Configuration, authentication method and device of optical communication equipment, optical communication equipment and system

Abstract

Disclosed are a configuration method and device of an optical communication device, an authentication method and device of an optical communication device, an optical communication device and a system, and belong to the technical field of optical communication. The configuration method comprises: a first optical communication device determining a random time delay parameter, the random time delay parameter being less than 48 mu s; and sending a broadcast message to a plurality of second optical communication devices, the broadcast message carrying configuration information, the configuration information being used for configuring the random time delay parameter. The first optical communication device can flexibly configure the random time delay parameter of the second optical communication device through the broadcast message.

Description

[0001] This application claims priority to Chinese Patent Application No. 202311164116.4, filed on September 8, 2023, entitled "Configuration, Authentication Method and Apparatus for Optical Communication Equipment, Optical Communication Equipment and System", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of optical communication technology, and in particular to a configuration and authentication method and apparatus for optical communication equipment, as well as an optical communication device and system. Background Technology

[0003] A passive optical network (PON) is a point-to-multipoint, single-fiber, bidirectional optical access network. A PON system typically includes a primary optical communication device, an optical distribution network (ODN), and multiple secondary optical communication devices. The primary optical communication device connects to the multiple secondary optical communication devices via the ODN.

[0004] When the second optical communication device comes online, the first optical communication device needs to authenticate the second optical communication device. Only after the second optical communication device has been authenticated can it transmit data with the first optical communication device. Typically, the authentication process for the second optical communication device includes: the first optical communication device sending a serial number request message to the second optical communication device in a silent window; the second optical communication device responding to the received serial number request message by sending a serial number response message based on random delay parameters; and the first optical communication device authenticating the second optical communication device based on the serial number response message.

[0005] The length of the silent window is greater than the sum of the random delay parameter and the round-trip propagation delay. The random delay parameter is 48 μs by default. For a maximum differential distance of 20 km between the first and second optical communication devices, the round-trip propagation delay is 200 μs; for a maximum differential distance of 40 km, the round-trip propagation delay is 400 μs. Therefore, the silent window is relatively long. Since the second optical communication device, which has already completed authentication, cannot send data during the silent window, the long silent window leads to a significant data transmission delay for the second optical communication device. Summary of the Invention

[0006] This application provides a configuration method and apparatus for an optical communication device, as well as an optical communication device and system, which helps to reduce the data transmission delay of the second optical communication device.

[0007] In a first aspect, this application provides a configuration method for an optical communication device, which may include: a first optical communication device determining a random delay parameter, the random delay parameter being less than 48μs; the first optical communication device sending a broadcast message to a plurality of second optical communication devices, the broadcast message carrying configuration information, the configuration information being used to configure the random delay parameter.

[0008] In this application, the first optical communication device can flexibly configure the random delay parameters of the second optical communication device by sending a broadcast message carrying configuration information for configuring random delay parameters. Furthermore, the random delay parameter configured in the configuration information is less than 48 μs, meaning it is less than the default random delay parameter in related technologies. This reduces the length of the silent window for a given round-trip propagation delay, which is beneficial for reducing the data transmission delay of the certified second optical communication device.

[0009] Optionally, the first optical communication device may determine the random delay parameters using any of the following methods:

[0010] Method 1: Receive the input random delay parameters.

[0011] In this first method, the random delay parameter can be directly configured by the staff, which is simple to implement and requires little change to the execution logic of the first optical communication device.

[0012] Method 2: Determine the random delay parameter based on the maximum differential distance between the first optical communication device and the plurality of second optical communication devices, wherein the random delay parameter is proportional to the maximum differential distance. Optionally, the maximum differential distance can be received by the first optical communication device. For example, it could be a parameter configured by an operator via a configuration interface.

[0013] In this second method, since the smaller the maximum difference distance, the shorter the length of the silent window needs to be, the default random delay parameter can be calculated based on the maximum difference distance. The calculation method is simple and easy to implement.

[0014] Method 3: Determine the random delay parameter based on the remaining bandwidth, wherein the remaining bandwidth is the bandwidth not allocated to the second optical communication device in a bandwidth allocation cycle, and the random delay parameter is less than the length of the remaining bandwidth minus the difference between the round-trip propagation delay and the response time of the second optical communication device.

[0015] In this third method, the remaining bandwidth can be used for windowing, avoiding any impact on the data transmission of already certified secondary optical communication devices. Furthermore, by determining the random delay parameters based on the remaining bandwidth, since each certified secondary optical communication device can transmit data normally in each bandwidth allocation cycle, the frequency of windowing can be increased. For example, a window can be set at 1ms or 2ms. This allows for the timely detection of newly added secondary optical communication devices and facilitates rapid authentication of them.

[0016] Secondly, this application provides a configuration method for an optical communication device. The configuration method includes: a second optical communication device receiving a broadcast message sent by a first optical communication device, the broadcast message carrying configuration information, the configuration information being used to configure random delay parameters, the random delay parameters being less than 48 μs; and the second optical communication device storing the configuration information.

[0017] In this application, the first optical communication device can flexibly configure the random delay parameters of the second optical communication device by sending a broadcast message carrying configuration information for configuring random delay parameters. Furthermore, the random delay parameter configured in the configuration information is less than 48 μs, meaning it is less than the default random delay parameter in related technologies. This reduces the length of the silent window for a given round-trip propagation delay, which is beneficial for reducing the data transmission delay of the certified second optical communication device.

[0018] Thirdly, this application provides an authentication method for optical communication devices. The authentication method includes: a first optical communication device sending a broadcast message to a plurality of second optical communication devices, the broadcast message carrying configuration information for configuring random delay parameters, the random delay parameters being less than 48 μs; the first optical communication device sending a sequence number request message to the plurality of second optical communication devices; and the first optical communication device receiving a sequence number response message sent by a second optical communication device, the sequence number response message being sent by the second optical communication device according to the random delay parameters configured by the configuration information.

[0019] Optionally, the first optical communication device sends a serial number request message to the plurality of second optical communication devices, including: sending the serial number request message to the plurality of second optical communication devices within a silent window, wherein the length of the silent window is less than 125 μs. The shorter the length of the silent window, the less impact it has on the data transmission of the authenticated second optical communication devices.

[0020] Optionally, the length of the silent window is determined based on the maximum differential distance between the first optical communication device and the plurality of second optical communication devices, wherein the maximum differential distance is less than 12.5 km. Therefore, the method provided in this application is particularly suitable for scenarios where the first optical communication device and the second optical communication device are relatively close.

[0021] Fourthly, this application provides an authentication method for an optical communication device. The authentication method includes: a second optical communication device receiving a broadcast message sent by a first optical communication device, the broadcast message carrying configuration information for configuring random delay parameters, the random delay parameters being less than 48 μs; the second optical communication device receiving a sequence number request message sent by the first optical communication device; and the second optical communication device responding to the sequence number request message by sending a sequence number response message to the first optical communication device according to the random delay parameters.

[0022] Fifthly, this application provides an authentication method for an optical communication device, the method comprising:

[0023] The first optical communication device sends a serial number request message to the plurality of second optical communication devices;

[0024] The first optical communication device receives a sequence number response message sent by the second optical communication device, the sequence number response message carrying random delay parameters and the sequence number of the second optical communication device;

[0025] The first optical communication device authenticates the second optical communication device based on the serial number and the random delay parameter;

[0026] After successful authentication, the first optical communication device sends a key generation message to the second optical communication device. The key generation message carries key parameters, which are used to generate a new key.

[0027] In this application, the first optical communication device can authenticate the second optical communication device using a sequence number and random delay parameters sent by the second optical communication device. Furthermore, by sending a key generation message to the second optical communication device, the first optical communication device can facilitate the second optical communication device in generating a new key based on the key parameters in the message, and then using the new key to encrypt data transmission between the first and second optical communication devices, thereby improving communication security between them.

[0028] In one possible scheme, the new key is a key pair, consisting of a sending key and a receiving key.

[0029] In one possible scheme, the key generation message carries (including) the identifier of the second optical communication device and key parameters. After receiving the key generation message carrying the identifier, the second optical communication device generates a new key to use or replace the old key according to the key parameters.

[0030] In one possible scenario, the key generation message carries a key index that can point to the aforementioned new key.

[0031] In one possible implementation, the key parameters include one or more random numbers generated by the first optical communication device. By using random numbers as key parameters, this application enhances the security of the generated key.

[0032] In one possible scheme, the key generation message carries an integrity check bit, which is used by the second optical communication device to perform integrity verification on the key generation message, thereby enhancing the security of the key generation message. Specifically, the first optical communication device can use a default integrity key to generate the integrity check bit in a broadcast scenario, or it can use an integrity key shared between the first and second optical communication devices in a unicast scenario.

[0033] In one possible scheme, the key generation message carries the key length, indicating the length of the new key (e.g., 256 bytes).

[0034] In one possible approach, when the first optical communication device sends a key generation message to the second optical communication device, it starts a first key waiting timer.

[0035] When the first key waiting timer expires and no new key reporting message is received from the second optical communication device, the first optical communication device sends a new key generation message to the second optical communication device.

[0036] In one possible scenario, after the first optical communication device authenticates the second optical communication device, it is in a key-inactive state, meaning that there is currently no valid key between the second optical communication device for data transmission of services.

[0037] In one possible implementation, the first optical communication device enters a key request state when it determines that a key exchange process needs to be initiated. In the key request state, the first optical communication device sends a key generation message to the second optical communication device.

[0038] In one possible approach, the authentication method provided in this application also includes:

[0039] The first optical communication device receives a new key reporting message from the second optical communication device, the message carrying the new key generated by the second optical communication device. Consequently, the second optical communication device can also obtain the new key generated by the second optical communication device. The first optical communication device can decrypt data sent by the second optical communication device using the new key, and can also send encrypted data to the second optical communication device using the new key to enhance communication security.

[0040] In one possible scenario, after receiving a new key reporting message, the first optical communication device transitions from the current key request state to the key confirmation state.

[0041] In one possible scenario, the aforementioned new key reporting message includes an identifier of the second optical communication device to identify the source of the new key reporting message.

[0042] In one possible implementation, the new key reporting message includes a reporting type (new key reporting or current key reporting). In this embodiment, the reporting type included in the new key reporting message is new key reporting, meaning that the second optical communication device reports the generated new key.

[0043] In one possible scenario, the aforementioned new key reporting message includes a new key encrypted with the shared key. The first optical communication device uses the shared key to decrypt the new key reporting message, obtaining the new key carried within, thereby enhancing the security of new key transmission and preventing the new key from being leaked.

[0044] In one possible scheme, the aforementioned new key reporting message includes an index of the new key (key index). After obtaining the new key, the first optical communication device saves the correspondence between the new key and the key index, so that it can subsequently obtain the new key generated by the second optical communication device based on the key index.

[0045] In one possible scheme, the new key reporting message carries an integrity check bit. This check bit is used by the first optical communication device to verify the integrity of the new key reporting message, thereby enhancing its security. The first optical communication device can generate the integrity check bit using an integrity key shared between the first and second optical communication devices.

[0046] In one possible approach, the above authentication method also includes:

[0047] The first optical communication device sends a key confirmation message to the second optical communication device, the message carrying an index of the new key. This message confirms that the first optical communication device has received the new key sent by the second optical communication device.

[0048] In one possible scenario, the key confirmation message also carries parameters such as the identifier of the second optical communication device, key length, and integrity check bits. The functions of these parameters are the same as those in the key generation message described above.

[0049] In one possible scenario, after the first optical communication device sends a key confirmation message to the second optical communication device, it enters a key confirmation waiting state from the key confirmation state.

[0050] In one possible approach, the above authentication method also includes:

[0051] The first optical communication device receives a current key reporting message from the second optical communication device, and then enters the key activation state. The current key reporting message carries the aforementioned key index. After receiving this message, the first optical communication device confirms that the second optical communication device has activated the new key corresponding to the key index. The first optical communication device then transitions from the key confirmation waiting state to the key activation state, and uses the new key to communicate with the second optical communication device (e.g., send service data).

[0052] In one possible approach, a second key waiting timer is started when the first optical communication device sends a key confirmation message to the second optical communication device.

[0053] When the second key waiting timer expires and the first optical communication device does not receive the current key reporting message from the second optical communication device, the first optical communication device sends a new key confirmation message to the second optical communication device, thereby avoiding a long wait for the current key reporting message from the second optical communication device and improving the reliability of the authentication method.

[0054] In one possible implementation, the first optical communication device sends a sequence number request message to the plurality of second optical communication devices, including:

[0055] A sequence number request message is sent to the plurality of second optical communication devices within a silent window, the length of which is less than or equal to 250 μs. Sending the sequence number request message within the silent window avoids affecting the second optical communication devices' reception of service data, thereby improving communication reliability.

[0056] In one possible implementation, the process includes the following step before the first optical communication device sends a sequence number request message to the plurality of second optical communication devices:

[0057] The first optical communication device sends a broadcast message to the plurality of second optical communication devices, the broadcast message carrying configuration profile information. The second optical communication devices can construct uplink data frames based on this configuration information and send them to the first optical communication device.

[0058] In one possible implementation, the first optical communication device sends a sequence number request message to the plurality of second optical communication devices, including:

[0059] A serial number request message is sent to the plurality of second optical communication devices during a silent window, the length of which is less than or equal to 250 μs.

[0060] Sixthly, this application provides an authentication method for an optical communication device, the method comprising:

[0061] The second optical communication device receives a sequence number request message sent by the first optical communication device;

[0062] In response to the sequence number request message, the second optical communication device generates random delay parameters;

[0063] The second optical communication device sends a sequence number response message to the first optical communication device according to the random delay parameter. The sequence number response message carries the random delay parameter and the sequence number of the second optical communication device.

[0064] The second optical communication device receives a key generation message sent by the first optical communication device. The key generation message carries key parameters, which are used to generate a new key.

[0065] The second optical communication device generates a new key based on the key parameters in the key generation message.

[0066] In the authentication method provided in this application, the second optical communication device can send a sequence number response message to the first optical communication device based on random delay parameters. Since different second optical communication devices have different random delays, this application can avoid conflicts caused by multiple second optical communication devices sending sequence number response messages simultaneously arriving at the first optical communication device, thus improving communication stability. Furthermore, the second optical communication device can generate a new key based on a key generation message sent by the first optical communication device. Then, the second optical communication device can send encrypted data to the first optical communication device based on the new key, improving the security of communication between the two devices.

[0067] In one possible implementation, the second optical communication device sending a sequence number response message to the first optical communication device based on the random delay parameter includes:

[0068] The second optical communication device generates a sequence number response message and sends the sequence number response message to the first optical communication device after the delay corresponding to the random delay parameter is satisfied.

[0069] In one possible scenario, after receiving the key generation message, the second optical communication device transitions from the key-inactive state to the key generation state.

[0070] In one possible implementation, the second optical communication device generates a new key based on the key parameters in the key generation message, including:

[0071] The second optical communication device generates an intermediate key based on the key parameters and shared key sent by the first optical communication device. Then, it generates a new key based on the shared key, the intermediate key, and the key parameters generated by the second optical communication device. This scheme improves the security of the generated new keys (sending and receiving keys) by adding an intermediate key.

[0072] In one possible scheme, the key parameter includes a random number.

[0073] In one possible implementation, the key generation message received by the second optical communication device also includes a key index. After generating the new key, the second optical communication device can also locally store the correspondence between the generated new key and the key index.

[0074] In one possible approach, the above authentication method also includes:

[0075] The second optical communication device sends a new key reporting message to the first optical communication device, the key reporting message carrying the new key generated by the second optical communication device.

[0076] In one possible scenario, the second optical communication device uses a shared key to encrypt the generated new key, and the encrypted new key is included in the key reporting message sent by the second optical communication device.

[0077] In one possible scenario, after generating a new key, the second optical communication device transitions from the key generation state to a key confirmation waiting state. In the key confirmation waiting state, the second optical communication device can send the aforementioned new key reporting message to the first optical communication device.

[0078] In one possible scenario, when the second optical communication device sends the new key reporting message to the first optical communication device, it starts a third key waiting timer.

[0079] When the third key waiting timer expires and the second optical communication device has not received a key confirmation message from the first optical communication device, the second optical communication device resends the new key reporting message to the first optical communication device. This scheme, by setting a key waiting timer, avoids the second optical communication device waiting for a long time for the key confirmation message, thus improving the reliability of the authentication method.

[0080] The parameters and beneficial effects carried in the new key reporting message sent by the second optical communication device can be referred to the description in the fifth aspect above, and will not be repeated here.

[0081] In one possible scheme, the above authentication method further includes: the second optical communication device receiving a key confirmation message sent by the first optical communication device and entering a key confirmation state.

[0082] The key confirmation message received by the second optical communication device carries a key index, and the second optical communication device confirms that the first optical communication device has obtained the new key based on the index.

[0083] After receiving the key confirmation message, the second optical communication device can change the status of the new key to enabled (enabled new key).

[0084] In one possible scheme, the above authentication method further includes: the second optical communication device sending a current key reporting message to the first optical communication device, and the second optical communication device entering the key activation state.

[0085] In one possible scenario, the current key reporting message carries (including) the identifier of the second optical communication device to identify the source of the new key reporting message.

[0086] In one possible implementation, the current key reporting message includes a reporting type (new key reporting or current key reporting). In this embodiment, the reporting type included in the current key reporting message is current key reporting, meaning that the second optical communication device reports a key that already exists (as opposed to a previously reported new key).

[0087] In one possible scenario, the aforementioned current key reporting message includes a key index. The first optical communication device can then obtain the new key generated by the second optical communication device based on the key index.

[0088] In one possible scheme, the current key reporting message carries an integrity check bit. This check bit is used by the first optical communication device to perform integrity verification on the current key reporting message, thereby enhancing the security of the current key reporting message. The first optical communication device can use an integrity key shared between the first and second optical communication devices to generate the integrity check bit.

[0089] In one possible scenario, the second optical communication device generates a key name based on the shared key and the new key, and the aforementioned current key reporting message includes the key name generated by the second optical communication device. For example, the second optical communication device calculates a hash value (key name Key_Name) based on the shared key and the new key.

[0090] Correspondingly, after receiving the current key reporting message, the first optical communication device can verify the previously saved new key based on the key name, further enhancing communication security. For example, the first optical communication device calculates a key name based on the saved new key, and checks whether the calculated key name matches the key name carried in the current key reporting message. If they match, it means that the previously saved new key is correct, and subsequent communication between the second optical communication device can use the new key for encryption.

[0091] Optionally, in the first to sixth aspects, the broadcast message is a physical layer operation, administration & maintenance (PLOAM) message, which includes a field for carrying the configuration information; or, the broadcast message is a GPON transmission convergence (GTC) frame or an Ethernet message.

[0092] When the broadcast message is a PLOAM message, the PLOAM message can be an extended burst length message, an upstream_overhead configuration message, or an extended optical network unit (ONU) configuration message. Using existing or newly added PLOAM messages to carry this configuration information requires minimal protocol modifications and is easy to implement.

[0093] When the broadcast message is a GTC frame, the GTC frame can be a downlink synchronization frame. Optionally, this configuration information can be carried in the frame header or payload of the GTC frame.

[0094] Optionally, the key generation message is a Key_Control(Generate) PLOAM message, and the new key reporting message is a Key_Report(Newkey) PLOAM message. The key confirmation message is a Key_Control(Confirm) PLOAM message, and the current key reporting message is a Key_Report(Existingkey) PLOAM message.

[0095] In aspects one through six, both the first optical communication device and the second optical communication device are devices within an optical access network. For example, the first optical communication device is an optical line termination (OLT) in a PON system, and the second optical communication device is an ONU in the PON system. Another example is that the first optical communication device is the primary fiber-to-the-room (FTTR), and the second optical communication device is the secondary FTTR. Here, the primary FTTR refers to the primary ONU in the FTTR scenario, also known as the primary gateway; the secondary FTTR refers to the secondary ONU in the FTTR scenario, also known as the secondary gateway.

[0096] In a seventh aspect, this application provides a configuration apparatus for an optical communication device. This configuration apparatus has the function of implementing the method described in the first aspect or any alternative method of the first aspect. The function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above-described function.

[0097] Eighthly, this application provides a configuration apparatus for an optical communication device. This configuration apparatus has the function of implementing the method described in the second aspect or any alternative method of the second aspect. The function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above-described function.

[0098] Ninthly, embodiments of this application provide an authentication device for an optical communication device. This authentication device for the optical communication device has the function of implementing the method described in the third aspect or any of the optional embodiments of the third aspect. The function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above-described function.

[0099] In a tenth aspect, embodiments of this application provide an authentication device for an optical communication device. This authentication device for the optical communication device has the function of implementing the method described in the fourth aspect or any of the optional embodiments of the fourth aspect. The function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above-described function.

[0100] Eleventhly, an optical communication device is provided. The optical communication device includes a processor and a memory. The memory stores software programs and modules. The processor implements the methods described in the first aspect or any possible implementation of the first aspect by running or executing the software programs and / or modules stored in the memory; or implements the methods described in the second aspect or any possible implementation of the second aspect; or implements the methods described in the third aspect or any possible implementation of the third aspect; or implements the methods described in the fourth aspect or any possible implementation of the fourth aspect; or implements the methods described in the fifth aspect or any possible implementation of the fifth aspect; or implements the methods described in the sixth aspect or any possible implementation of the sixth aspect.

[0101] Optionally, the processor may be one or more, and the memory may be one or more.

[0102] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0103] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0104] In a twelfth aspect, a computer program product is provided. The computer program product includes computer program code that, when executed by a computer, causes the computer to perform the method described in the first aspect or any possible implementation of the first aspect; or, perform the method described in the second aspect or any possible implementation of the second aspect; or, perform the method described in the third aspect or any possible implementation of the third aspect; or, perform the method described in the fourth aspect or any possible implementation of the fourth aspect; or, implement the method described in the fifth aspect or any possible implementation of the fifth aspect; or, implement the method described in the sixth aspect or any possible implementation of the sixth aspect.

[0105] In a thirteenth aspect, this application provides a computer-readable storage medium for storing program code executed by a processor, the program code including instructions for implementing the method in any possible embodiment of the first aspect above; or, implementing the method in any possible embodiment of the second aspect above; or, implementing the method in any possible embodiment of the third aspect above; or, implementing the method in any possible embodiment of the fourth aspect above; or, implementing the method in any possible embodiment of the fifth aspect above; or, implementing the method in any possible embodiment of the sixth aspect above.

[0106] In a fourteenth aspect, this application provides a chip including a processor, the processor being configured to retrieve and execute instructions stored in a memory, causing an optical communication device on which the chip is mounted to perform the method in any of the possible embodiments of the first aspect above, or to perform the method in any of the possible embodiments of the second aspect above; or to perform the method in any of the possible embodiments of the third aspect above; or to perform the method in any of the possible embodiments of the fourth aspect above; or to implement the method in any of the possible embodiments of the fifth aspect above; or to implement the method in any of the possible embodiments of the sixth aspect above.

[0107] In a fifteenth aspect, this application provides another chip. This other chip includes an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are interconnected via internal interconnection paths. The processor is used to execute code in the memory. When the code is executed, the processor is used to perform the method in any of the possible embodiments of the first aspect described above; or, perform the method in any of the possible embodiments of the second aspect described above; or, perform the method in any of the possible embodiments of the third aspect described above; or, perform the method in any of the possible embodiments of the fourth aspect described above; or, implement the method in any of the possible embodiments of the fifth aspect described above; or, implement the method in any of the possible embodiments of the sixth aspect described above. Attached Figure Description

[0108] Figure 1 This is a schematic diagram of the structure of a PON system provided in an embodiment of this application;

[0109] Figure 2 This is a schematic diagram of a configuration method for an optical communication device provided in an embodiment of this application;

[0110] Figure 3 This is a schematic diagram of another configuration method for an optical communication device provided in an embodiment of this application;

[0111] Figure 4 This is a schematic diagram of a data transmission process in a PON system provided in an embodiment of this application;

[0112] Figure 5 This is a schematic diagram of an authentication method for an optical communication device provided in an embodiment of this application;

[0113] Figure 6 This is a block diagram of a configuration device for an optical communication equipment provided in an embodiment of this application;

[0114] Figure 7 This is a block diagram of a configuration apparatus for another optical communication device provided in an embodiment of this application;

[0115] Figure 8 This is a block diagram of an authentication device for an optical communication equipment provided in an embodiment of this application;

[0116] Figure 9 This is a block diagram of an authentication device for another optical communication equipment provided in an embodiment of this application;

[0117] Figure 10 This is a schematic diagram of the structure of an optical communication device provided in an embodiment of this application. Detailed Implementation

[0118] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0119] Figure 1 This is a schematic diagram of a PON system provided in an embodiment of this application. Figure 1 As shown, the PON system includes a first optical communication device 110, a second optical communication device 120, and an ODN 130. The first optical communication device 110 is connected to one or more second optical communication devices 120 through the ODN 130. Both the first optical communication device 110 and the second optical communication device 120 are devices within the optical access network.

[0120] For example, the first optical communication device is an OLT, and the second optical communication device is an ONU. Another example is that the first optical communication device is the master FTTR, and the second optical communication device is the slave FTTR. Here, the master FTTR refers to the master ONU in the FTTR scenario, also known as the master gateway; the slave FTTR refers to the slave ONU in the FTTR scenario, also known as the slave gateway. The master FTTR is generally installed in the living room or doorway information box. In addition to providing network functions for general ONUs, it also performs configuration synchronization, channel optimization, and other management functions for other ONUs in the home.

[0121] In this embodiment of the application, ONU can also be referred to as optical network termination (ONT).

[0122] The first optical communication device 110 is typically located on the network side, such as a central office (CO), and can centrally manage multiple second optical communication devices 120. The first optical communication device 110 can act as a medium between the second optical communication devices 120 and an upper-layer network (not shown in the figure), forwarding data received from the upper-layer network to the second optical communication device 120, and forwarding data received from the second optical communication device 120 to the upper-layer network. The upper-layer network includes, but is not limited to, the Internet, the public switched telephone network (PSTN), and community antenna television (CATV).

[0123] Multiple second optical communication devices 120 can be distributed and installed on the user side. Each second optical communication device 120 can be a network device for communicating with the first optical communication device 110 and the user equipment. Each second optical communication device 120 can act as a medium between the first optical communication device 110 and the user equipment; for example, the second optical communication device 120 can forward data received from the first optical communication device 110 to the user equipment, and forward data received from the user equipment to the first optical communication device 110.

[0124] ODN 130 is a data distribution / multiplexing system that may include a backbone fiber, a passive optical splitter, and user fibers. The passive optical splitter may include a first port and multiple second ports. The first port of the passive optical splitter is connected to a first optical communication device 110 via the backbone fiber, and each second port of the passive optical splitter is connected to a second optical communication device 120 via a user fiber.

[0125] In a PON system, the data flow from the first optical communication device 110 to the second optical communication device 120 is downlink. The first optical communication device 110 broadcasts downlink data to all second optical communication devices 120, and each second optical communication device 120 only receives data with its own identifier. Conversely, the data flow from the second optical communication device 120 to the first optical communication device 110 is uplink. The first optical communication device 110 allocates time slots to each second optical communication device 120, and each second optical communication device 120 transmits uplink data according to the time slots allocated by the first optical communication device 110. The allocation of time slots by the first optical communication device 110 to each second optical communication device 120 can be referred to as bandwidth allocation or bandwidth granting.

[0126] In this embodiment, the first optical communication device 110 sends a broadcast message to the second optical communication device 120 to configure random delay parameters for the second optical communication device 120. After receiving the broadcast message, the second optical communication device 120 determines the random delay parameters based on the received broadcast message and sends a sequence number response message according to the random delay parameters. See the method embodiments below for details.

[0127] In the embodiments of this application, the PON system includes, but is not limited to, gigabit-capable PON (GPON), 10 gigabit per second PON (XG-PON), 10-gigabit-per-second symmetric passive optical network (XGS-PON), Ethernet PON (EPON), 10 gigabit per second EPON (10G-EPON), 25 gigabit per second PON (25G-PON), 50 gigabit per second PON (50G-PON), 100 gigabit per second PON (100G-PON), 25 gigabit per second EPON (25G-EPON), and 50 gigabit per second EPON (50G-PON). EPON (50G-EPON), as well as other rates such as GPON and EPON.

[0128] Figure 2 This is a schematic flowchart illustrating a configuration method for an optical communication device provided in an embodiment of this application. Figure 2 As shown, the method includes the following steps.

[0129] S201: The first optical communication device determines the random delay parameters.

[0130] The random delay parameter is less than 48 μs. In related technologies, the default random delay parameter is 48 μs.

[0131] S202: The first optical communication device sends a broadcast message to multiple second optical communication devices. The broadcast message carries configuration information, which is used to configure random delay parameters.

[0132] Accordingly, the second optical communication device receives the broadcast message sent by the first optical communication device.

[0133] S203: The second optical communication device obtains and saves configuration information from the received broadcast message.

[0134] In this way, the second optical communication device can send response messages, such as sequence number response messages, according to the random delay parameters corresponding to the configuration information.

[0135] In this embodiment, the first optical communication device can send a broadcast message carrying configuration information for configuring random delay parameters. Therefore, the random delay parameters of the second optical communication device can be flexibly configured as needed. Furthermore, the random delay parameter configured in the configuration information is less than 48 μs. With the round-trip propagation delay remaining constant, the length of the silent window can be reduced, which is beneficial for reducing the data transmission delay of the certified second optical communication device. With the round-trip propagation delay reduced, the length of the silent window can be further reduced, which also helps to reduce the data transmission delay of the certified second optical communication device.

[0136] In some embodiments, the method is executed in scenarios where the maximum differential distance between the first optical communication device and the plurality of second optical communication devices is less than 20 km. When the maximum differential distance between the first optical communication device and the plurality of second optical communication devices is small, it is usually necessary to reduce the length of the silent window to improve the transmission performance of the second optical communication devices. Therefore, it is possible to adopt... Figure 2 The method described above configures the random delay parameters. In campus network or FTTR scenarios, the communication distances between each second optical communication device and the first optical communication device are relatively small, and correspondingly, the maximum differential distance is also relatively small. For example, in a campus network scenario, the maximum communication distance between the first optical communication device and multiple second optical communication devices is typically less than 10km. In an FTTR scenario, the maximum communication distance between the first optical communication device and multiple second optical communication devices is less than 5km, and typically less than 1km.

[0137] In this embodiment, the communication distance between the second optical communication device and the first optical communication device can refer to the length of the optical fiber connecting the two devices. Differential distance, also known as fiber optic differential distance, can refer to the difference in communication distance between any two second optical communication devices and the first optical communication device. Maximum differential distance refers to the difference between the maximum and minimum communication distances between the first optical communication device and each of the second optical communication devices.

[0138] In one possible implementation, the configuration information is the index value corresponding to the random delay parameter. Different values ​​of the random delay parameter correspond to different index values.

[0139] In some examples, several random delay parameter values ​​can be spaced out within the range of 0 to 48 μs, with each random delay parameter value corresponding to an index value. The intervals between adjacent random delay parameter values ​​can be equal or unequal. Using this method, fewer bits can be used to indicate random delay parameters.

[0140] For example, 10μs, 20μs, 30μs and 40μs can be selected as random delay parameter point values, corresponding to index values ​​00, 01, 10 and 11 respectively. In this way, only 2 bits are needed to indicate the random delay parameter.

[0141] In other examples, more random delay parameter point values ​​can be arranged within the range of 0 to 48 μs, and this application does not impose any limitations on this. The number of random delay parameter point values ​​is related to the number of bits carrying the configuration information (i.e., the bits used to indicate the random delay parameters). For example, if the number of bits carrying the configuration information is n, then the number of random delay parameter point values ​​is less than or equal to 2 to the power of n.

[0142] In another possible implementation, the configuration information is directly the value of the random delay parameter. In this case, there are more possibilities for the configured random delay parameter, even reaching the order of 0.1 μs. For example, 2.1 μs, 3.8 μs, etc.

[0143] In the following description, the first optical communication device will be an OLT and the second optical communication device will be an ONU as an example. Those skilled in the art will understand that the OLT in the following description can also be a master FTTR, and the ONU can also be a slave FTTR.

[0144] Figure 3 This is a schematic flowchart illustrating a configuration method for an optical communication device provided in an embodiment of this application. Figure 3 As shown, the method includes the following steps.

[0145] S301: OLT receives random delay parameters.

[0146] For example, the OLT receives random delay parameters input through the configuration interface. These random delay parameters are set by the staff based on the PON system's network topology. For instance, they may be determined based on the maximum differential distance between the OLT and multiple ONUs. The staff can directly configure these random delay parameters, which is simple to implement and requires minimal changes to the OLT's execution logic.

[0147] Alternatively, in other embodiments, the OLT may determine the random delay parameters in the following two ways.

[0148] The first method involves determining the random delay parameter based on the maximum differential distance between the OLT and multiple ONUs. This random delay parameter is directly proportional to the maximum differential distance. In some examples, this maximum differential distance can be received by the OLT through its configuration interface. The operator inputs this maximum differential distance into the OLT according to the PON system's networking configuration.

[0149] In some examples, the OLT determines the random delay parameter as the product of the default random delay parameter (i.e., 48 μs) and a first scaling factor. For instance, the first scaling factor can be equal to the ratio of the maximum differential distance to 20 km. Assuming the maximum differential distance is 2 km, the first scaling factor is 0.1, and the random delay parameter is 4.8 μs.

[0150] In this first method, since the smaller the maximum difference distance, the shorter the length of the silent window needs to be, the default random delay parameter can be calculated based on the maximum difference distance. The calculation method is simple and easy to implement.

[0151] The second method determines the random delay parameter based on the remaining bandwidth, which is the bandwidth not allocated to the ONU during a bandwidth allocation cycle. The random delay parameter is less than the length of the remaining bandwidth minus the difference between the round-trip propagation delay and the change in ONU response time.

[0152] For example, a bandwidth allocation period is 125μs.

[0153] Assuming the allocated bandwidth is 85μs, the remaining bandwidth is 40μs. If the maximum differential distance is 1km, the round-trip propagation delay corresponding to this maximum differential distance is 10μs, and the ONU response change is 2μs, then the random delay parameter is less than or equal to 28μs.

[0154] For example, the OLT may determine the remaining bandwidth by first determining the allocated bandwidth in each bandwidth allocation cycle based on the bandwidth of each authenticated ONU connected to the OLT; then, determining the remaining bandwidth as the difference between the bandwidth allocation cycle and the allocated bandwidth. The allocated bandwidth is equal to the sum of the bandwidths of each authenticated ONU. The bandwidth of each authenticated ONU can be obtained based on its subscription information. Based on this subscription information, the length of time slots that each ONU needs to be allocated in each bandwidth allocation cycle can be determined.

[0155] Figure 4 This is a schematic diagram illustrating the data transmission process in a PON system according to an embodiment of this application. Figure 4As shown, ONU1 and ONU2 are authenticated ONUs. In each bandwidth allocation cycle (i.e., 125μs), uplink bandwidth is allocated to both ONU1 and ONU2. ONU1 transmits data 1 using its allocated uplink bandwidth, and ONU2 transmits data 2 using its allocated uplink bandwidth. ONUx is a newly powered-on ONU, and ONUx sends a sequence number response message X within the silent window. From... Figure 4 It can be seen that the length of the silent window is less than 125μs and is within the remaining bandwidth, so it does not affect the data transmission of ONU1 and ONU2.

[0156] As can be seen, this second method utilizes remaining bandwidth for windowing, avoiding impact on data transmission of already certified ONUs. Furthermore, by determining the random latency parameters based on the remaining bandwidth, since each certified ONU can transmit data normally in each bandwidth allocation cycle, the frequency of windowing can be increased. For example, a window can be set at 1ms or 2ms. This allows for timely detection of newly connected ONUs and rapid certification of them.

[0157] S302: The OLT sends a broadcast message to multiple ONUs.

[0158] In some examples, the broadcast message can be a PLOAM message.

[0159] In one possible implementation, a new field can be added to the existing PLOAM message to carry the configuration information.

[0160] Alternatively, the existing PLOAM message can be an extended burst length message or an upstream_overhead configuration message.

[0161] The formats of these two PLOAM messages are explained below.

[0162] Table 1: Format of Extended Burst Length Messages

[0163]

[0164] As shown in Table 1, the extended burst length message includes 12 bytes, of which the 5th byte is used to carry random delay parameters. Bytes 6-12 are reserved bytes. That is, the 5th byte is the field used to carry the configuration information. In other embodiments, other reserved bytes can also be used to carry random delay parameters.

[0165] When using extended burst length messages to carry configuration information, the number of bits used to carry the configuration information is large. Therefore, the configuration information can be the index value corresponding to the aforementioned random delay parameter, or the configuration information can be the value of the random parameter delay directly.

[0166] Table 2: Format of upstream_overhead messages

[0167]

[0168] As shown in Table 2, the upstream_overhead message consists of 12 bytes, with some bits reserved in the 10th byte. Therefore, these reserved bits can be used to carry configuration information. That is, the 10th byte is the field used to carry this configuration information. Since the number of bits available to carry configuration information in this method is limited, this configuration information can be the index value corresponding to the aforementioned random delay parameter.

[0169] In another possible implementation, a new PLOAM message can be added, which includes a field for carrying the configuration information. For example, this new PLOAM message can be referred to as an extended ONU config message.

[0170] Table 3. Format of Extended ONU Config Messages

[0171]

[0172] As shown in Table 3, the newly added PLOAM message includes 12 bytes. The first byte indicates that the message type is a broadcast message sent to all ONUs. The second byte indicates that the message identifier is an extended ONU configuration message. The third byte carries random delay parameters. Bytes 4-12 are reserved bytes. That is, the third byte is the field used to carry the configuration information. In other embodiments, other reserved bytes can also be used to carry random delay parameters.

[0173] When using the newly added PLOAM message to carry configuration information, the number of bits used to carry the configuration information is relatively large. Therefore, the configuration information can be the index value corresponding to the aforementioned random delay parameter, or the configuration information can be the value of the random parameter delay directly.

[0174] In other examples, the broadcast message can be a GTC frame. In this case, the PON system to which the OLT and ONU belong can be a GPON system of various rates. GTC frames include, but are not limited to, downlink synchronization frames (DS frames with valid PSync). Optionally, configuration information can be carried in the frame header or payload field of the GTC frame.

[0175] In some other examples, the broadcast message is an Ethernet message. In this case, the PON system to which the OLT and ONU belong is an EPON system of various rates.

[0176] Accordingly, the ONU receives broadcast messages sent by the OLT.

[0177] S303: The ONU obtains and saves configuration information from the received broadcast message.

[0178] Figure 5 This is a flowchart illustrating an authentication method for an optical communication device provided in an embodiment of this application. Figure 5 As shown, the method includes the following steps.

[0179] S501: The OLT sends a broadcast message.

[0180] This broadcast message carries configuration information used to configure random delay parameters, which are less than 48μs. This broadcast message is a PLOAM message. For more information on PLOAM messages, please refer to [link to PLOAM message documentation]. Figure 3 The illustrated embodiment will not be described in detail here. For the method by which the OLT obtains this random delay parameter, please refer to [link to documentation]. Figure 3 The embodiments shown will not be described in detail here.

[0181] S502: The OLT sends a sequence number request message to multiple ONUs.

[0182] Correspondingly, the first ONU receives the sequence number request message.

[0183] Optionally, the OLT sends a sequence number request message during a silent window. During the silent window, authenticated ONUs cannot send uplink data.

[0184] Optionally, the length of the silent window is less than 125 μs. The shorter the silent window, the less impact it has on the data transmission of certified ONUs. Compared to the typical 250 μs in related technologies, reducing the silent window length to less than 125 μs can significantly reduce the impact on the data transmission of certified ONUs.

[0185] The length of the silent window is determined based on the maximum differential distance between the OLT and multiple ONUs. When the length of the silent window is less than 125 μs, the maximum differential distance between the OLT and ONUs is less than 12.5 km. This is because, according to the standard, when the maximum differential distance between the OLT and ONUs is 20 km, the corresponding round-trip propagation delay is 200 μs. Assuming that 125 μs is all round-trip propagation delay, the corresponding maximum differential distance is 12.5 km. Since the length of the silent window is equal to the sum of the round-trip propagation delay, the change in ONU response time (default is 2 μs), and the random delay parameter, when the length of the silent window is equal to 125 μs, the maximum differential distance between the OLT and ONUs is less than 12.5 km.

[0186] In some embodiments, the length of the silent window is less than 48 μs, for example, greater than or equal to 4 μs and less than 48 μs. This further reduces the impact on data transmission to the authenticated ONU.

[0187] S503: The first ONU responds to the sequence number request message and sends a sequence number response message to the OLT according to the random delay parameter.

[0188] The first ONU is any ONU that receives the sequence number request message.

[0189] In S503, the first ONU arbitrarily selects a random number within the random delay parameter as the target delay value, and sends a sequence number response message after delaying by the target delay value. The probability that different ONUs determine the same target delay value is small; therefore, the probability that the OLT simultaneously receives sequence number response messages sent by different ONUs is also small, thereby reducing conflicts between sequence number response messages sent by different ONUs.

[0190] The sequence number response message carries the sequence number of the first ONU. Correspondingly, the OLT receives this sequence number response message.

[0191] S504: The OLT authenticates the first ONU based on the received sequence number response message.

[0192] The serial number in the serial number response message is compared with the pre-saved serial number of the first ONU. If the serial number in the serial number response message is different from the pre-saved serial number of the first ONU, the first ONU fails authentication. If the serial number in the serial number response message is the same as the pre-saved serial number of the first ONU, the subsequent authentication process is performed. The subsequent authentication process includes ranging procedures, etc. For details, please refer to the relevant technologies.

[0193] In this embodiment, if the ONU successfully completes the subsequent authentication process, the ONU enters the operation state. Upon entering the operation state, there is no key between the ONU and the OLT that can be used to encrypt the payload; both the OLT and ONU are in a key-inactive state. The authentication method provided in this embodiment further includes the following steps:

[0194] S505: The OLT sends a key generation message to the ONU, which carries the key index and key parameters.

[0195] In this embodiment, the OLT can transition from a key-inactive state to a key-requesting state. The OLT in the key-requesting state can send a key generation message to the ONU in the key-inactive state, carrying the key index and key parameters. Furthermore, the OLT can also start a key wait timer 1.

[0196] Specifically, the channel termination (CT) module in the OLT can send PLOMA messages to the ONU, such as the Key_Control(Generate) PLOAM message.

[0197] In this embodiment, the Key_Control(Generate)PLOMA message sent by the OLT carries the index of the new key and the random number R1 generated by the OLT. Simultaneously, the OLT starts the key wait timer 2 when sending the PLOMA message to the ONU.

[0198] S506: The ONU generates a new key based on the key generation message.

[0199] In this embodiment, the ONU, which is in a key-inactive state, enters the key generation state after receiving a key generation message from the OLT. Upon entering the key generation state, the ONU can start a key wait timer 4.

[0200] In the key generation state, the ONU generates a new key based on the key generation message. For example, the ONU generates a new key (which may include a sending key and a receiving key) based on the random number R1 in the PLOAM message mentioned above and its own generated random number R2.

[0201] S507: The ONU sends a new key reporting message to the OLT, which carries the new key generated by the ONU.

[0202] In this embodiment, the ONU can send a PLOAM message to the OLT to send a new key. For example, the ONU sends a Key_Report(Newkey)PLOAM message to the OLT. After the ONU sends the Key_Report(Newkey)PLOAM message to the OLT, the ONU enters a key confirmation waiting state and starts a key waiting timer 5.

[0203] The new key can be encrypted using the shared key between the OLT and ONU; that is, the Key_Report(Newkey)PLOAM message carries the encrypted new key. After receiving the encrypted new key, the OLT can decrypt it using the shared key to obtain the new key.

[0204] After receiving the Key_Report(Newkey)PLOAM message, the OLT transitions from the current key request state to the key confirmation state and executes step S508. If the OLT's local key wait timer 2 times out and the OLT has not yet received the Key_Report(Newkey)PLOAM message, the OLT will again initiate a key generation Key_Control(Generate)PLOAM message to the ONU.

[0205] S508: The OLT saves the new key generated by the ONU carried in the new key reporting message.

[0206] After receiving a new key report message, the OLT can decrypt the Key_Report(Newkey)PLOAM message (e.g., using a shared key) to obtain the new key carried within, and then save the correspondence between the decrypted new key and the key index.

[0207] S509: The OLT sends a key confirmation message to the ONU, which carries the key index.

[0208] The OLT can send a PLOAM message, such as a Key_Control(Confirm) PLOAM message, to the ONU to confirm that the new key has been received. After sending the Key_Control(Confirm) PLOAM message to the ONU, the OLT can start a key wait timer 3.

[0209] After receiving the Key_Control(Confirm)PLOAM message sent by the OLT, the ONU enters the key confirmation state from the key confirmation waiting state.

[0210] If the ONU has not received the Key_Control(Confirm)PLOAM message from the OLT after the key wait timer 5 expires, the ONU executes step S507, that is, resends the Key_Report(Newkey)PLOAM message. If the ONU receives a new Key_Control(Generate)PLOAM message at this time, the ONU executes step S507 again, that is, resends the Key_Report(Newkey)PLOAM message to the OLT.

[0211] S510: The ONU modifies the status of the new key and sends a current key reporting message to the OLT.

[0212] In this process, the ONU changes the status of the new key from inactive to enabled, and then sends a Key_Report(Existingkey)PLOAM message to the OLT. After the ONU sends the Key_Report(Existingkey)PLOAM message, the ONU transitions from the key confirmation state to the key enable state, thus completing the new key enablement process.

[0213] Correspondingly, after receiving the Key_Report(Existingkey)PLOAM message, the OLT enters the key activation state. The payload in subsequent downlink physical frames sent to the ONU will be encrypted using this new key. Additionally, if the OLT has not received the Key_Report(Existingkey)PLOAM message by the timer 3 expires, the OLT sends a new Key_Control(Confirm)PLOAM message to the ONU to reconfirm the new key.

[0214] In this embodiment, by setting timers (key wait timers 1, 2, 3, 4, and 5) on the OLT and ONU, the authentication process can avoid prolonged waiting times, thus improving authentication efficiency. Furthermore, the OLT can flexibly set the duration of key wait timer 1 to control the total time of the key activation process. That is, if key wait timer 1 times out before the OLT enters the key activation state, the OLT enters the key-disabled state and restarts step S505. Correspondingly, the ONU can also flexibly set the duration of key wait timer 4 to control the total time of the key activation process. That is, if key wait timer 4 times out before the ONU enters the key activation state, the ONU enters the key-disabled state, waits to receive the key generation message sent by the OLT, and then restarts step S506.

[0215] In the authentication method provided in this embodiment, the new key can be used for communication between ONU and OLT. That is, the data sending and receiving process between OLT and ONU can be encrypted or decrypted using the new key, which improves the security of communication between ONU and OLT.

[0216] In the authentication method provided in this embodiment, the ONU can first generate an intermediate key based on the random number R1 sent by the OLT and the shared key, and then use the intermediate key, the shared key, and the random number R2 generated by the ONU itself to generate a new key. By adding an intermediate key, the security of the generated new key (sending key and receiving key) can be improved.

[0217] In the authentication method provided in this embodiment, the current key reporting message sent by the ONU can carry a key name generated by the ONU based on the new key, so that the OLT can verify the local key based on the key name. For example, the OLT calculates a key name (Key_name) based on the key saved in step S508. If the key name calculated by the OLT is consistent with the key name in the current key reporting message, the key verification is successful. The OLT performs encrypted communication with the ONU based on the locally saved key. For example, Key_Name = AES_CMAC(shared key, new key|0x33313431353932363533353839373933,128).

[0218] Figure 6 This is a block diagram of a configuration device for an optical communication device according to an embodiment of this application. This configuration device can be implemented through software, hardware, or a combination of both, becoming all or part of the optical communication device (e.g., an OLT or a main FTTR). Figure 6 As shown, the configuration device 600 includes a determining unit 601 and a sending unit 602.

[0219] The determining unit 601 is used to determine random delay parameters, which are less than 48μs. The transmitting unit 602 is used to send broadcast messages to multiple second optical communication devices. The broadcast messages carry configuration information, which is used to configure the random delay parameters.

[0220] Optionally, the determining unit 601 is used to determine the random time delay parameters using any of the following methods:

[0221] The random delay parameter is received as input; or, the random delay parameter is determined based on the maximum differential distance between the first optical communication device and multiple second optical communication devices, wherein the random delay parameter is proportional to the maximum differential distance; or, the random delay parameter is determined based on the remaining bandwidth, wherein the remaining bandwidth is the bandwidth not allocated to the second optical communication devices in a bandwidth allocation cycle, wherein the random delay parameter is less than the length of the remaining bandwidth minus the difference between the round-trip propagation delay and the change in the response time of the second optical communication devices.

[0222] Figure 7 This is a block diagram of a configuration device for an optical communication device according to an embodiment of this application. This configuration device can be implemented through software, hardware, or a combination of both, becoming all or part of the optical communication device (e.g., an ONU or an FTTR). Figure 7 As shown, the configuration device 700 includes a receiving unit 701 and a storage unit 702.

[0223] The receiving unit 701 is used to receive broadcast messages sent by the first optical communication device. The broadcast messages carry configuration information, which is used to configure random delay parameters. The random delay parameters are less than 48μs. The storage unit 702 is used to store the configuration information.

[0224] It should be noted that the configuration device for the optical communication device provided in the above embodiments is only an example of the division of the above functional units when configuring the optical communication device. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the configuration device for the optical communication device provided in the above embodiments and the configuration method embodiments for the optical communication device belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0225] Figure 8 This is a block diagram of an authentication device for an optical communication device provided in an embodiment of this application. This configuration device can be implemented through software, hardware, or a combination of both, becoming all or part of the optical communication device (e.g., an OLT or a main FTTR). Figure 8 As shown, the authentication device 800 includes a sending unit 801 and a receiving unit 802.

[0226] The transmitting unit 801 is used to send broadcast messages to multiple second optical communication devices. The broadcast messages carry configuration information, which is used to configure random delay parameters, the random delay parameters being less than 48μs; and to send sequence number request messages to the multiple second optical communication devices. The receiving unit 802 is used to receive sequence number response messages sent by the second optical communication devices. The sequence number response messages are sent by the second optical communication devices according to the random delay parameters configured in the configuration information.

[0227] Figure 9 This is a block diagram of an authentication device 900 for an optical communication device provided in an embodiment of this application. This configuration device can be implemented as all or part of an optical communication device (e.g., an ONU or an FTTR) through software, hardware, or a combination of both. Figure 9 As shown, the authentication device 900 includes a receiving unit 901 and a sending unit 902.

[0228] The receiving unit 901 is used to receive a broadcast message sent by the first optical communication device, the broadcast message carrying configuration information used to configure random delay parameters, the random delay parameters being less than 48μs; and to receive a sequence number request message sent by the first optical communication device. The sending unit 902 is used to respond to the sequence number request message by sending a sequence number response message to the first optical communication device according to the random delay parameters.

[0229] It should be noted that the authentication device for optical communication equipment provided in the above embodiments is only illustrated by the division of the above functional units when authenticating optical communication equipment. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the authentication device for optical communication equipment provided in the above embodiments and the authentication method embodiments for optical communication equipment belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0230] The descriptions of the processes corresponding to the above-mentioned figures each have their own emphasis. For parts of a process that are not described in detail, please refer to the relevant descriptions of other processes.

[0231] Figure 10 This is a schematic diagram of the structure of an optical communication device 1000 provided in an embodiment of this application. For example... Figure 10 As shown, the optical communication device 1000 includes at least one processor 1001, a memory 1002, and at least one network interface 1003.

[0232] Processor 1001 may be, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the embodiments of this application. For example, processor 1001 may include an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0233] Memory 1002 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Optionally, memory 1002 exists independently and is connected to processor 1001 via internal connection 1004. Alternatively, memory 1002 and processor 1001 may be integrated together.

[0234] Network interface 1003 uses any transceiver-like device for communicating with other devices or communication networks. Network interface 1003 includes, for example, at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0235] In some embodiments, processor 1001 includes one or more CPUs, such as Figure 10 CPU0 and CPU1 are shown in the diagram.

[0236] In some embodiments, the optical communication device 1000 may optionally include multiple processors, such as... Figure 10 The processors 1001 and 1005 shown are illustrated. Each of these processors is, for example, a single-core processor (CPU) or a multi-core processor (CPU). Here, "processor" may optionally refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0237] In some embodiments, the optical communication device 1000 further includes an internal connection 1004. The processor 1001, memory 1002, and at least one network interface 1003 are connected via the internal connection 1004. The internal connection 1004 includes pathways for transmitting information between the aforementioned components. Optionally, the internal connection 1004 is a single board or a bus. Optionally, the internal connection 1004 may be divided into an address bus, a data bus, a control bus, etc.

[0238] In some embodiments, the optical communication device 1000 further includes an input / output interface 1006. The input / output interface 1006 is connected to the internal connection 1004.

[0239] In some embodiments, the input / output interface 1006 is used to connect to an input device to receive commands or data input by a user through the input device, as described in the above method embodiments, such as random delay parameters or maximum differential distance. Input devices include, but are not limited to, keyboards, touchscreens, microphones, mice, or sensing devices.

[0240] In some embodiments, the input / output interface 1006 is also used to connect to an output device. The input / output interface 1006 outputs intermediate and / or final results generated by the processor 1001 executing the above method embodiments, such as random delay parameters, through the output device. The output device includes, but is not limited to, a display, printer, projector, etc.

[0241] Optionally, the processor 1001 implements the method in the above embodiments by reading the program code 1010 stored in the memory 1002, or the processor 1001 implements the method in the above embodiments by internally stored program code. When the processor 1001 implements the method in the above embodiments by reading the program code 1010 stored in the memory 1002, the memory 1002 stores program code that implements the method provided in the embodiments of this application.

[0242] For more details on how processor 1001 implements the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here.

[0243] In some embodiments, a computer-readable storage medium is also provided, which stores computer instructions. When the computer instructions stored in the computer-readable storage medium are executed by an optical communication device, the optical communication device performs the configuration method or authentication method of the optical communication device provided in the above method embodiments.

[0244] In some embodiments, a computer program product is also provided, the computer program product including one or more computer program instructions, which, when loaded and run by a computer, cause the computer to execute the configuration method or authentication method of the optical communication device provided in the above method embodiments.

[0245] In some embodiments, a chip is also provided, including a memory and a processor. The memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to perform the configuration method or authentication method of the optical communication device provided in the above method embodiments.

[0246] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, and do not exclude other elements or objects.

[0247] The above is merely one embodiment of this application and is not intended to limit this application. The scope of protection of this application shall be determined by the scope of the claims.

Claims

1. An authentication method for an optical communication device, characterized in that, The method includes: The first optical communication device sends a serial number request message to multiple second optical communication devices; The first optical communication device receives a sequence number response message sent by the second optical communication device, the sequence number response message carrying random delay parameters generated by the second optical communication device and the sequence number of the second optical communication device; The first optical communication device authenticates the second optical communication device based on the serial number and the random delay parameter; After successful authentication, the first optical communication device sends a key generation message to the second optical communication device. The key generation message carries key parameters, which are used by the second optical communication device to generate a new key. The new key is used to encrypt or decrypt data transmitted between the first optical communication device and the second optical communication device. The key parameters include one or more random numbers generated by the first optical communication device. The first optical communication device receives a new key reporting message sent by the second optical communication device, the key reporting message carrying the new key generated by the second optical communication device; The first optical communication device sends a key confirmation message to the second optical communication device, the key confirmation message carrying the index of the new key; The first optical communication device receives the current key reporting message sent by the second optical communication device, and the first optical communication device enters the key activation state.

2. The method according to claim 1, characterized in that, When the first optical communication device sends a key generation message to the second optical communication device, it starts a first key waiting timer; When the first key waiting timer expires and no new key reporting message is received from the second optical communication device, the first optical communication device sends a new key generation message to the second optical communication device.

3. The method according to claim 1, characterized in that, Also includes: When the first optical communication device receives the new key reporting message, it transitions from the key request state to the key confirmation state.

4. The method according to claim 1, characterized in that, When the first optical communication device sends a key confirmation message to the second optical communication device, it starts a second key waiting timer. When the second key waiting timer expires and the first optical communication device does not receive the current key reporting message sent by the second optical communication device, the first optical communication device sends a new key confirmation message to the second optical communication device.

5. The method according to claim 1, characterized in that, The first optical communication device sends a serial number request message to the plurality of second optical communication devices, including: sending the serial number request message to the plurality of second optical communication devices within a silent window, wherein the length of the silent window is less than or equal to 250 μs.

6. The method according to claim 1, characterized in that, Before the first optical communication device sends a serial number request message to the plurality of second optical communication devices, the following is also included: The first optical communication device sends a broadcast message to the plurality of second optical communication devices, the broadcast message carrying configuration information.

7. The method according to claim 6, characterized in that, The broadcast message is a Physical Layer Operation Management and Maintenance (PLOAM) message, and the PLOAM message includes fields for carrying the configuration information. Alternatively, the broadcast message may be a Gigabit Passive Optical Network (GTC) transmission aggregated GTC frame or an Ethernet message.

8. The method according to claim 7, characterized in that, The PLOAM message is an extended burst length message, an upstream_overhead configuration message, or an extended optical network unit (ONU) configuration message.

9. An authentication method for an optical communication device, characterized in that, The method includes: The second optical communication device receives a sequence number request message sent by the first optical communication device; In response to the sequence number request message, the second optical communication device generates random delay parameters; The second optical communication device sends a sequence number response message to the first optical communication device according to the random delay parameter. The sequence number response message carries the random delay parameter and the sequence number of the second optical communication device. The second optical communication device receives a key generation message sent by the first optical communication device. The key generation message carries key parameters, which are used to generate a new key. The key parameters include one or more random numbers generated by the first optical communication device. The second optical communication device generates a new key based on the key parameters in the key generation message; The second optical communication device sends a new key reporting message to the first optical communication device. The key reporting message carries the new key generated by the second optical communication device. The new key is used to encrypt or decrypt the data transmitted between the first optical communication device and the second optical communication device. The second optical communication device receives a key confirmation message sent by the first optical communication device, the key confirmation message carrying the index of the new key; The second optical communication device sends a current key reporting message to the first optical communication device, and the second optical communication device enters the key activation state.

10. The method according to claim 9, characterized in that, When the second optical communication device sends the new key reporting message to the first optical communication device, it starts a third key waiting timer; When the third key waiting timer expires and the second optical communication device does not receive a key confirmation message from the first optical communication device, the second optical communication device sends the new key reporting message to the first optical communication device again.

11. The method according to claim 10, characterized in that, Also includes: The second optical communication device receives the key confirmation message sent by the first optical communication device and enters the key confirmation state.

12. The method according to claim 9, characterized in that, The second optical communication device generates a new key based on the key parameters in the key generation message, including: The second optical communication device generates a new key based on the random number in the key generation message.

13. The method according to claim 9, characterized in that, The new key carried in the new key reporting message is encrypted using a shared key between the second optical communication device and the first optical communication device.

14. An optical communication device, characterized in that, The optical communication device includes a processor and a memory, the memory being used to store software programs, and the processor, by running or executing the software programs stored in the memory, causes the optical communication device to implement the method as described in any one of claims 1 to 8, or to implement the method as described in any one of claims 9 to 13.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code executed by a processor, the program code including instructions for implementing the method as claimed in any one of claims 1 to 8, or instructions for implementing the method as claimed in any one of claims 9 to 13.

Images