PON Mutual Authentication Using Certificates and Shared Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current PON systems face security risks due to one-way authentication methods that expose sensitive information like serial numbers and passwords in plaintext, leading to spoofing attacks that affect user services and pose significant security threats.
Innovation Solution
Implement a two-way authentication method using shared key algorithms and certificates between the OLT and ONU, where both devices verify each other's certificates and generate a shared key for encrypted communication, without requiring additional devices or secure channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If one-way authentication methods (SN, MAC address, password) are used, then authentication can be performed, but information leakage risk increases and spoofing attacks become possible
Solution Approach 1:
The patent introduces certificates and public key infrastructure as intermediaries between OLT and ONU. Instead of directly transmitting sensitive authentication information, the system uses certificate-based authentication where OLT and ONU exchange and verify each other's certificates. This intermediary mechanism prevents direct exposure of sensitive information while maintaining authentication reliability.
Solution Approach 2:
The patent replaces traditional mechanical authentication methods (transmitting passwords and serial numbers in plaintext) with cryptographic mechanisms. By substituting the mechanical system of direct information transmission with cryptographic certificate verification and public key exchange, the system eliminates information leakage risks while maintaining authentication functionality.
2Reliability
If one-way authentication is implemented, then OLT can authenticate ONU, but ONU cannot authenticate OLT leading to spoofing vulnerability
Solution Approach 1:
The patent implements asymmetric authentication where OLT and ONU have different but complementary authentication capabilities. OLT possesses ONU's certificate for authenticating ONU, while ONU possesses OLT's certificate for authenticating OLT. This asymmetric design ensures both parties can verify each other's identity, preventing spoofing attacks while maintaining system reliability.
Solution Approach 2:
The patent establishes a feedback mechanism in the authentication process where OLT sends authentication requests to ONU, ONU responds with its certificate, OLT verifies it, and then ONU verifies OLT's certificate in return. This bidirectional feedback loop ensures both parties are authenticated before establishing communication, eliminating spoofing vulnerabilities.
3Reliability
If two-way authentication with certificate verification is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent leverages the universality of certificate-based authentication mechanisms that are already widely implemented in modern communication systems. By using standardized public key infrastructure and certificate verification processes, the system achieves enhanced security without significantly increasing complexity, as these mechanisms can be integrated into existing device architectures.
Solution Approach 2:
The patent performs certificate verification and shared key generation as preliminary actions before actual data communication begins. By completing the complex authentication and key exchange processes in advance, the system establishes secure communication channels without adding complexity to the ongoing data transmission operations. The authentication overhead is confined to the initial connection phase.
Data Source
AI summary
The present disclosure provides methods for secure communication. In an example method, an optical line terminal (OLT) sends a first message to an optical network unit (ONU), where the first message includes a first key algorithm, a certificate of the OLT, and a public key of the OLT, and the first key algorithm is a key algorithm supported by both the OLT and the ONU. The ONU verifies the certificate of the OLT, and after the verification succeeds, the ONU determines a shared key based on the first key algorithm and the public key of the OLT. The ONU sends a second message to the OLT, where the second message includes a certificate of the ONU and a public key of the ONU. The OLT verifies the certificate of the ONU. After the verification succeeds, the OLT determines the shared key based on the first key algorithm and the public key of the ONU.