Authentication method for link protection in Ethernet Passive Optical Network

• US 20060129814A1
• Filed: 04/29/2005
• Published: 06/15/2006
• Est. Priority Date: 12/10/2004
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Eun, Jee Sook, Kwon, Yool, Yoo, Tae Whan, Han, Kyeong soo
• Granted Patent: US 7,730,305 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04Q 11/0067 Provisions for optical access or distribution networks, e.g. Gigabit Ethernet Passive Optical Network (GE-PON), ATM-based Passive Optical Network (A-PON), PON-Ring
• CPC Class Codes: H04Q 2011/0088 Signalling aspects

Abstract

An authentication method for link protection between an OLT and an ONU newly connected thereto in an EPON, which is implemented in a data link layer to which cryptography is applied. First, an authentication key is distributed to both the OLT and an ONU. The OLT (or ONU) generates first and second random values, generates an authentication request frame containing the random values, and transmits it to the ONU (or OLT). The ONU generates a first hash value according to a hash function using the random values contained in the request frame, and transmits an authentication response frame containing the first hash value to the OLT. The OLT compares the first hash value with a second hash value calculated by it according to the has function using the two random values and an authentication key distributed to it, and transmits an authentication result frame to the ONU.

Claims

1. An authentication method for link protection in an Ethernet Passive Optical Network (EPON) including an Optical Line Terminal (OLT) connected to other network systems and a plurality of Optical Network Units (ONUs) located at a subscriber side of the EPON, the method comprising steps of:

distributing an authentication key to both the OLT and an ONU in the EPON;

generating first and second random values in one of the OLT and the ONU, generating an authentication request frame containing the first and second random values in the one of the OLT and the ONU, and transmitting the authentication request frame from the one of the ONU and OLT to the other thereof;

generating a first hash value according to a predetermined function using the first and second random values contained in the authentication request frame in the other of the ONU and OLT, and transmitting an authentication response frame containing the first hash value from the other of the ONU and OLT to the one thereof; and

comparing, in the one of the OLT and the ONU, the first hash value contained in the authentication response frame with a second hash value calculated by the one of the OLT and the ONU according to the predetermined function using the first and second random values and an authentication key distributed to the one of the OLT and the ONU, and transmitting an authentication confirmation frame containing an authentication result value indicating a result of the comparison from the one of the OLT and the ONU to the other thereof.

2. The authentication method according to claim 1, wherein the authentication key is generated from a Pairwise Master Key (PMK) according to a key management protocol, the PMK being generated from a master key, the master key being distributed to both the OLT and the ONU when the EPON is established.

3. The authentication method according to claim 1, wherein if cryptography is not used for transmission between the OLT and the ONU, the master key distributed to both the ONU and the OLT when the EPON is established is used as the authentication key.

4. The authentication method according to claim 1, wherein each of the first and second hash values is generated by a Pseudo Random Function (PRF) “

Y=PRF(Nonce1∥

Nonce2∥

AK)”

, where “

Y”

denotes the hash value, “

Nonce1”

denotes the first and second random values, and “

AK”

denotes the authentication key.

5. The authentication method according to claim 1, wherein each of the authentication request frame, the authentication response frame, and the authentication confirmation frame includes a MAC destination address field, a MAC source address field, a length/type field indicating the length and type of frame, a subtype information field, a flag field used to define information that must be confirmed in the key management protocol each time a key management frame is transmitted, a code field used to determine which one of the authentication request, response, and confirmation frames is the corresponding authentication frame, a data/pad field having a variable length up to 107 bytes and being used to define the contents of a message carried within the authentication frame, and a frame check sequence field defining a value for detecting a transmission error of the frame.

6. The authentication method according to claim 4, wherein each of the hash values includes at least 160 bits.

7. The authentication method according to claim 5, wherein values of the fields of an authentication frame are set according to rules of a slow protocol.

8. The authentication method according to claim 5, wherein the flag field contains local set-done information indicating the information of an encryption module at a transmitting side, and contains remote set-done information indicating the information of an encryption module at a receiving side.

9. The authentication method according to claim 5, wherein the code field has fourth to sixth code values indicating the authentication request frame, the authentication response frame, and the authentication confirmation frame, respectively.

10. The authentication method according to claim 5, wherein the data/pad field of an authentication request frame includes a key index, and first and second random values.

11. The authentication method according to claim 5, wherein the data/pad field of an authentication response frame includes a key index and a hash value.

12. The authentication method according to claim 5, wherein the data/pad field of an authentication confirmation frame includes a key index and information indicating whether or not authentication is successful.