by means such as illegal reading and cloning, dictionary brute force cracking, etc., improving the security and providing an additional guarantee for the network quality.

Description

Technical Field

[0001] The present invention relates to the field of optical communication technologies, and more specifically, to a dynamic authentication method for a communication device and an optical module. Background Art

[0002] The optical network has developed rapidly. As the core device for receiving and emitting light in optical fiber communication, the optical module undertakes more and more important functions. At the same time, the development of optical modules has become increasingly diversified. There are differences in the processes, quality, parameters, etc. of optical modules from different manufacturers, and even counterfeit products appear. To improve network stability and ensure the compatibility between the communication device and the optical module, the authentication function between the device and the optical module is particularly important to avoid network failures caused by using counterfeit brands or incompatible optical modules.

[0003] The prior art performs encrypted storage and decryption verification through the inherent information of the optical module itself; writes specific encrypted information into the optical module in advance through an encryption algorithm, reads and authenticates it during operation; and discriminates through product anti-counterfeiting labels, etc. The information used in these solutions is fixed and can be read, copied, cracked, etc. by special equipment, resulting in low security. In addition, these solutions are difficult to modify and maintain in the future after mass production, and are not flexible enough. Summary of the Invention

[0004] The present invention provides a dynamic authentication method for a communication device and an optical module, which solves the technical problem in the prior art that the inherent information of the optical module can be read, copied, and cracked by special equipment, resulting in low security.

[0005] To solve the above technical problem, the technical solution of the present invention is as follows:

[0006] The present invention provides a dynamic authentication method for a communication device and an optical module, including the following steps:

[0007] The communication device determines whether an optical module is connected;

[0008] When the communication device determines that an optical module is connected, it reads the first information of the optical module and generates dynamic encrypted data according to the first information;

[0009] The communication device writes the dynamic encrypted data into the optical module in a preset format;

[0010] The communication device reads the backup verification data generated by the optical module after writing the dynamic encrypted data;

[0011] The communication device checks according to the backup verification data to determine whether the optical module is a legal optical module;

[0012] The communication device records and stores the first information of the legal optical module to complete the dynamic authentication.

[0013] Among the above technical means, a dynamic authentication method is adopted. The authentication process is executed as the device power-on program runs and stops when the power is off, and the key data is lost accordingly. Compared with the static method of fixed encrypted data, it can prevent others from maliciously reading and copying the storage information of the optical module using a dedicated device, thus avoiding the risk of encrypted data leakage. At the same time, there is no need to pre-write fixed encrypted information during the production stage of the optical module, which brings convenience to later adjustment and maintenance and is convenient for production and use.

[0014] Further, the communication device determines whether there is an optical module connected, including:

[0015] The communication device reads the first information of the optical module. When the communication device successfully reads the first information of the optical module, the communication device determines that there is an optical module connected.

[0016] Further, the first information of the optical module includes the combination of the SN and VenderID string of the optical module.

[0017] Further, generating dynamic encrypted data according to the first information includes:

[0018] Performing MD5 encryption processing on the first information to obtain dynamic encrypted data.

[0019] Further, the communication device writes the dynamic encrypted data into the first preset register address in the optical module according to a preset format. The first preset register address includes a first address, a second address, a third address, and a fourth address.

[0020] Further, the communication device writes the dynamic encrypted data into the first preset register address in the optical module according to a preset format, including:

[0021] The communication device writes the data length of the dynamic encrypted data into the first address, writes the dynamic encrypted data into the fourth address, and then writes the start processing action instruction into the second address.

[0022] Further, the communication device writing the dynamic encrypted data into the preset register address in the optical module further includes:

[0023] The communication device reads the data of the third address to obtain the writing processing result of the optical module. If the communication device cannot read the data of the third address or the writing processing result is abnormal, the optical module is an illegal optical module, and the optical module is powered off and then powered on again; if the writing processing result is successful, the communication device reads the backup verification data generated by the optical module after writing the dynamic encrypted data.

[0024] Further, the communication device reads backup verification data generated by the optical module after writing the dynamic encryption data, including:

[0025] When the optical module detects that a start processing action instruction is written at the second address, it reads the data at the fourth address, extracts the data at the fourth address in the form of data length plus actual data content, and then encrypts the extracted data at the fourth address and writes it to a second preset register address in the optical module;

[0026] The communication device reads the data at the second preset register address in the optical module to obtain backup verification data.

[0027] Further, the communication device checks whether the optical module is a legal optical module according to the backup verification data, including:

[0028] After decrypting the backup verification data, the communication device compares it with the dynamic encryption data. If they are consistent, it determines that the optical module is a legal optical module; if not, it determines that the optical module is an illegal optical module.

[0029] Further, after the communication device records and stores the first information of the legal optical module, it further includes:

[0030] Check whether the first information of the legal optical module overlaps with the first information of other existing legal optical modules. If there is an overlap, the legal optical module is powered off and then powered on again, and it is determined to be an illegal optical module.

[0031] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0032] Compared with the method of reading fixed information to authenticate the optical module, the present invention adopts a dynamic authentication method. While the authentication data is closely related to the key information of the device and the optical module, the authentication data is dynamically generated and is difficult to be cracked by means such as illegal reading and cloning, dictionary brute force cracking, etc., improving the security and providing an additional guarantee for network quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic flowchart of a dynamic authentication method for a communication device and an optical module provided by an embodiment of the present invention;

[0034] Figure 2 It is a schematic flowchart of adding initial authentication logic processing to the firmware of the optical module provided by an embodiment of the present invention;

[0035] Figure 3 It is a schematic flowchart of the communication device performing authentication provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0036] The accompanying drawings are only for illustrative purposes and should not be construed as limiting the present patent;

[0037] To better illustrate this embodiment, some components in the accompanying drawings are omitted, enlarged or reduced, which do not represent the dimensions of the actual product;

[0038] For those skilled in the art, it is understandable that some well-known structures and their descriptions in the accompanying drawings may be omitted.

[0039] The technical solution of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0040] Embodiment

[0041] This embodiment provides a dynamic authentication method for a communication device and an optical module, as Figure 1 shown, including the following steps:

[0042] The communication device determines whether an optical module is accessed;

[0043] When the communication device determines that an optical module is accessed, it reads the first information of the optical module and generates dynamic encryption data according to the first information;

[0044] The communication device writes the dynamic encryption data into the optical module according to a preset format;

[0045] The communication device reads the backup verification data generated by the optical module after writing the dynamic encryption data;

[0046] The communication device checks according to the backup verification data to determine whether the optical module is a legal optical module;

[0047] The communication device records and stores the first information of the legal optical module to complete the dynamic authentication.

[0048] In the embodiment of the present invention, a dynamic authentication method is proposed for the authentication between a communication device and an optical module. Compared with the method of using fixed information authentication or no authentication, the security and flexibility are greatly improved. At the same time, a method for adjusting the authentication logic in the later stage is also provided, which can well adapt to the production and engineering environment.

[0049] In a specific embodiment, generally, the firmware program needs to be pre-burned inside the optical module to run normally. The firmware only covers the content for the optical module to implement general functions. In this embodiment, the optical module adds specific logical processing of authentication data on this basis. The processing includes: obtaining specific register address data, parsing the data according to a preset data format and dynamically generating backup verification data to a specified register address, and modifying the status register to indicate the result of this processing (success, failure, error code, etc.), asFigure 2 As shown, specifically:

[0050] (1) The area where the optical module receiving device writes data (hereinafter simply referred to as Area A) is A2.AA - FF, a total of 55 bytes. The storage area where the optical module generates check data (hereinafter simply referred to as Area B) is A0.AA - FF, a total of 55 bytes. Among them, Area A and Area B are virtual mapped addresses, and no data is saved in this area after the optical module is powered off.

[0051] (2) Area A is defined as follows: A2.AA is the data length written by this device for authentication; A2.AB is the action instruction (start processing, clear data); A2.AC is the data result status register of the optical module processing data (success code 1, failure code 2).

[0052] (3) When the optical module detects that data is written to the A2.AB address, it executes the corresponding action. For example, when it receives the "start processing" instruction, it reads the data in the A2.AA - FF area, extracts the data content in the form of "data length + actual data content", then modifies and generates new data by incrementing each byte by 1 and writes it to the A0.AA - FF area, and then sets the status register to the "success" status.

[0053] The specific method for adjusting the authentication logic of the optical module is as follows:

[0054] The communication device can adjust the authentication process and update and iterate the key algorithms by upgrading the APP through the local / cloud management platform. The communication device and the optical module are connected and communicate through the IIC interface. The optical module firmware with the new authentication logic is placed on the communication device by means of APP upgrade, and then through the IIC interface communication between the communication device and the optical module, the new firmware is burned into the optical module, thereby realizing the adjustment of the authentication logic.

[0055] In a further embodiment, the communication device determines whether an optical module is accessed, including:

[0056] The communication device reads the first information of the optical module. When the communication device successfully reads the first information of the optical module, the communication device determines that an optical module is accessed.

[0057] In a further embodiment, the first information of the optical module includes the SN and VenderID string combination of the optical module.

[0058] In a further embodiment, generating dynamic encryption data according to the first information includes:

[0059] Performing MD5 encryption processing on the first information to obtain dynamic encryption data.

[0060] In a further embodiment, the communication device writes the dynamic encrypted data to a first preset register address in the optical module according to a preset format, and the first preset register address includes a first address, a second address, a third address, and a fourth address.

[0061] In a further embodiment, the communication device writes the dynamic encrypted data to a first preset register address in the optical module according to a preset format, including:

[0062] The communication device writes the data length of the dynamic encrypted data to the first address, writes the dynamic encrypted data to the fourth address, and then writes a start processing action instruction to the second address.

[0063] In a further embodiment, the communication device writes the dynamic encrypted data to a preset register address in the optical module according to a preset format, further including:

[0064] The communication device reads the data at the third address to obtain the write processing result of the optical module. If the communication device cannot read the data at the third address or the write processing result is abnormal, the optical module is an illegal optical module, and the optical module is powered off and then powered on again; if the write processing result is successful, the communication device reads the backup check data generated by the optical module after writing the dynamic encrypted data.

[0065] In a further embodiment, the communication device reads the backup check data generated by the optical module after writing the dynamic encrypted data, including:

[0066] When the optical module detects that a start processing action instruction is written to the second address, it reads the data at the fourth address, extracts the data at the fourth address in the form of data length plus actual data content, and then encrypts the extracted data at the fourth address and writes it to a second preset register address in the optical module;

[0067] The communication device reads the data at the second preset register address in the optical module to obtain the backup check data.

[0068] In a further embodiment, the communication device checks according to the backup check data to determine whether the optical module is a legal optical module, including:

[0069] The communication device decrypts the backup check data and compares it with the dynamic encrypted data. If they are consistent, it determines that the optical module is a legal optical module; if they are inconsistent, it determines that the optical module is an illegal optical module.

[0070] In a further embodiment, after the communication device records and stores the first information of the legal optical module, it further includes:

[0071] Check whether the first information of the legal optical module overlaps with the first information of other existing legal optical modules. If there is an overlap, power off the legal optical module and then power it on again, and determine it as an illegal optical module.

[0072] In a specific embodiment, a general device usually has multiple PON ports for accessing optical modules. The device system records the key information of the currently accessed legal optical module: the module SN. If the newly accessed optical module coincides with the currently recorded SN, it is also considered an illegal optical module. This can further prevent the illegal cracking and copying of optical module information to avoid the authentication process of the device.

[0073] In a specific embodiment, after the communication device detects the insertion of the optical module, according to a preset algorithm, it reads the key information of the optical module (such as the optical module SN, manufacturer ID, module model, etc.) to generate dynamic encrypted data, and writes the encrypted data into a specific register address of the optical module in a preset format; after the optical module recognizes the data writing, it starts to execute the logical processing in (1); the communication device reads the value of the status register of the optical module. If the flag is unsuccessful, it directly exits the authentication process and marks the optical module as an illegal module; if the flag is successful, it enters the next authentication process: the communication device reads the backup verification data dynamically generated by the optical module, and verifies the legality of the data through a preset algorithm. If the verification passes, it is marked as a legal optical module, otherwise it is marked as an illegal optical module. The specific steps are as Figure 3 shown, including:

[0074] (1) The communication device determines whether an optical module is accessed by the way of whether it successfully reads the optical module information. If it recognizes the access of the optical module, it enters the next step.

[0075] (2) The communication device reads the SN and VenderID string combination of the optical module, performs MD5 encryption processing on this information, and writes the encrypted data X into area A of the optical module, where A2.AA writes the length L of the data after MD5 encryption processing, and the encrypted data starts from the A2.AD address; then writes the action instruction "start processing" to the A2.AB address of the optical module; the communication device waits and reads the data at the A2.AC address of the optical module to obtain the processing result of the optical module. If the acquisition waiting times out or the processing result of the optical module is abnormal, the optical module is considered an illegal optical module, and it is powered off and then powered on again. If the status register mark obtained is "successful", it enters the next processing.

[0076] (3) Read the data of optical module A0.AA - FF with a reading length of L bytes. After processing the read data by subtracting 1 from each byte, strictly compare it with the original encrypted data X. If they are not exactly the same, the optical module is considered an illegal optical module and is processed by powering off and then powering on again. If they are exactly the same, the optical module is considered a legal optical module, and its SN and VenderID are recorded.

[0077] (4) Check whether the newly recorded SN and VenderID of the optical module overlap with the existing information. If there is an overlap, the module is also considered an illegal module, and it is also processed by powering off and then powering on again, and its legal record is deleted.

[0078] For an illegal optical module, immediately stop power supply, then power on again. After powering on, re - enter the authentication process of the communication device and the optical module in (2).

[0079] In a specific embodiment, when the optical module detects data written to the A2.AB address and executes corresponding actions, for example, when receiving the "start processing" instruction, it reads the data in the A2.AA - FF area. When extracting the data content in the form of "data length + actual data content", new data can be generated by modifying through various encryption methods and written to the A0.AA - FF area. Correspondingly, after the communication device reads the data of the optical module A0.AA - FF, the corresponding decryption method is selected for decryption according to the corresponding encryption method.

[0080] The same or similar reference numerals correspond to the same or similar components;

[0081] The terms describing the positional relationship in the drawings are only for illustrative purposes and should not be construed as a limitation of this patent;

[0082] Obviously, the above - mentioned embodiments of the present invention are only examples for clearly explaining the present invention, rather than limitations on the implementation manners of the present invention. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to enumerate all the implementation manners here. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A dynamic authentication method for a communication device and an optical module, characterized in that, Including the following steps: The communication device is connected to the optical module through the IIC interface for communication. The optical module firmware with the new authentication logic is placed on the communication device by means of APP upgrade, the new firmware is burned into the optical module, and it is judged whether there is an access of the optical module; When the communication device judges that there is an access of the optical module, it reads the first information of the optical module and generates dynamic encryption data according to the first information. The first information of the optical module includes the combination of the SN and VenderID string of the optical module; The communication device writes the dynamic encryption data to the fourth address in the first preset register address in the optical module according to a preset format; The communication device reads the backup check data generated by the optical module after writing the dynamic encryption data, including: when the optical module detects that a start processing action instruction is written to the second address in the first preset register address, it reads the data at the fourth address, extracts the data at the fourth address in the form of the data length plus the actual data content, and then encrypts the extracted data at the fourth address and writes it to the second preset register address in the optical module; the communication device reads the data at the second preset register address in the optical module to obtain the backup check data; The communication device checks according to the backup check data to judge whether the optical module is a legal optical module; The communication device records and stores the first information of the legal optical module to complete dynamic authentication.

2. The dynamic authentication method for a communication device and an optical module according to claim 1, characterized in that The communication device judges whether there is an access of the optical module, including: The communication device reads the first information of the optical module. When the communication device successfully reads the first information of the optical module, the communication device judges that there is an access of the optical module.

3. The dynamic authentication method for a communication device and an optical module according to claim 1, wherein Generating dynamic encryption data according to the first information, including: Performing MD5 encryption processing on the first information to obtain dynamic encryption data.

4. The dynamic authentication method for a communication device and an optical module according to claim 1, wherein The communication device writes the dynamic encryption data to the first preset register address in the optical module according to a preset format. The first preset register address includes a first address, a second address, a third address and a fourth address.

5. The dynamic authentication method for a communication device and an optical module according to claim 4, characterized in that, The communication device writes the dynamic encryption data to the first preset register address in the optical module according to a preset format, including: The communication device writes the data length of the dynamic encryption data to the first address, writes the dynamic encryption data to the fourth address, and then writes the start processing action instruction to the second address.

6. The dynamic authentication method for a communication device and an optical module according to claim 5, characterized in that The communication device writing the dynamic encryption data to the preset register address in the optical module further includes: the communication device reads the data at the third address to obtain the writing processing result of the optical module. If the communication device cannot read the data at the third address or the writing processing result is abnormal, the optical module is an illegal optical module, and the optical module is powered off and then powered on again; if the writing processing result is successful, the communication device reads the backup check data generated by the optical module after writing the dynamic encryption data.

7. The dynamic authentication method for a communication device and an optical module according to claim 1, characterized in that The communication device checks according to the backup check data to judge whether the optical module is a legal optical module, including: After the communication device decrypts the backup verification data, it compares the decrypted data with the dynamic encryption data. If they are consistent, the optical module is determined to be a legal optical module; if they are inconsistent, the optical module is determined to be an illegal optical module.

8. The dynamic authentication method for a communication device and an optical module according to claim 7, wherein, After the communication device records and stores the first information of the legal optical module, it further includes: Checking whether the first information of the legal optical module overlaps with the first information of other existing legal optical modules. If an overlap occurs, the legal optical module is powered off and then restarted, and is determined to be an illegal optical module.

Images