OLT and ONU mutual authentication method based on RSA algorithm

Abstract

The invention discloses a method for mutual authentication of an OLT (Optical Line Terminal) and an ONU (Optical Network Unit) based on an RSA (Rivest-Shamir-Adleman) algorithm, which comprises the following steps: S1, ONU equipment initializes an OMCI protocol, creates a private management entity for encryption verification and simultaneously generates a first public key and a first private key, the first public key is stored in an MIB (Management Information Block) database of the private management entity, and the first private key is stored in the ONU equipment locally; the security of registration authorization is improved through encryption authentication, online of illegal equipment (equipment which does not pass encryption authentication) can be effectively prevented, the operation and maintenance cost is reduced, meanwhile, the encryption verification process only exists in the process of starting registration authentication, and all information interaction in the OMCI protocol is not encrypted, so that the security is ensured, and the security of registration authentication is improved. And additional calculation burden and delay caused by encryption and decryption operations are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of optical network units, and in particular to a method for mutual authentication between an OLT and an ONU based on a RSA algorithm. Background Art

[0002] In the traditional GPON system authentication and authorization process, most of the authentication is done in plain text. For a small number of OLT devices, a plug-and-play automatic registration method is used for ONU. After the ONU is registered and online, there is no need to manually autofind the onu and then register. Automatic registration simultaneously sends multiple service template configurations, so that the service flow is smooth after the ONU device is online, greatly reducing deployment work.

[0003] However, while automatic registration makes operation and maintenance more convenient, it also brings about the problem of illegal authorization. If the registration and normal use of third-party illegal devices cannot be effectively identified and restricted, it will not only occupy OLT bandwidth resources, but also increase the operation and maintenance costs of network service providers. Summary of the invention

[0004] The purpose of the present invention is to provide a method for mutual authentication between OLT and ONU based on RSA algorithm, the method improves the security of registration authorization through encryption authentication, can effectively prevent illegal equipment (equipment that has not passed encryption authentication) from going online, and reduces operation and maintenance costs. Meanwhile, the process of encryption verification only exists in the process of starting registration authentication, and all information interactions in the OMCI protocol are not encrypted, thereby reducing the extra computing burden and delay caused by encryption and decryption operations while ensuring security.

[0005] To achieve the above objectives, the following technical solutions are adopted:

[0006] A method for mutual authentication between an OLT and an ONU based on an RSA algorithm comprises the following steps:

[0007] S1: The ONU device initializes the OMCI protocol and creates a private management entity for encryption verification. At the same time, a first public key and a first private key are generated, wherein the first public key is saved in the MIB database of the private management entity, and the first private key is saved locally in the ONU device;

[0008] S2: The OLT device initializes the OMCI protocol and generates a second public key and a second private key;

[0009] S3: When the ONU device and the OLT device enter the GPON registration process, the OLT device obtains the first public key from the MIB database of the private management entity;

[0010] S4: After the ONU device reaches the O5 state, the OLT device sends the second public key to the private management entity of the ONU device;

[0011] S5: The OLT device generates a random string, and then encrypts the random string using the RSA algorithm according to the first public key obtained from the ONU device, and then sends the encrypted data to the private management entity of the ONU device;

[0012] S6: After receiving the encrypted data, the ONU device uses the first private key to decrypt the data to obtain a random string, then uses the second public key to encrypt the random string, and saves the encrypted data into the MIB database of the private management entity;

[0013] S7: The OLT device obtains the encrypted data stored in the MIB database, and decrypts the data using the second private key to obtain a random string;

[0014] S8: Compare the random string obtained in S7 with the random string generated by the OLT device in S5. If the two strings are completely consistent, the verification and authentication are successful. Otherwise, return to step S3.

[0015] Furthermore, in S3, the OLT device obtains the first public key of the ONU device through the MIB Upload operation in the ONU device, or actively sends a GetRequest method.

[0016] Furthermore, in S4, the OLT device sends the second public key of the OLT device to the ONU device through the Set Request operation of the OMCI protocol.

[0017] Furthermore, in S5, the OLT device generates a random string of fixed length according to the random number seed, and a new random string is regenerated each time the OLT device authenticates the ONU device.

[0018] Furthermore, in S5, the OLT device encapsulates the encrypted data into the data field of the OMCI protocol frame, and sends it to the private management entity of the ONU device through a Set Request operation.

[0019] By adopting the above scheme, the beneficial effects of the present invention are:

[0020] 1) Compared with the traditional authentication method, the present invention can effectively improve the registration authentication security between OLT and ONU, prevent illegal devices (devices that have not passed encryption authentication) from going online, affecting bandwidth resource occupation, etc., reduce the operation and maintenance costs of network service providers, and eliminate the need to manually remove illegal ONU devices in a batch configuration environment, thereby reducing the complexity of operations;

[0021] 2) The present invention uses the asymmetric encryption RSA algorithm, which has the advantages of higher security and support for key exchange and identity authentication capabilities compared to the traditional MD5 algorithm and SHA algorithm. The present invention is different from the symmetric encryption algorithm, which relies on the confidentiality of the key. Once the key is leaked, the data will become unsafe. The asymmetric encryption algorithm used in the present invention can make the public key public, but the private key must be kept confidential. Even if the public key is leaked, the security of the private key will not be affected.

[0022] 3) The process of encryption verification of the present invention only exists in the process of starting registration authentication, and all information interactions in the non-OMCI protocol are encrypted, which is unnecessary, because after the encryption verification fails, ONUUNREGISTER can be used by the OLT side to make it impossible to go online, and after authentication, both parties interact normally, and adopt such a mode to reduce the extra computing burden and the delay caused by the encryption and decryption operation while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a simplified flow chart of the present invention;

[0024] Figure 2 This is a specific flow chart of the interaction between the ONU device and the OLT device of the present invention. DETAILED DESCRIPTION

[0025] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0026] In order to facilitate the understanding of the technical solution of the present invention, the relevant technical terms are briefly described as follows:

[0027] In the field of optical network unit technology, OMCI (Optical Network Unit Management and Control Interface, i.e. ONU Management and Control Interface) is a protocol for information exchange between OLT and ONT defined in the GPON standard. It is an important protocol for managing and controlling ONU devices in GPON networks. It provides functions such as device configuration, performance monitoring, fault management, firmware upgrades, and security management, ensuring efficient operation and reliable management of GPON networks. The working principle of the OMCI protocol is briefly described as follows:

[0028] 1. Message format

[0029] The OMCI message consists of multiple fields, including message type, transaction ID, sequence number, ME type, ME instance, attribute mask and data field. The message type defines the type of message, such as Set Request, Get Request, CreateRequest, etc.

[0030] 2. Message Interaction

[0031] The OLT sends an OMCI message to the ONU to request configuration, query or other operations; after receiving the message, the ONU performs the corresponding operation and returns a response message to the OLT.

[0032] 3. Management Entity (ME)

[0033] ME is a management object defined in the OMCI protocol. Each ME represents a functional module or parameter set of an ONU. Common MEs include ONT Data, ONT Extended TC Data, Ethernet PM, and PPTP PM.

[0034] 4. Operation Type

[0035] Set Request: Set the attribute value of ME;

[0036] Get Request: Get the attribute value of ME;

[0037] Create Request: Create a new ME instance;

[0038] Delete Request: Delete an existing ME instance;

[0039] Get All Alarms Next: Get the alarm information of ONU;

[0040] Get All Alarms: Get all alarm information of ONU;

[0041] Get Next: Get the attribute value of the next ME;

[0042] MIB Upload: upload the ONU MIB (Management Information Base) data;

[0043] MIB Reset: reset the MIB data of ONU;

[0044] The OMCIPON protocol standard only defines several plain text authentication methods such as MAC, SN, PASSWORD, and LOID, and does not provide a more secure authentication method. Therefore, there is a risk of being easily cracked or impersonated. Therefore, in actual scenarios, during the ONU authentication and registration process, a more reliable encryption algorithm can be added as a credential for device identity authentication. Figure 1 to Figure 2As shown, the present invention provides a method for mutual authentication between OLT and ONU based on RSA algorithm, which specifically includes the following steps:

[0045] S1: The ONU device initializes the OMCI protocol and creates a private management entity for encryption verification. At the same time, a first public key and a first private key are generated, wherein the first public key is saved in the MIB database of the private management entity, and the first private key is saved locally in the ONU device.

[0046] In this step, when the ONU device initializes the OMCI protocol, it will first add a private ME (management entity) for encryption verification. The members of the private management entity include: the public key on the OLT side, the public key on the ONU side, and the encrypted string data for storage and transmission; the private management entity is used to exchange public keys and encrypted data, and set it as the upload olt attribute; when the ONU device is initialized, it will generate a first public key and a first private key, and save the generated first public key in the MIB database of the management entity, to be transmitted to the OLT device, and the first private key is retained locally by the ONU device.

[0047] S2: The OLT device initializes the OMCI protocol and generates a second public key and a second private key.

[0048] Similarly, when initializing the OMCI protocol, the OLT device will also prepare a public key and a private key (a second public key and a second private key) and save them in the database.

[0049] S3: When the ONU device and the OLT device enter the GPON registration process, the OLT device obtains the first public key from the MIB database of the private management entity.

[0050] In S3, the OLT device obtains the first public key of the ONU device through the MIB Upload operation in the ONU device, or actively sends a Get Request method.

[0051] When the ONU device and the OLT device enter the GPON registration process, the OLT can obtain the public key in the ONU private ME through the ONU MIB Upload operation or actively send a Get Request.

[0052] S4: After the ONU device reaches the O5 state, the OLT device sends the second public key to the private management entity of the ONU device.

[0053] In S4, the OLT device sends the second public key of the OLT device to the ONU device through the Set Request operation of the OMCI protocol.

[0054] After the ONU reaches the O5 state (operating state, which refers to a specific working state of the ONU in the GPON network), the OLT sends the Set Request operation of the OMCI protocol to send the OLT public key to the ONU private ME for storage.

[0055] S5: The OLT device generates a random string, and then encrypts the random string using the RSA algorithm according to the first public key obtained from the ONU device, and then sends the encrypted data to the private management entity of the ONU device.

[0056] In S5, the OLT device generates a random string of fixed length according to the random number seed, and a new random string is regenerated each time the OLT device authenticates with the ONU device.

[0057] In S5, the OLT device encapsulates the encrypted data into the data field of the OMCI protocol frame, and sends it to the private management entity of the ONU device through the SetRequest operation.

[0058] In this step, the OLT side generates a random string of fixed length based on the random number seed, and it will be regenerated each time with the ONU authentication to ensure the difference; the OLT encrypts the random string using the RSA algorithm based on the public key obtained from the ONU side, and then encapsulates the encrypted data into the data field of the OMCI protocol frame, and sends it to the private ME of the ONU through the Set Request operation.

[0059] S6: After receiving the encrypted data, the ONU device uses the first private key to decrypt the data to obtain a random string, then uses the second public key to encrypt the random string, and saves the encrypted data into the MIB database of the private management entity.

[0060] After receiving the Set Request operation sent by the OLT, the ONU side uses the private key to decrypt it. The decrypted result is a random string generated by the OLT. The ONU side then encrypts the random string using the OLT's public key and saves the encrypted value to the OMCI MIB database for OLT to obtain.

[0061] S7: The OLT device obtains the encrypted data stored in the MIB database, and decrypts the data using the second private key to obtain a random character string.

[0062] Based on the Set Request result success (OMCI message) returned by the ONU, the OLT determines that the ONU has completed the encryption operation, and then sends the Get Request OMCI message to obtain the encrypted value of the ONU. After obtaining the encrypted value, it uses the OLT's private key to decrypt it and finally compares it with the initial random string. If they are completely consistent, the verification passes.

[0063] S8: Compare the random string obtained in S7 with the random string generated by the OLT device in S5. If the two strings are completely consistent, the verification and authentication are successful. Otherwise, return to step S3.

[0064] After this mutual verification process, the OLT can determine whether the currently registered ONU is legal. If the encryption verification passes, it will be allowed to go online normally and send the multi-service template configuration. Otherwise, the ONU will execute RE-REGISTER and return to step S3 for re-authentication.

[0065] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for mutual authentication between OLT and ONU based on RSA algorithm, characterized in that: The steps include: S1: The ONU device initializes the OMCI protocol and creates a private management entity for encryption verification. At the same time, a first public key and a first private key are generated, wherein the first public key is saved in the MIB database of the private management entity, and the first private key is saved locally in the ONU device; S2: The OLT device initializes the OMCI protocol and generates a second public key and a second private key; S3: When the ONU device and the OLT device enter the GPON registration process, the OLT device obtains the first public key from the MIB database of the private management entity; S4: After the ONU device reaches the O5 state, the OLT device sends the second public key to the private management entity of the ONU device; S5: The OLT device generates a random string, and then encrypts the random string using the RSA algorithm according to the first public key obtained from the ONU device, and then sends the encrypted data to the private management entity of the ONU device; S6: After receiving the encrypted data, the ONU device uses the first private key to decrypt the data to obtain a random string, then uses the second public key to encrypt the random string, and saves the encrypted data into the MIB database of the private management entity; S7: The OLT device obtains the encrypted data stored in the MIB database, and decrypts the data using the second private key to obtain a random string; S8: Compare the random string obtained in S7 with the random string generated by the OLT device in S5. If the two strings are completely consistent, the verification and authentication are successful. Otherwise, return to step S3.

2. The method for mutual authentication between OLT and ONU based on RSA algorithm according to claim 1, characterized in that: In S3, the OLT device obtains the first public key of the ONU device through the MIB Upload operation in the ONU device, or actively sends a Get Request method.

3. The method for mutual authentication between OLT and ONU based on RSA algorithm according to claim 1, characterized in that: In S4, the OLT device sends the second public key of the OLT device to the ONU device through the Set Request operation of the OMCI protocol.

4. The method for mutual authentication between OLT and ONU based on RSA algorithm according to claim 1, characterized in that: In S5, the OLT device generates a random string of fixed length according to the random number seed, and a new random string is regenerated each time the OLT device authenticates with the ONU device.

5. The method for mutual authentication between OLT and ONU based on RSA algorithm according to claim 4, characterized in that: In S5, the OLT device encapsulates the encrypted data into the data field of the OMCI protocol frame, and sends it to the private management entity of the ONU device through a Set Request operation.

Images