WO2017092465A1 - 广播报文加密方法、olt、onu及计算机存储介质 - Google Patents

广播报文加密方法、olt、onu及计算机存储介质 Download PDF

Info

Publication number
WO2017092465A1
WO2017092465A1 PCT/CN2016/098281 CN2016098281W WO2017092465A1 WO 2017092465 A1 WO2017092465 A1 WO 2017092465A1 CN 2016098281 W CN2016098281 W CN 2016098281W WO 2017092465 A1 WO2017092465 A1 WO 2017092465A1
Authority
WO
WIPO (PCT)
Prior art keywords
broadcast
key
message
olt
encryption
Prior art date
Application number
PCT/CN2016/098281
Other languages
English (en)
French (fr)
Inventor
张剑英
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2017092465A1 publication Critical patent/WO2017092465A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0631—Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution
    • H04L2209/601—Broadcast encryption

Definitions

  • the present invention relates to the field of optical communications, and in particular, to a broadcast message encryption method, an OLT, an ONU, and a computer storage medium.
  • an Ethernet Passive Optical Network includes an Optical Line Terminal (OLT), an Optical Distribution Network (ODN), and an Optical Network Unit. (Optical Network Unit, ONU for short).
  • OLT Optical Line Terminal
  • ODN Optical Distribution Network
  • ONU Optical Network Unit
  • the optical signal transmission between the OLT and the ONU is possible; and the transmission channel from the OLT to the ONU is called the downlink channel, and the transmitted data is the downlink data.
  • the ODN is used in the OLT and the ONU. Provide light channels between.
  • an optical line terminal can be connected to a plurality of optical network units through a splitter. If the downlink data transmitted by the OLT to the ONU is not encrypted, the ONU may overhear other ONU information. In order to avoid this situation, the downlink data must be encrypted to prevent leakage of information between the ONUs.
  • the embodiments of the present invention are expected to provide a broadcast message encryption method, an OLT, an ONU, and a computer storage medium, which can at least partially solve the problem of information leakage.
  • a first aspect of the embodiments of the present invention provides a method for encrypting a broadcast message, where the method includes:
  • the optical line terminal OLT determines the designated broadcast message to be encrypted
  • the method further includes:
  • the OLT negotiates an encryption key with the ONU to determine an encryption key and a key index
  • the key index is used by the ONU to determine the encryption key.
  • the OLT negotiates an encryption key with the ONU to determine an encryption key and a key index, including:
  • the OLT negotiates an encryption key with the ONU to determine an encryption key and a key index, and further includes:
  • the key request message is resent.
  • the optical line terminal OLT determines the specified broadcast message to be encrypted, including:
  • the method further includes:
  • the specified broadcast message is encrypted to form a broadcast encrypted message.
  • a second aspect of the embodiments of the present invention provides a method for encrypting a broadcast message, where the method includes:
  • the ONU negotiates an encryption key with the OLT to determine an encryption key and a key index
  • the encryption key and the key index are used by the OLT to encrypt a broadcast message and the ONU decrypt the broadcast encrypted message formed by the OLT encryption.
  • the method further includes:
  • a third aspect of the embodiments of the present invention provides an optical line terminal OLT, where the OLT includes:
  • a first determining unit configured to determine a specified broadcast message to be encrypted
  • Forming a unit configured to encrypt the specified broadcast packet to form a broadcast encrypted packet
  • the first sending unit is configured to send the broadcast encrypted message to the optical network unit ONU.
  • the OLT further includes:
  • the first negotiation unit is configured to negotiate an encryption key between the OLT and the ONU, and determine an encryption key and a key index;
  • the forming unit is configured to encrypt the to-be-encrypted portion of the specified broadcast message by using the encryption key, and carry the key index in a plaintext portion of the specified broadcast message to form the broadcast Encrypted message;
  • the key index is used by the ONU to determine the encryption key.
  • the first sending unit is further configured to send a key request message to the ONU that receives the broadcast encrypted message; after the key request message is sent, start the first timing;
  • the OLT further includes:
  • the first receiving unit is configured to receive, according to the timing of the first timing, a response message that is returned by the ONU based on the key request message;
  • the first negotiating unit is configured to extract the encryption key from the response message.
  • the first sending unit is further configured to resend the key request message if the response message has not been received or the encryption key is not extracted after the first timing timeout.
  • the first determining unit is configured to parse the preamble and the opcode opcode field of the packet to obtain parsing information; and determine, according to the parsing information, whether the packet is a specified packet to be encrypted.
  • the OLT further includes:
  • a detecting unit configured to detect a broadcast encryption enable switch
  • the forming unit is configured to encrypt the specified broadcast message to form a broadcast encrypted message if the broadcast encryption enable switch is enabled.
  • a fourth aspect of the embodiments of the present invention provides an optical network unit ONU, where the ONU includes:
  • a second negotiating unit configured to negotiate an encryption key with the OLT, and determine an encryption key and a key index
  • a storage unit configured to store the encryption key and a key index
  • the encryption key and the key index are used by the OLT to encrypt a broadcast message and the ONU decrypt the broadcast encrypted message formed by the OLT encryption.
  • the ONU further includes:
  • a second receiving unit configured to receive the broadcast encrypted message sent by the OLT
  • a parsing unit configured to parse the plaintext portion of the broadcast encrypted packet to determine a key index
  • a query unit configured to query an encryption key according to the key index
  • a decryption unit configured to decrypt the ciphertext portion of the broadcast encrypted message based on the encryption key.
  • the embodiment of the invention further discloses a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute at least one of the broadcast message encryption methods.
  • the broadcast message encryption method, the OLT, the ONU, and the computer storage medium provided by the embodiment of the present invention determine the specified broadcast message to be encrypted, and then encrypt the broadcast message to form a broadcast encrypted message, and the OLT sends the broadcast to the ONU.
  • the message is encrypted, which reduces the theft and information leakage caused by the plaintext transmission during the transmission of the broadcast message. By encrypting the broadcast message, the difficulty of information leakage is increased, and the information security is improved.
  • FIG. 1 is a schematic structural view of an EPON system
  • FIG. 2 is a schematic flowchart of a method for encrypting a first broadcast packet according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for encrypting a second broadcast packet according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a third method for encrypting a broadcast packet according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a method for encrypting a fourth broadcast packet according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of an OLT according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of an ONU according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a part of a packet according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic flowchart of AES encryption according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of comparison of data frames before and after encryption using triple-stirring according to an embodiment of the present invention.
  • FIG. 11 is a flowchart showing an encryption key negotiation process in a triple agitation encryption process according to an embodiment of the present invention. intention.
  • the present embodiment provides a method for encrypting a broadcast message, encrypting a specified broadcast message to be encrypted, and improving information security.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • this embodiment provides a method for encrypting a broadcast message, where the method includes:
  • Step S110 The optical line terminal OLT determines a designated broadcast message to be encrypted.
  • Step S120 Encrypt the specified broadcast packet to form a broadcast encrypted packet.
  • Step S130 Send the broadcast encrypted message to the optical network unit ONU.
  • the OLT before the OLT sends the downlink data, if the downlink data sent is a broadcast packet, it is determined whether it is a specified broadcast packet that needs to be encrypted.
  • the specified broadcast message here can be a broadcast message of a specified type. Specifically, the broadcast message may be classified into a registered broadcast message and a non-registered broadcast message; and the specified broadcast message may be a non-registered broadcast message.
  • the OLT receives an indication instruction, which is to encrypt a certain broadcast message, and the broadcast message specified to be encrypted is the designated broadcast message.
  • the body part of the broadcast message may be parsed, and the corresponding broadcast message is determined to be the specified broadcast message according to the security requirement of the content of the body part.
  • step S120 the specified broadcast message is encrypted to form a broadcast encrypted message.
  • the content of the broadcast message cannot be obtained or the broadcast message is stolen without the key.
  • the difficulty of the content increases.
  • Broadcasting the message in step S120 Encryption can include all encryption or partial encryption.
  • the partial encryption here may be only encrypting part of the content of the broadcast message, for example, not encrypting the header of the broadcast message, but only encrypting the body of the broadcast message.
  • the all encryption is to encrypt the entire broadcast message.
  • the broadcast encrypted packet formed by the encryption is sent to the ONU, and the transmission can be sent to the ONU through the ODN.
  • the broadcast packet encryption method in this embodiment not only improves the security of information transmission between the OLT and the ONU, but also reduces information leakage, and has the characteristics of being simple and convenient to implement.
  • the method further includes:
  • Step S101 The OLT negotiates an encryption key with the ONU to determine an encryption key and a key index.
  • the step S120 may include: encrypting, by using the encryption key, the to-be-encrypted part of the specified broadcast message, and carrying the key index in a plaintext part of the specified broadcast message to form the broadcast. Encrypting a message; wherein the key index is used by the ONU to determine the encryption key.
  • the OLT performs an encryption key negotiation with the ONU that needs to receive the broadcast message.
  • the OLT and the corresponding ONU determine the encryption key, so that the subsequent ONU can decrypt the broadcast encrypted message.
  • an cryptographic key may be determined by the OLT and sent to the ONU, or the ONU may determine an encryption key and send it to the OLT.
  • the encryption key is generally determined by the ONU and sent to the OLT through the uplink optical channel.
  • a key index is further determined. After the ONU receives the broadcast encrypted message, the ONU extracts the plaintext portion of the broadcast encrypted message to determine the encryption key.
  • the key index here may also be determined by the ONU, or may be determined by the OLT. In this embodiment, it is preferable that the key index is determined by a party forming the encryption key.
  • the plaintext part of the key index in the embodiment may be included in the packet header in the packet.
  • Preamble the key index may be represented by a portion of the 5th byte of the preamble; specifically, the last 2 bits of the 5th byte are used to represent the key index.
  • the OLT performs the negotiation of the encryption key with the ONU in advance, thereby determining the encryption key and the key index, so as to facilitate the decryption of the subsequent broadcast encrypted message.
  • the OLT and the ONU may set multiple encryption keys in advance, and only need to negotiate the key index corresponding to the encryption key when performing negotiation.
  • the encryption key is dynamically generated for one end of the OLT and the ONU, and is not selected from a plurality of preset keys.
  • step S101 may include:
  • the key request message may correspond to a key request frame, for example, the OLT sends a key request frame to the ONU that receives the corresponding broadcast message, and the ONU receives the key request frame. A key notification frame carrying the encryption key is then restored as the response message. In this way, the OLT can extract an encryption key for encrypting the broadcast message from the response message.
  • the response message further includes a key index, where the key index may be a serial number of the key or the like.
  • the OLT after the OLT sends the key request message, it starts a timer to count or starts a counter to count, and if the OLT receives the response message within the first time, indicating The negotiation is successful; this limits the invalidity of the key negotiation, and avoids the security problem of the encryption key caused by neglecting the timeliness in the key negotiation process.
  • the step S101 further includes: if the first timing timeout has not received the response message or the encryption key is not extracted, and the response message has not been received, resending the key Request message. If the current OLT has data to be sent, in the embodiment, the OLT may resend the key request message when the first timing expires or the encryption key is not extracted, so as to re-key negotiation to ensure broadcast. The normal transmission of the message.
  • the current ONU may be faulty. Even if the key request message is continued to be sent, the OLT load is too large.
  • the specified number of times may be specified in this embodiment. If the number of times exceeds the specified number of times, the key request message is stopped or the key negotiation request message is sent after the specified length of time is stopped, or the prompt information such as the key negotiation failure is output.
  • the step S110 may include:
  • Step S111 Parsing a preamble of the message and an opcode field of the operation code to obtain parsing information
  • Step S112 Determine, according to the parsing information, whether the packet is a specified packet to be encrypted.
  • the step S111 may include: parsing a preamble of the broadcast message, extracting a mode bit and a logical link identifier in the preamble; and determining, according to the mode bit and/or the logical link identifier, whether the packet is Broadcast message.
  • the packets can be classified into broadcast packets, unicast packets, and multicast packets.
  • the message can be further divided into a packet header and a body part, and the message includes a preamble, a destination address (DA), a source address (Source) address, and a type field.
  • Two logical link identification (LLID) fields are included in the preamble.
  • each LLID includes 8 bits; thus, the two LLID fields have a total of 16 bits, the most significant bits of the 16 bits are the mode bits, and the last 15 bits are the logical link identifiers used to record the broadcast message. In the normal case, if the mode bit is 1, it indicates that the message is a broadcast message. If the last 15 bits are all 1, the message is a broadcast message.
  • Step S112 is to parse the content in the opcode field to determine whether the broadcast packet is A registration message that cannot be encrypted. For example, when the content of the opcode field is 02, 04, 05, and 06, the broadcast message is usually a registration message, where 02, 04, 05, and 06 are hexadecimal numbers. Therefore, if the content of the opcode field is not hexadecimal 02, 04, 05, and 06 in step S112, the broadcast message can be used as the specified broadcast message to be encrypted.
  • broadcast packets are not encrypted. In some special scenarios, such as performing broadcast packet transmission and reception tests on certain ONUs, it may only be necessary to send broadcast packets to specific broadcasts. ONU.
  • the method further includes: detecting a broadcast encryption enable switch in the embodiment; the step S120 includes: if the broadcast encryption enable switch is in the If the status is enabled, the specified broadcast packet is encrypted to form a broadcast encrypted packet.
  • an encryption enable switch can be configured for the OLT in advance. If the broadcast packet to be encrypted needs to be sent, the broadcast encryption enable switch is enabled, and the OLT is triggered. The above steps S110 to S130 are performed.
  • the default state of the broadcast encryption enable switch is a non-enabled state. In the non-enabled state, the OLT does not perform encryption processing on the broadcast message.
  • the first type: Advanced Encryption Standard (AES) encryption is performed on the specified packet.
  • AES encryption is an encryption method based on the block encryption standard.
  • the encrypted portion of the specified broadcast message that needs to be encrypted may be divided into a plurality of blocks, for example, the continuously distributed 128-bit data in the encrypted portion. Divided into one block, each block is encrypted using an encryption key of length 128 bits.
  • the specified broadcast message is agitated and encrypted using the agitation key, for example, the specified broadcast message is triple-aguttered and encrypted using the agitation key.
  • Stirring encryption is to use the agitation key to scramble the content that needs to be encrypted, so that the information after the agitation is encrypted is out of order, so that there is no agitation. Even if the key's ONU steals the message, it will consider it a meaningless garbled message.
  • triple-stirring may be used to perform at least three times of agitation encryption on the specified broadcast message.
  • the embodiment provides a method for encrypting broadcast packets, which can encrypt some broadcast packets that need to be encrypted, improve information security of broadcast packets, and reduce information leakage.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • this embodiment provides a method for encrypting a broadcast message, where the method includes:
  • Step S210 The ONU negotiates an encryption key with the OLT to determine an encryption key and a key index.
  • Step S220 storing the encryption key and a key index
  • the encryption key and the key index are used by the OLT to encrypt a broadcast message and the ONU decrypt the broadcast encrypted message formed by the OLT encryption.
  • the broadcast packet encryption method in this embodiment is applied to the ONU.
  • the OLN negotiates with the OLT for the encryption key of the broadcast packet encryption to determine the encryption key and the key index.
  • the encryption key and the key index are stored in step S220, so that when the broadcast encrypted message is received subsequently, the encryption key can be found by using the key index, and the encryption key is used to decrypt the The broadcast encrypted message; this can reduce the phenomenon that broadcast messages are stolen by other unrelated ONUs.
  • step S220 in this embodiment may occur before the step S210.
  • the ONU pre-stores a plurality of encryption keys and a key index corresponding to the encryption key.
  • the The ONU picks a set from the pre-stored encryption key and key index as an encryption key and a key index for the current broadcast message exchange with the OLT. Therefore, the execution sequence of step S210 and step S220 in this embodiment may be as shown in FIG. 4, or may be before step S220, and step S210 is followed.
  • the method further includes:
  • Step S230 Receive a broadcast encrypted message sent by the OLT.
  • Step S240 Parsing the plaintext part of the broadcast encrypted message, and determining a key index
  • Step S250 Query an encryption key according to the key index
  • Step S260 Decrypt the ciphertext part of the broadcast encrypted message based on the encryption key.
  • the ONU receives the broadcast encrypted packet and parses the plaintext portion of the broadcast encrypted packet, where the plaintext portion may include a preamble.
  • the key index is obtained by parsing the field of the key index, and the key index is obtained, and the corresponding encryption key is searched by using the key index, and finally the step S260 is used to decode the broadcast encrypted message by using the encryption key.
  • the ciphertext part has the characteristics of easy implementation. It should be noted that if the encryption mode of the broadcast encrypted message is symmetric encryption in step S260, the encryption key is also a decryption key, and the broadcast encrypted message can be directly decoded by using the encryption key. .
  • the encryption mode of the broadcast encrypted message is asymmetric encryption
  • the encryption key corresponds to a decryption key
  • the decryption key needs to be determined according to the encryption key, and the decryption key is used to secretify the message. Broadcast encrypted messages.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • an embodiment of the present invention provides an optical line terminal OLT, where the OLT includes:
  • the first determining unit 110 is configured to determine a specified broadcast message to be encrypted.
  • the forming unit 120 is configured to encrypt the specified broadcast message to form a broadcast encrypted message.
  • the first sending unit 130 is configured to send the broadcast encrypted message to the optical network unit ONU.
  • the embodiment provides an OLT, and the OLT includes the first determining unit 110, the forming unit 120, and the first sending unit 130.
  • the first determining unit 110 and the forming unit 120 may each correspond to a processor or processing circuit in the OLT, and the processor may include a central processing unit, an application processor, a microprocessor, and a digital signal processor. Or a programmable array.
  • the processor or processing circuit implements the functions of the first determining unit 110 and the forming unit 120 by executing a designated code.
  • the first sending unit 130 corresponds to an optical sending interface of the OLT, for example, corresponding to The downlink sending interface that the OLT sends a signal to the ONU can be used to send the encrypted message to the OUN.
  • the OLT encrypts the broadcast packet that needs to be encrypted, and prevents other ONUs that do not need to receive the broadcast packet from leaking the information content of the broadcast packet, thereby improving the security of the information.
  • the OLT further includes: a first negotiating unit configured to negotiate an encryption key with the ONU to determine an encryption key and a key index; and the forming unit 120 is configured to use the encryption key pair
  • the part to be encrypted of the specified broadcast message is encrypted, and the key index is carried in the plaintext part of the specified broadcast message to form the broadcast encrypted message; wherein the key index is used for the
  • the ONU determines the encryption key.
  • the first negotiating unit may correspond to a communication interface or a processor, and may determine the encryption key and the key index by performing operations such as multiple information interaction and information parsing extraction with OUN.
  • the encryption key can be easily negotiated by the setting of the first negotiation unit, so that the ONU can be subsequently decrypted by the ONU.
  • the first sending unit 130 is further configured to send a key request message to the ONU that receives the broadcast encrypted message; after sending the key request message, start the first timing;
  • the OLT further includes:
  • the first receiving unit is configured to receive, according to the timing of the first timing, a response message that is returned by the ONU based on the key request message;
  • the first negotiating unit is configured to extract the encryption key from the response message.
  • the first receiving unit may include a downlink receiving interface of the OLT, and is configured to receive the response message from the ONU.
  • the first timing is also set to avoid various information security problems caused by excessive negotiation time.
  • the information security problem herein may include that the encryption key is leaked.
  • the first sending unit 130 is further configured to time out if the first timing The key request message is resent if the response message has not been received or the encryption key has not been extracted. In this embodiment, of course, in order to ensure the smooth transmission of the broadcast message, if at least one of the above three cases occurs, the key request message will be resent. In a specific implementation, the first sending unit 130 sends the key request message to the same ONU until the specified number of times is reached, or stops after a period of time, or sends a negotiation failure warning to the upper device. Information, etc.
  • the first determining unit 110 is configured to parse a preamble of the message and an opcode field to obtain parsing information; and determine, according to the parsing information, whether the packet is a specified packet to be encrypted.
  • the preamble includes information such as the mode bit and the logical link identifier mentioned in the foregoing embodiment, and the preamble can be used to determine whether the packet that needs to be sent is a broadcast packet, and the content of the opcode field can be determined according to the content of the opcode field.
  • Whether the specified broadcast message to be encrypted has the characteristics of simple structure and simple implementation.
  • the OLT further includes:
  • a detecting unit configured to detect a broadcast encryption enable switch
  • the forming unit 120 is configured to encrypt the specified broadcast message to form a broadcast encrypted message if the broadcast encryption enable switch is in an enabled state.
  • the detecting unit may correspond to a processor or a processing circuit, and may detect whether a field indicating the broadcast encryption enable in the OLT is set to a specified value corresponding to the enabled state.
  • the state of the broadcast encryption enable switch is determined.
  • the detection of the state of the broadcast encryption enable switch by the detection unit can be well compatible with the prior art by the setting of the detection unit. In the default state, the broadcast encryption enable switch is normally disabled. Avoid affecting the transmission of most broadcast messages that do not require encryption.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • the embodiment provides an optical network unit ONU, where the ONU includes:
  • the second negotiating unit 210 is configured to negotiate an encryption key with the OLT, and determine an encryption key and a key index.
  • the storage unit 220 is configured to store the encryption key and a key index
  • the encryption key and the key index are used by the OLT to encrypt a broadcast message and the ONU decrypt the broadcast encrypted message formed by the OLT encryption.
  • the second negotiating unit 210 in this embodiment may correspond to an optical communication interface, a processor, a processing circuit, or the like in the ONU, and perform information interaction with the OLT by using an optical communication interface, and determine a key index and a key through information interaction. index. For example, at least one of the determined encryption key and the key index is transmitted to the OLT using the optical communication interface.
  • the ONU further includes a storage unit 220 that can correspond to various storage media in the ONU, and can be used to store the encryption key and a key index.
  • the ONU can assist the OLT in determining the encryption key through the negotiation with the OLT, so that the OLT can encrypt the broadcast message to be encrypted by the OLT to improve the information security of the broadcast message.
  • the ONU further includes:
  • a second receiving unit configured to receive the broadcast encrypted message sent by the OLT
  • a parsing unit configured to parse the plaintext portion of the broadcast encrypted packet to determine a key index
  • a query unit configured to query an encryption key according to the key index
  • a decryption unit configured to decrypt the ciphertext portion of the broadcast encrypted message based on the encryption key.
  • the second receiving unit in this embodiment may correspond to an optical communication interface capable of optical communication with the OLT, and is capable of receiving information, such as the broadcast encrypted message, from the OLT.
  • the broadcast encrypted message may include a plaintext part and a ciphertext part; in the embodiment of the present invention, information requiring confidentiality is located in the ciphertext part.
  • the plaintext portion may include information such as a preamble of the message.
  • the key index is also located in the plaintext portion. Therefore, in this embodiment, the parsing unit will be the plaintext department.
  • the decryption is performed to obtain the key index, and the encryption key is determined according to the key index, thereby decrypting the encrypted portion of the broadcast encrypted message based on the encryption key, thereby obtaining the packet of the decrypted original broadcast message.
  • the content realizes the encrypted interaction of broadcast messages, which can prevent information leakage and improve the security of information.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute any one or more of the foregoing broadcast message encryption methods, for example, 2.
  • the computer storage medium in this embodiment may be a computer storage medium such as an optical disk, a hard disk, a magnetic disk, a magnetic tape, a flash disk, or the like, and may be a non-transitory storage medium.
  • the present example provides a broadcast message encryption system, which can be applied to systems in an OLT and an ONU, including: a broadcast service packet authentication unit, an interaction unit, a preamble modification unit, an AES encryption unit, and a triple agitation encryption unit.
  • performing broadcast message encryption includes the following steps:
  • the first step using the broadcast service packet authentication unit to complete the identification of the broadcast packet.
  • the content of the logical link identifier and the mode bit can be used to determine whether the corresponding packet is a broadcast message. Generally, if the mode bit value is 1, it indicates that the message is a broadcast message; or, when each bit of the logical link identifier is 1, it indicates that the message is a broadcast message.
  • 8 is a partial schematic diagram of a message including a preamble, a destination address DA field, a source address SA field, a length/type field, an OP-code field, and the like; and a data area and the like are not shown in FIG. 8.
  • the preamble includes a reserved field 1, a reserved field 2, a Start of Packet Delimiter (SPD) field, an LLID of two bytes in length, and a check CRC field.
  • SPD Start of Packet Delimiter
  • Step 2 Use the interactive unit to determine whether to perform various encryptions such as encryption and encryption. parameter.
  • the step may specifically include: determining whether to apply for an encryption key according to a pre-configured broadcast encryption enable switch whenever a new broadcast data packet header is received.
  • the broadcast message key index is configured with a direct register. If the broadcast encryption switch is enabled, the key index of the direct register configuration is directly queried, and whether the encryption and encryption modes are required is determined according to the key index.
  • the encryption methods in this example may include AES encryption and triple-agitation encryption.
  • the third step the preamble modification unit determines whether to modify the preamble (preamble modification unit) according to the processing of the previous key interaction unit. After applying for the encryption key, the broadcast encryption enables the state of the switch to remain valid. Then, the lower 2 bits of the 5th byte in the preamble are changed to 1 and the key index, and the modified preamble is checked to generate a check value. For example, a loop check is performed on the modified preamble to generate a loop check value.
  • Step 4 Encrypt according to the encryption and encryption methods in the second step.
  • the encryption method may include AES encryption and triple agitation encryption. The following describes the specific implementation of AES encryption and triple agitation encryption.
  • the data to be encrypted is divided into a plurality of data blocks, each of which includes 128 bits. As shown in FIG. 9, the data block formed by the division is used as an input block, and is used as an input of the encryption logic together with the encryption key. After AES encryption, the encrypted output block is formed. Typically, the output block includes the same number of bits as the input block. Next, the output block is XORed with the last 16 bytes of the corresponding plaintext block to obtain the ciphertext that has been AES encrypted.
  • the AES encryption unit is further configured to finally determine an encryption key; specifically, the method may include:
  • the OLT issues a KEY_ASSIGN message.
  • the KEY_ASSIGN message includes an initial value of the 16-bit encrypted input value, a first key activation time, and a 128-bit initial key.
  • the KEY_ASSIGN message here corresponds to the key request message in the foregoing embodiment.
  • the receiving ONU sends a KEY_RESPONSE message.
  • the KEY_RESPONSE contains a 128-bit updated key and a second key activation time.
  • the KEY_RESPONSE message here corresponds to the response message in the previous embodiment.
  • the first key activation time is a timestamp of the OLT sending the KEY_ASSIGN message
  • the second key activation time is a timestamp of sending the KEY_RESPONSE message. According to the two timestamps, the transmission delay can be determined, if the transmission delay is greater than the predetermined time. Delay, in this case, the negotiation can be considered to have failed.
  • the 128 initial key sent by the OLT can be used as an initial value of the updated key formed by the ONU.
  • the 128 initial key and the 128 updated key may also have no relationship at all.
  • the updated key is the encryption key used to encrypt the specified broadcast message in the foregoing embodiment.
  • Step 6 The triple-stirring encryption unit is used for triple-stirring encryption.
  • the OLT proposes a key update request, and the ONU provides a 3-byte agitation key, and the OLT uses the agitation key to complete the agitation encryption.
  • the agitation encryption is enabled, all data frames and OAM frames of the unregistered broadcast message are agitated.
  • the unregistered broadcast message corresponds to the aforementioned specified broadcast message.
  • the agitation key is the result of the addition or addition of 3-byte data and 3-byte random number extracted by the ONU from the uplink user data.
  • the fifth byte in the preamble is used as the identification field of the agitation key index to implement key synchronization.
  • the format in which the broadcast data frame is agitated before encryption and the format after the encryption is encrypted are shown in FIG.
  • the data frame before the agitation encryption shown in FIG. 10 includes a preamble and other data in the form of a plaintext.
  • the mode bit and the logical link identifier are stored in the field, and two reserved fields 1 and reserved words each having a length of 2 bytes are stored.
  • Paragraph 2 In the agitated encrypted data frame, an encrypted index is added to the last byte of the reserved field 2 of the sign-in code. And in agitating the encrypted data, the data agitation agitation zone is agitated and encrypted using the agitation key.
  • the data agitation area shown in FIG. 10 may include a destination address DA field, a source address SA field, a length/type field, and a data area and an FCS field.
  • the FCS is an abbreviation of Frame Check Sequence, which is a check field; the data can be verified by using a cyclic check code that saves the data frame.
  • the verification data stored in the FCS can be used to verify the data stored in the data area.
  • the check code stored in the preamble cyclic check code CRC field can be used to verify the data stored in the preamble.
  • the key update is implemented by a new key request frame (new_key_request) and a key notification frame (new_churning_key).
  • the OLT sends a new key request frame including the new key request to the ONU, the request frame containing the sequence number of the key currently being used for downlink encryption.
  • the new key request frame here is equivalent to the key request message in the foregoing embodiment.
  • the ONU After receiving the new key request frame, the ONU generates a new agitation key, and the serial number of the agitation key may be a binary sequence number, which may be a binary of the lowest bit of the In-use_Key_Index byte in the received new key request frame. Complement code.
  • the ONU sends a new key notification frame to the OLT, and the new key notification frame includes a new key index field and a new agitation key field.
  • the new key index field includes a key index with a data length of 1 byte
  • the new agitation key field includes a churn key with a data length of 3 bytes.
  • the lowest bit value of the new key sequence index field (New_Key_Index) is a new key index, and the remaining bit values can be set to a specified value, where the specified value can be 0 or 1.
  • the new key notification frame herein may correspond to the response message returned based on the key request message in the foregoing embodiment.
  • the OLT After the OLT receives the new key notification frame, it can use the new agitation key to agitate the subsequent frames. Key synchronization relies on the second byte in reserved field 2 in each frame. As long as the ONU receives the agitation frame sent by the OLT, the key index Key_Index can be the new key. The key number in the notification frame, the ONU uses the new key to de-agile.
  • the second byte of the reserved field 2 may be provided with a Flag and an encrypted index; the Flag may include 1 bit, indicating whether the current message is encrypted, for example, when the content of the bit is 0, it is not encrypted. This bit is 1 for encryption.
  • the index information such as the key label of the encryption key indicated by the bit corresponding to the encryption index.
  • the OLT has a timer key_update_timer for controlling the key update period. When the timer expires, the OLT initiates the above key update process.
  • the OLT uses another timer, Churning_Timer, as a mechanism to initiate the next key update request if a key update frame cannot be obtained, to increase the reliability of the key update.
  • the timer Churning_Timer here is equivalent to the timer for counting the first timing in the foregoing embodiment.
  • the timer Churning_Timer is started each time the OLT issues a new key request frame.
  • the OLT receives the correct new key notification frame sent by the ONU before the Churning_Timer times out, the OLT enables the new key as the agitation key for agitation encryption and resets the Churning_Timer.
  • the OLT When the OLT still does not receive the new key notification frame after the timer Churning_Timer expires, the key interaction is considered to be failed, the Churning_Timer is reset; and the OLT sends a new round of new key request frame.
  • the ONU still uses the original key before the new key is successfully exchanged, and the information about the key interaction failure is reported to the network administrator by the OLT. If the OLT fails to receive the key update frame before the Churning_Timer timeout after sending the new key request frame three times in a row, the OLT shall alert the network administrator. Downstream traffic is still agitated with the old key.
  • the values of the key update period T key and the timer Chrning_Timer can be configured. The default value of T key is 10s. Key update and synchronization process.
  • FIG. 11 is a schematic flowchart of agitation key interaction between an OLT and an ONU, including:
  • the OLT sends a new key request to the ONU within a key update period T key time.
  • the ONU After receiving the new key request, the ONU returns the agitation key 0 to the OLT.
  • the OLT receives the agitation key 0.
  • the OLT uses the agitation key 0 for agitation encryption.
  • the ONU After receiving the broadcast encrypted message, the ONU will use the agitation key 0 to de-agile the encryption.
  • the OLT sends a new key request within the next T key time.
  • the OLT ONU After receiving the new key request, the OLT ONU returns the agitation key 1 to the OLT.
  • the OLT uses the agitation key 1 for agitation encryption.
  • the ONU After receiving the broadcast encrypted message, the ONU will use the agitation key 1 to de-agile the encryption.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner such as: multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the coupling, or direct coupling, or communication connection of the components shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may be electrical, mechanical or other forms. of.
  • the units described above as separate components may or may not be physically separated, and the components displayed as the unit may or may not be physical units, that is, may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may be separately used as one unit, or two or more units may be integrated into one unit; the above integration
  • the unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing storage device includes the following steps: the foregoing storage medium includes: a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • ROM read-only memory
  • RAM random access memory
  • magnetic disk or an optical disk.
  • optical disk A medium that can store program code.
  • a method for encrypting a specified broadcast message is also provided, so that the broadcast of the broadcast text can be avoided, and the information is leaked once it is stolen, thereby improving information security. Wide application prospects.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Small-Scale Networks (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种广播报文加密方法、OLT及ONU，所述方法包括：光线路终端OLT确定待加密的指定广播报文；对所述指定广播报文进行加密，形成广播加密报文；向光网络单元ONU发送所述广播加密报文。本发明实施例还公开了一种计算机存储介质。

Description

广播报文加密方法、OLT、ONU及计算机存储介质 技术领域
本发明涉及光通信领域，尤其涉及一种广播报文加密方法、OLT、ONU及计算机存储介质。
背景技术
如图1所示，在以太网无源光网络(Ethernet Passive Optical Network，简称EPON***中包括光线路终端(Optical Line Terminal，简称OLT)、光配线网络(Optical Distribution Network，ODN)和光网络单元(Optical Network Unit，简称ONU)。所述OLT和与ONU之间能够进行光信号传输；且从OLT向ONU的发送通道称为下行通道，发送的数据为下行数据。ODN用于在OLT和ONU间提供光通道。
如图1所示，一个光线路终端可以通过分光器与多个光网络单元连接。若OLT传输给ONU的下行数据不加密的话，ONU可能偷听到别的ONU信息，为了避免这种情况的出现，必须对于下行数据采取加密，以防止ONU间信息的泄漏。
目前现有技术中提出了一些对下行数据进行加密的方法，可是在实际使用时，依然发现有一些信息还是被其他ONU窃取导致信息的泄露。
发明内容
有鉴于此，本发明实施例期望提供广播报文加密方法、OLT、ONU及计算机存储介质，能够至少部分解决信息泄露的问题。
本发明实施例的技术方案是这样实现的：
本发明实施例第一方面提供了一种广播报文加密方法，所述方法包括：
光线路终端OLT确定待加密的指定广播报文；
对所述指定广播报文进行加密，形成广播加密报文；
向光网络单元ONU发送所述广播加密报文。
基于上述方案，所述方法还包括：
所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引；
所述对所述指定广播报文进行加密，形成广播加密报文，包括：
利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；
其中，所述密钥索引用于所述ONU确定所述加密密钥。
基于上述方案，所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引，包括：
向接收所述广播加密报文的ONU发送密钥请求消息；
在发送所述密钥请求消息后，启动第一计时；
在所述第一计时的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
从所述响应消息中提取所述加密密钥。
基于上述方案，所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引，还包括：
若所述第一计时超时还未接收到所述响应消息或未提取到加密密钥，则重新发送所述密钥请求消息。
基于上述方案，所述光线路终端OLT确定待加密的指定广播报文，包括：
解析报文的前导码和操作码opcode字段，获得解析信息；
根据所述解析信息确定所述报文是否为待加密的指定报文。
基于上述方案，所述方法还包括：
检测广播加密使能开关；
所述对所述指定广播报文进行加密，形成广播加密报文，包括：
若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。
本发明实施例第二方面提供了一种广播报文加密方法，所述方法包括：
ONU与OLT协商加密密钥，确定加密密钥和密钥索引；
存储所述加密密钥和密钥索引；
其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
基于上述方案，所述方法还包括：
接收OLT发送的所述广播加密报文；
解析所述广播加密报文的明文部分，确定密钥索引；
根据所述密钥索引查询加密密钥；
基于所述加密密钥解密所述广播加密报文的密文部分。
本发明实施例第三方面提供一种光线路终端OLT，所述OLT包括：
第一确定单元，配置为确定待加密的指定广播报文；
形成单元，配置为对所述指定广播报文进行加密，形成广播加密报文；
第一发送单元，配置为向光网络单元ONU发送所述广播加密报文。
基于上述方案，所述OLT还包括：
第一协商单元，配置为OLT与ONU协商加密密钥，确定加密密钥和密钥索引；
所述形成单元，配置为利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；
其中，所述密钥索引用于所述ONU确定所述加密密钥。
基于上述方案，所述第一发送单元，还配置为向接收所述广播加密报文的ONU发送密钥请求消息；在发送所述密钥请求消息后，启动第一计时；
所述OLT还包括：
第一接收单元，配置为在所述第一计时的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
所述第一协商单元，配置为从所述响应消息中提取所述加密密钥。
基于上述方案，所述第一发送单元，还配置为若所述第一计时超时还未接收到所述响应消息或未提取到加密密钥，则重新发送所述密钥请求消息。
基于上述方案，所述第一确定单元，配置为解析报文的前导码和操作码opcode字段，获得解析信息；及根据所述解析信息确定所述报文是否为待加密的指定报文。
基于上述方案，所述OLT还包括：
检测单元，配置为检测广播加密使能开关；
所述形成单元，配置为若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。
本发明实施例第四方面提供了一种光网络单元ONU，所述ONU包括：
第二协商单元，配置为与OLT协商加密密钥，确定加密密钥和密钥索引；
存储单元，配置为存储所述加密密钥和密钥索引；
其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
基于上述方案，所述ONU还包括：
第二接收单元，配置为接收OLT发送的所述广播加密报文；
解析单元，配置为解析所述广播加密报文的明文部分，确定密钥索引；
查询单元，配置为根据所述密钥索引查询加密密钥；
解密单元，配置为基于所述加密密钥解密所述广播加密报文的密文部分。
本发明实施例还公开了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行所述广播报文加密方法的至少其中之一。
本发明实施例提供的广播报文加密方法、OLT、ONU及计算机存储介质，会确定出需要加密的指定广播报文，然后对广播报文进行加密形成广播加密报文，OLT向ONU发送的广播加密报文，这样就减少了广播报文在传输过程中因明文传输导致的被窃取和信息泄露，通过加密广播报文，增大信息泄露的难度，提高了信息安全性。
附图说明
图1为一种EPON***的结构示意图；
图2为本发明实施例提供的第一种广播报文加密方法的流程示意图；
图3为本发明实施例提供的第二种广播报文加密方法的流程示意图；
图4为本发明实施例提供的第三种广播报文加密方法的流程示意图；
图5为本发明实施例提供的第四种广播报文加密方法的流程示意图；
图6为本发明实施例提供的一种OLT的结构示意图；
图7为本发明实施例提供的一种ONU的结构示意图；
图8为本发明实施例提供的报文的部分结构示意图；
图9为本发明实施例提供的AES加密的流程示意图；
图10为本发明实施例提供的利用三重搅动加密前后的数据帧的比对示意图；
图11为本发明实施例提供的三重搅动加密过程中加密密钥协商流程示 意图。
具体实施方式
研究发现，光线路终端发送至光网络单元的数据都会采取各种加密方式进行加密传输。但是仅对普通的单播和组播业务数据加密，没有专门针对广播数据加密的，而导致某些广播数据被非法ONU窃取并泄露。有鉴于此，本实施例提供了一种广播报文加密方法，对待加密的指定广播报文进行加密，提高信息安全性。以下结合说明书附图及具体实施例对本发明的技术方案做进一步的详细阐述，应当理解，以下所说明的优选实施例仅用于说明和解释本发明，并不用于限定本发明。
实施例一：
如图2所示，本实施例提供一种广播报文加密方法，所述法包括：
步骤S110：光线路终端OLT确定待加密的指定广播报文；
步骤S120：对所述指定广播报文进行加密，形成广播加密报文；
步骤S130：向光网络单元ONU发送所述广播加密报文。
在本实施例中所述OLT发送下行数据之前，若发送的下行数据为广播报文，将会确定是否是需要加密的指定广播报文。这里的指定广播报文可为指定类型的广播报文。具体的如广播报文可分为注册广播报文和非注册广播报文；所述指定广播报文可为非注册广播报文。在比如，所述OLT接收到指示指令，该指示指令加密某一个广播报文，该指定要加密的广播报文即为所述指定广播报文。当然在具体实现时，还可解析所述广播报文的正文部分，根据正文部分内容的安全性要求，确定对应的广播报文是否为所述指定广播报文。
在步骤S120中将对指定广播报文进行加密，形成广播加密报文，这样的话，就算是其他ONU窃取到该广播报文，没有密钥也无法获取广播报文的内容或窃取广播报文的内容的难度增大。在步骤S120中对所述广播报文 进行加密可包括全部加密或部分加密。这里的部分加密可为仅对广播报文的部分内容进行加密，例如不对广播报文的包头进行加密，而仅对广播报文的正文进行加密。所述全部加密为对整个广播报文进行加密。
在步骤S130中将加密后形成的广播加密报文发送给ONU，这里的发送可通过ODN下发到ONU。
本实施例所述的广播报文加密方法，不仅提高了OLT与ONU之间信息传输的安全性，减少了信息泄露，还具有实现简便的特点。
如图3所示，在本实施例中，所述方法还包括：
步骤S101：所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引；
所述步骤S120可包括：利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；其中，所述密钥索引用于所述ONU确定所述加密密钥。
在本实施例中所述OLT会与需要接收该广播报文的ONU进行加密密钥协商，这样的话，OLT和对应的ONU将确定出加密密钥，方便后续ONU对广播加密报文的解密。在实现过程中，可以由所述OLT确定出一个加密密钥，下发给ONU即可，也可以ONU确定出一个加密密钥，发送给OLT。但是在本实施例中为了避免其他ONU窃取加密密钥，通常可选为由ONU确定出加密密钥，通过上行光通道发送给OLT。在本实施例中还会确定一个密钥索引，这个密钥索引方便ONU接收到所述广播加密报文之后，从广播加密报文的明文部分中提取出来，进而确定出所述加密密钥。这里的所述密钥索引同样可以是所述ONU确定的，也可以是所述OLT确定的，在本实施例中优选为所述密钥索引由形成所述加密密钥的一方来确定。
本实施例中承载所述密钥索引的明文部分，可包括位于报文中包头内 的前导码。例如，可利用前导码的第5个字节中的部分比特来表示所述密钥索引；具体如，利用所述第5个字节中最后2个比特来表示所述密钥索引。
总之，本实施例所述方法，OLT会事先与ONU进行加密密钥的协商，从而确定出加密密钥和密钥索引，以方便后续广播加密报文的解密。
当然在具体的实现过程中，所述OLT和ONU可以预先设置多个加密密钥，后续在进行协商时，仅需协商加密密钥对应的密钥索引即可。在本实施例中为了进一步提升信息安全性，所述加密密钥对于OLT和ONU其中一端是动态生成，而非从多个预先设置的密钥中选择的。
可选地，所述步骤S101可包括：
向接收所述广播加密报文的ONU发送密钥请求消息；
在发送所述密钥请求消息后，启动第一计时器；
在所述第一计时器的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
从所述响应消息中提取所述加密密钥。
在本实施例中所述密钥请求消息可对应于一个密钥请求帧，例如所述OLT通过向接收对应广播报文的ONU发送一个密钥请求帧，ONU在接收到所述密钥请求帧之后会恢复一个携带有加密密钥的密钥通知帧作为所述响应消息。这样OLT就能够从所述响应消息中提取出进行广播报文加密的加密密钥。通常所述响应消息中还包括密钥索引，这里的密钥索引可为所述密钥的序号等。
在本实施例中，所述OLT发送完所述密钥请求消息后，会启动计时器进行计时或启动计数器进行计数来进行计时，若OLT在第一计时时间内接收到所述响应消息，表示此次协商成功；这样对密钥协商的失效性进行了限定，避免了密钥协商过程中忽视时效性导致的加密密钥的安全性问题。
可选地，所述步骤S101还包括：若所述第一计时超时还未接收到所述响应消息或未提取到加密密钥，还未接收到所述响应消息，则重新发送所述密钥请求消息。若当前OLT有数据需要发送，在本实施例中所述OLT还会在第一计时超时或未提取到加密密钥时，重新发送所述密钥请求消息，以重新进行密钥协商以确保广播报文的正常发送。
当然在具体的实现过程中可能当前ONU出现故障，即便继续发送所述密钥请求消息也没有用，反而会导致OLT负荷过大；这样的话，在本实施例中可以规定指定次数，若连续协商的次数超过指定次数，则停止发送所述密钥请求消息或停止指定时长之后在发送所述密钥协商请求消息，或输出密钥协商失败等提示信息。
在本实施例中，所述步骤S110可包括：
步骤S111：解析报文的前导码和操作码opcode字段，获得解析信息；
步骤S112：根据所述解析信息确定所述报文是否为待加密的指定报文。
所述步骤S111可包括：解析广播报文的前导码，提取所述前导码中的模式位和逻辑链路标识；根据所述模式位和/或逻辑链路标识，确定所述报文是否为广播报文。
报文可分为广播报文、单播报文和组播报文。报文又可分为包头和正文两个部分，在报文中包括前导码、目的地址(Destination Address，DA)、源地址(Sources Address，SA)和类型字段等信息。在前导码中包括两个逻辑链路标识(Logic Link Identification，LLID)字段。通常每一个LLID包括8个比特；从而两个LLID字段共16比特，这16比特的最高位的比特为所述模式位，后15个比特为用来记录该广播报文的逻辑链路标识。在通常情况下若所述模式位为1，表示该报文为广播报文，若后15位全为1也表示该报文为广播报文。
步骤S112为解析所述opcode字段中的内容，确定出该广播报文是否 为不能够进行加密的注册报文。例如，所述opcode字段的内容为02、04、05、06时，通常表示该本广播报文为注册报文，这里的02、04、05、06对应的是16进制数。故在步骤S112中若opcode字段的内容不是16进制的02、04、05及06时，则该广播报文可以作为所述待加密的指定广播报文。
在一些实施例中，通常情况下广播报文是不加密的，仅在一些特殊场景下，例如对某些ONU进行广播报文收发测试等处理时，可能仅需要将广播报文发送给特定的ONU。在本实施例中为了与现有技术进行更好的兼容个，在本实施例中所述方法还包括：检测广播加密使能开关；所述步骤S120包括：若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。在本实施例中可事先为OLT配置一个加密使能开关，若当前需要发送需要加密的广播报文，则将所述广播加密使能开关处于使能状态，这样的话，才会触发所述OLT执行上述步骤S110至步骤S130。所述广播加密使能开关的默认状态为非使能状态，在非使能状态下，所述OLT不会对广播报文进行加密处理。
所述步骤S130中对指定广播报文进行加密的方式有多种，以下提供两种可选方式。
第一种：对所述指定报文进行高级加密标准(Advanced Encryption Standard，简称AES)加密。AES加密为一种基于区块加密标准的加密方式，在本实施例中可以将指定广播报文中需要加密的加密部分划分为多个块，例如，将加密部分中的连续分布的128位数据划分为一个块，利用长度为128位的加密密钥对每一个块进行加密处理。
第二种：
利用搅动密钥对指定广播报文进行搅动加密，例如，利用搅动密钥对所述指定广播报文进行三重搅动加密。搅动加密为利用搅动密钥打乱需要加密的内容，从而使搅动加密之后的信息呈现出乱序性，这样没有搅动密 钥的ONU即便窃取到该报文，也会认为是一个没有意义的乱码报文。在本实施例中为了提升加密效果，提升广播报文的安全性，在本实施例中可选为采用三重搅动，对指定广播报文进行至少三次的搅动加密。
总之，本实施例提供了一种广播报文加密方法，可以对部分需要加密的广播报文进行加密，提高广播报文的信息安全性，减少信息的泄露。
实施例二：
如图4所示，本实施例提供一种广播报文加密方法，所述方法包括：
步骤S210：ONU与OLT协商加密密钥，确定加密密钥和密钥索引；
步骤S220：存储所述加密密钥和密钥索引；
其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
本实施例所述广播报文加密方法为应用于ONU中的方法，该OLN会与OLT进行广播报文加密的加密密钥的协商，确定出加密密钥和密钥索引。在步骤S220中将存储所述加密密钥及密钥索引，这样后续接收到广播加密报文时，可以利用所述密钥索引查找到所述加密密钥，并利用所述加密密钥解密所述广播加密报文；这样能够减少广播报文被其他不相关的ONU窃取的现象。
值得注意的是：本实施例所述步骤S220可能发生在所述步骤S210之前，例如，ONU预先存储了多个加密密钥及加密密钥对应的密钥索引，在执行步骤S210时，所述ONU从预先存储的加密密钥和密钥索引中挑选一组作为与OLT本次进行广播报文交互的加密密钥和密钥索引。故在本实施例中所述步骤S210和步骤S220的执行顺序可以如图4所示，也可以是步骤S220之前，步骤S210在后。
如图5所示，作为本实施例的进一步改进，所述方法还包括：
步骤S230：接收OLT发送的广播加密报文；
步骤S240：解析所述广播加密报文的明文部分，确定密钥索引；
步骤S250：根据所述密钥索引查询加密密钥；
步骤S260：基于所述加密密钥解密所述广播加密报文的密文部分。
在本实施例中ONU接收到广播加密报文，解析广播加密报文的明文部分，这里的明文部分可包括前导码。通过解析前导码承载所述密钥索引的字段，得到所述密钥索引，进而利用密钥索引查找到对应的加密密钥，最终执行步骤S260利用所述加密密钥解码所述广播加密报文的密文部分；具有实现简便的特点。值得注意的是：在步骤S260中若广播加密报文的加密方式是对称加密，则所述加密密钥也就是解密密钥，可以直接利用所述加密密钥对所述广播加密报文进行解码。若所述广播加密报文的加密方式为非对称加密，则所述加密密钥对应有解密密钥，则需要根据该加密密钥确定出所述解密密钥，利用解密密钥来机密所述广播加密报文。
实施例三：
如图6所示，本发明实施例提供一种光线路终端OLT，所述OLT包括：
第一确定单元110，配置为确定待加密的指定广播报文；
形成单元120，配置为对所述指定广播报文进行加密，形成广播加密报文；
第一发送单元130，配置为向光网络单元ONU发送所述广播加密报文。
本实施例提供一种OLT，该OLT包括所述第一确定单元110、形成单元120和第一发送单元130。所述第一确定单元110和所述形成单元120均可对应于所述OLT中的处理器或处理电路，所述处理器可包括中央处理器、应用处理器、微处理器、数字信号处理器或可编程阵列。所述处理器或处理电路通过执行指定代码，实现所述第一确定单元110和所述形成单元120的功能。
所述第一发送单元130对应于所述OLT的光发送接口，例如，对应于 所述OLT向ONU发送信号的下行发送接口，能够用于将所述OUN发送加密报文。
在本实施例中所述OLT会对需要加密的广播报文进行加密，避免不需要接收该广播报文的其他ONU泄露该广播报文的信息内容，提升信息的安全性。
可选地，所述OLT还包括：第一协商单元，配置为OLT与ONU协商加密密钥，确定加密密钥和密钥索引；所述形成单元120，配置为利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；其中，所述密钥索引用于所述ONU确定所述加密密钥。所述第一协商单元可对应于通信接口或处理器，能够通过与OUN多次信息交互和信息解析提取等操作，确定出所述加密密钥和密钥索引。在本实施例中通过第一协商单元的设置，可以简便的协商出加密密钥，从而能够方便ONU后续解密所述广播加密报文。
可选地，所述第一发送单元130，还配置为向接收所述广播加密报文的ONU发送密钥请求消息；在发送所述密钥请求消息后，启动第一计时；
所述OLT还包括：
第一接收单元，配置为在所述第一计时的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
所述第一协商单元，配置为从所述响应消息中提取所述加密密钥。
所述第一接收单元可包括OLT的下行接收接口，能够用于从ONU接收所述响应消息。在本实施例中，还设置了第一计时，避免因协商时间过长导致的各种信息安全性问题，这里的信息安全性问题可包括加密密钥被泄露。
在本实施例中，所述第一发送单元130，还配置为若所述第一计时超时 还未接收到所述响应消息或未提取到加密密钥，则重新发送所述密钥请求消息。在本实施例中当然为了保证广播报文的顺利发送，若出现上述三种情况的至少其中之一时，将重新发送所述密钥请求消息。在具体实现时，所述第一发送单元130向同一个ONU发送所述密钥请求消息的次数直至达到指定次数后才停止，或停止一段时间后间隔发送，或向上层设备发送协商失败的警告信息等。
具体地，所述第一确定单元110，配置为解析报文的前导码和操作码opcode字段，获得解析信息；及根据所述解析信息确定所述报文是否为待加密的指定报文。所述前导码包括前述实施例中提到的模式位和逻辑链路标识等信息，根据前导码可确定出当前需要发送的报文是否为广播报文，根据所述opcode字段的内容可确定出是否待加密的指定广播报文，具有结构简单及实现简便的特点。
可选地，所述OLT还包括：
检测单元，配置为检测广播加密使能开关；
所述形成单元120，配置为若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。
在本实施例中所述检测单元可对应于处理器或处理电路，可以检测所述OLT内的表示所述广播加密使能的字段是否被置为对应于所述使能状态的指定值，来确定所述广播加密使能开关的状态。当然这只是一种实现，具体的实现结构还有多种，不限于上述实现结构。
通过检测单元的设置，通过检测单元对广播加密使能开关的状态的检测，可以与现有技术中很好的兼容，在默认状态下所述广播加密使能开关通常为非使能状态，以避免影响大多数不需要加密的广播报文的发送。
实施例四：
如图7所示，本实施例提供一种光网络单元ONU，所述ONU包括：
第二协商单元210，配置为与OLT协商加密密钥，确定加密密钥和密钥索引；
存储单元220，配置为存储所述加密密钥和密钥索引；
其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
本实施例所述第二协商单元210可对应于所述ONU中的光通信接口和处理器或处理电路等，利用光通信接口与OLT进行信息交互，通过信息交互确定出密钥索引和密钥索引。例如，利用所述光通信接口将确定好的加密密钥和密钥索引的至少其中之一，发送给所述OLT。所述ONU还包括存储单元220可对应于所述ONU中的各种存储介质，可用于存储所述加密密钥和密钥索引。
总之，本实施例所述ONU通过与OLT之间的协商，可以协助OLT确定加密密钥，方便OLT利用该加密密钥对待加密的广播报文进行加密，以提高广播报文的信息安全性。
可选地，所述ONU还包括：
第二接收单元，配置为接收OLT发送的所述广播加密报文；
解析单元，配置为解析所述广播加密报文的明文部分，确定密钥索引；
查询单元，配置为根据所述密钥索引查询加密密钥；
解密单元，配置为基于所述加密密钥解密所述广播加密报文的密文部分。
本实施例所述第二接收单元可对应于能够与OLT进行光通信的光通信接口，能够从OLT接收信息，例如所述广播加密报文。在本实施例中所述广播加密报文可包括明文部分和密文部分；在本发明实施例中需要保密的信息位于在所述密文部分中。所述明文部分可包括报文的前导码等信息。所述密钥索引也位于所述明文部分。故在本实施例中解析单元会对明文部 分进行解密，获得所述密钥索引，在根据密钥索引确定出加密密钥，从而基于加密密钥解密所述广播加密报文的加密部分，从而获得解密后的原始广播报文的报文内容，实现了广播报文的加密交互，能够防止信息的泄露，提高了信息的安全性。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行前述任意一个或多个广播报文加密方法，例如可图2、图3、图4及图5中一个或多个所示的广播报文加密方法。
本实施例所述的计算机存储介质可为光盘、硬盘、磁盘、磁带、闪盘等各种计算机存储介质，可选为非瞬间存储介质。
以下结合上述任意实施例提供一个示例：
本示例提供一种广播报文加密***，该***可为应用于OLT和ONU中的***，包括：广播业务包鉴别单元、交互单元、前导码修改单元、AES加密单元及三重搅动加密单元。
利用上述广播报文加密***，执行广播报文加密包括以下步骤：
第一步：；利用广播(Broadcast)业务包鉴别单元，完成广播包的鉴别。在EPON***中，可以利用逻辑链路标识和模式位的内容确定出对应的报文是否为广播报文。通常若模式位取值为1，表示该报文为广播报文；或者，当逻辑链路标识的各比特均为1，表示该报文为广播报文。图8为报文的部分示意图，报文包括前导码，目的地址DA字段、源地址SA字段、长度/类型字段、OP-code字段等字段；还有数据区域等字段未在图8中显示。所述前导码包括保留字段1、保留字段2、帧起始定界符(Start of Packet Delimiter，SPD)字段、两个字节长度的LLID以及校验CRC字段。报文
第二步：利用交互单元，确定是否进行加密及加密方式等各种加密 参数。该步骤具体可包括：每当收到新广播数据包头的时候，根据预先配置的广播加密使能开关，决定是否申请加密密钥。在本示例中，广播报文密钥索引用直接寄存器进行配置，若广播加密开关处于使能状态，则直接查询直接寄存器配置的密钥索引，根据密钥索引判断是否需要加密及加密方式。本示例中的加密方式可包括AES加密和三重搅动加密。
第三步：前导码修改单元，根据前面的密钥交互单元的处理，决定是否修改前导码即(前导码修改单元)，在申请加密密钥后，广播加密使开关的状态依然保持使能有效，则将前导码中的第5字节的低2bit改为1和密钥索引，并对修改后的前导码做校验，生成校验值。例如，对修改后的前导码做循环校验，生成循环校验值。
第四步：根据第二步的加密使能以及加密方式，进行加密。所述加密方式可包括AES加密和三重搅动加密。以下分别介绍一下AES加密和三重搅动加密的具体实现。
利用AES加密单元进行AES加密时，将要加密的数据进行分割成一个多个数据块，其中每一个数据块包括128比特。如图9所示，将分割形成的数据块作为输入块，与加密密钥一同作为加密逻辑的输入，经过AES加密后，将形成加密后的输出块。通常输出块包括的比特数与所述输入块包括的比特数相同。接下来，将输出块与对应明文块的后16字节进行异或运算，得到完成了AES加密的密文。
所述AES加密单元还会用于最终确定加密密钥；具体如可包括：
1)OLT发出KEY_ASSIGN消息。在该KEY_ASSIGN消息包括16位加密输入值中的初始值、第一密钥激活时间、128位初始密钥。这里的KEY_ASSIGN消息对应于前述实施例中的密钥请求消息。
2)OLT发出KEY_ASSIGN消息的同时，启动一个超时计数器。
3)接收ONU发送KEY_RESPONSE消息。该KEY_RESPONSE消 息内含有128位更新后的密钥，以及第二密钥激活时间。这里的KEY_RESPONSE消息对应于前述实施例中的响应消息。
4)如果OLT的超时计数器表示已经超时，还未收到KEY_RESPONSE，或者基于第一密钥激活时间和第二密钥激活时间判断出OLT与ONU协商失败未提取到加密密钥，就重启密钥交互过程。第一密钥激活时间为OLT发送KEY_ASSIGN消息的时间戳，第二密钥激活时间为发送KEY_RESPONSE消息的时间戳，根据这两个时间戳，就能够确定出传输时延，若传输时延大于预定时延，这样的话，可认为协商失败。
OLT发送的128初始密钥可以作为所述ONU形成128更新后的密钥的初始值。所述128初始密钥与128更新后的密钥也可以完全没有关系，在本实施例中所述128更新后的密钥为前述实施例中用来加密指定广播报文的加密密钥。
第六步：三重搅动加密单元用于三重搅动加密。在三重搅动加密过程中，OLT提出密钥更新要求，ONU提供3字节搅动密钥，OLT使用此搅动密钥完成搅动加密。在启用搅动加密后，对非注册广播报文所有的数据帧和OAM帧进行搅动。这的非注册广播报文即对应于前述的指定广播报文。
搅动密钥是ONU由上行用户数据中提取的3字节数据与3字节随机数或相加的结果。
前导码中的第五个字节作为搅动密钥索引的标识字段来实现密钥同步。在图10中显示有广播数据帧搅动加密前的格式和搅动加密后的格式。在图10所示的搅动加密前的数据帧包括前导码和以明文形式存在的其他数据。在前导码中2个字节长度的LLID字段，在该字段中存储有模式位和逻辑链路标识，和两个长均为2个字节的保留字段1和保留字 段2。在搅动加密后的数据帧中，签到码的保留字段2的后一个字节中添加了加密索引。且在搅动加密的数据中，利用搅动密钥对数据搅动搅动区进行搅动加密。
在图10所示的数据搅动区可包括目的地址DA字段、源地址SA字段、长度/类型字段及数据区域和FCS字段。所述FCS为Frame Check Sequence的缩写，是校验字段；可以利用保存该数据帧的循环校验码等校验数据。FCS中存储的校验数据可用于对数据区域内存储的数据进行校验。在前导码循环校验码CRC字段存储的校验码，可用于对前导码内存储数据的校验。
密钥更新由新密钥请求帧(new_key_request)和密钥通知帧(new_churning_key)来实现。OLT向ONU发出包括新密钥请求的新密钥请求帧，该请求帧包含当前正在用于下行加密的密钥的序号。这里的新密钥请求帧相当于前述实施例中密钥请求消息。
ONU收到新密钥请求帧后产生新的搅动密钥，该搅动密钥的序号可为二进制序号，可以为是所接收到的新密钥请求帧中In-use_Key_Index字节最低位的二进制的补码。
ONU向OLT发送新密钥通知帧，新密钥通知帧中包含新密钥索引字段和新搅动密钥字段。通常新密钥索引字段包括密钥索引，数据长度为1个字节，新搅动密钥字段包括搅动密钥，数据长度为3个字节。新密钥序索引字段(New_Key_Index)的最低位的值为新密钥索引，剩余比特值均可以置为指定值，这里的指定值可为0或1。这里的新密钥通知帧可相当于前述实施例中的基于密钥请求消息返回的响应消息。
OLT收到新密钥通知帧后，就可以使用新搅动密钥对随后的帧进行搅动加密。密钥同步依靠每个帧中的保留字段2中的第2个字节来实现，只要ONU收到OLT发送的搅动帧中，密钥索引Key_Index可为新密钥 通知帧中的密钥编号，则ONU使用新密钥进行解搅动。所述保留字段2的第2个字节中可设置有Flag和加密索引；所述Flag可包括1个比特，表示当前报文是否有加密，例如当该比特的内容为0表示未加密，当该比特为1表示加密。所述加密索引对应的比特表示的加密密钥的密钥标号等索引信息。
OLT有一个定时器key_update_timer，用于控制密钥更新周期。当该定时器超时，OLT则启动上述密钥更新过程。OLT使用另一个定时器Churning_Timer用于作为在无法获得密钥更新帧情况下启动下一次密钥更新请求的机制，以增加密钥更新的可靠性。这里的定时器Churning_Timer相当于前述实施例中对第一计时进行计时的计时器。
当OLT每次发出新密钥请求帧时，启动定时器Churning_Timer。当OLT在Churning_Timer超时前收到了ONU发来的正确的新密钥通知帧，则OLT启用新密钥作为搅动密钥进行搅动加密，并将Churning_Timer复位。
当定时器Churning_Timer超时后OLT仍没有收到新密钥通知帧，则认为密钥交互失败，将Churning_Timer复位；且OLT发送新一轮的新密钥请求帧。
在新密钥成功交互之前，ONU仍然使用原来的密钥，并且由OLT将密钥交互失败的信息上报给网管。如果OLT连续3次发送新密钥请求帧后仍然无法在Churning_Timer超时前收到密钥更新帧，则OLT应向网管告警。下行业务仍然使用旧的密钥进行搅动。密钥更新周期Tkey和定时器Churning_Timer的值均可配置。Tkey的缺省值为10s。密钥更新与同步过程。
图11提供了OLT和ONU之间进行搅动密钥交互的流程示意图，包括：
OLT在一个密钥更新周期Tkey时间内向ONU发送新密钥请求。
ONU接收到新密钥请求后，向OLT返回搅动密钥0。
OLT接收搅动密钥0。
OLT利用搅动密钥0进行搅动加密。
ONU后续在接收到广播加密报文后，会利用搅动密钥0解搅动加密。
OLT在下一个Tkey时间内，发送新密钥请求。
OLT ONU接收到新密钥请求后，向OLT返回搅动密钥1。
OLT利用搅动密钥1进行搅动加密。
ONU后续在接收到广播加密报文后，会利用搅动密钥1解搅动加密。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个***，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能单元可以全部集成在一个处理模块中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，凡按照本发明原理所作的修改，都应当理解为落入本发明的保护范围。
工业实用性
本发明实施例中，提供了一种对指定的广播报文也会加密的方法，这样可以避免广播报文明文发送，一旦被窃取就泄露的现象，提升了信息安全性，在信息技术领域具有广泛的应用前景。

Claims (17)

  1. 一种广播报文加密方法，所述方法包括：
    光线路终端OLT确定待加密的指定广播报文；
    对所述指定广播报文进行加密，形成广播加密报文；
    向光网络单元ONU发送所述广播加密报文。
  2. 根据权利要求1所述的方法，其中，
    所述方法还包括：
    所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引；
    所述对所述指定广播报文进行加密，形成广播加密报文，包括：
    利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；
    其中，所述密钥索引用于所述ONU确定所述加密密钥。
  3. 根据权利要求2所述的方法，其中，
    所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引，包括：
    向接收所述广播加密报文的ONU发送密钥请求消息；
    在发送所述密钥请求消息后，启动第一计时；
    在所述第一计时的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
    从所述响应消息中提取所述加密密钥。
  4. 根据权利要求3所述的方法，其中，
    所述OLT与ONU协商加密密钥，确定加密密钥和密钥索引，还包括：
    若所述第一计时超时还未接收到所述响应消息或未提取到加密密钥，则重新发送所述密钥请求消息。
  5. 根据权利要求1所述的方法，其中，
    所述光线路终端OLT确定待加密的指定广播报文，包括：
    解析报文的前导码和操作码opcode字段，获得解析信息；
    根据所述解析信息确定所述报文是否为待加密的指定报文。
  6. 根据权利要求1至5任一项所述的方法，其中，
    所述方法还包括：
    检测广播加密使能开关；
    所述对所述指定广播报文进行加密，形成广播加密报文，包括：
    若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。
  7. 一种广播报文加密方法，所述方法包括：
    ONU与OLT协商加密密钥，确定加密密钥和密钥索引；
    存储所述加密密钥和密钥索引；
    其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
  8. 根据权利要求7所述的方法，其中，
    所述方法还包括：
    接收OLT发送的所述广播加密报文；
    解析所述广播加密报文的明文部分，确定密钥索引；
    根据所述密钥索引查询加密密钥；
    基于所述加密密钥解密所述广播加密报文的密文部分。
  9. 一种光线路终端OLT，所述OLT包括：
    第一确定单元，配置为确定待加密的指定广播报文；
    形成单元，配置为对所述指定广播报文进行加密，形成广播加密报文；
    第一发送单元，配置为向光网络单元ONU发送所述广播加密报文。
  10. 根据权利要求9所述的OLT，其中，
    所述OLT还包括：
    第一协商单元，配置为于OLT与ONU协商加密密钥，确定加密密钥和密钥索引；
    所述形成单元，配置为利用所述加密密钥对所述指定广播报文的待加密部分进行加密，并将所述密钥索引携带在所述指定广播报文的明文部分，形成所述广播加密报文；
    其中，所述密钥索引用于所述ONU确定所述加密密钥。
  11. 根据权利要求10所述的OLT，其中，
    所述第一发送单元，还配置为向接收所述广播加密报文的ONU发送密钥请求消息；在发送所述密钥请求消息后，启动第一计时；
    所述OLT还包括：
    第一接收单元，配置为在所述第一计时的计时时间内，接收所述ONU基于所述密钥请求消息返回的响应消息；
    所述第一协商单元，配置为从所述响应消息中提取所述加密密钥。
  12. 根据权利要求11所述的OLT，其中，
    所述第一发送单元，还配置为若所述第一计时超时还未接收到所述响应消息或未提取到加密密钥，则重新发送所述密钥请求消息。
  13. 根据权利要求9所述的OLT，其中，
    所述第一确定单元，配置为解析报文的前导码和操作码opcode字段，获得解析信息；及根据所述解析信息确定所述报文是否为待加密的指定报文。
  14. 根据权利要求9至13任一项所述的OLT，其中，
    所述OLT还包括：
    检测单元，配置为检测广播加密使能开关；
    所述形成单元，配置为若所述广播加密使能开关处于使能状态，则对所述指定广播报文进行加密，形成广播加密报文。
  15. 一种光网络单元ONU，所述ONU包括：
    第二协商单元，配置为与OLT协商加密密钥，确定加密密钥和密钥索引；
    存储单元，配置为存储所述加密密钥和密钥索引；
    其中，所述加密密钥和所述密钥索引用于所述OLT对广播报文进行加密及ONU解密所述OLT加密形成的广播加密报文。
  16. 根据权利要求15所述的ONU，其中，
    所述ONU还包括：
    第二接收单元，配置为接收OLT发送的所述广播加密报文；
    解析单元，配置为解析所述广播加密报文的明文部分，确定密钥索引；
    查询单元，配置为根据所述密钥索引查询加密密钥；
    解密单元，配置为基于所述加密密钥解密所述广播加密报文的密文部分。
  17. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至8任一项所述广播报文加密方法。
PCT/CN2016/098281 2015-11-30 2016-09-07 广播报文加密方法、olt、onu及计算机存储介质 WO2017092465A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510863047.5 2015-11-30
CN201510863047.5A CN106817352A (zh) 2015-11-30 2015-11-30 广播报文加密方法及装置

Publications (1)

Publication Number Publication Date
WO2017092465A1 true WO2017092465A1 (zh) 2017-06-08

Family

ID=58796211

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/098281 WO2017092465A1 (zh) 2015-11-30 2016-09-07 广播报文加密方法、olt、onu及计算机存储介质

Country Status (2)

Country Link
CN (1) CN106817352A (zh)
WO (1) WO2017092465A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111935181A (zh) * 2020-09-25 2020-11-13 北京天御云安科技有限公司 一种全密态条件下密钥切换的业务无中断实现方法
CN114268412A (zh) * 2021-11-18 2022-04-01 岚图汽车科技有限公司 车辆通信方法、装置、存储介质及设备
CN116866902A (zh) * 2023-07-27 2023-10-10 烟台东方威思顿电气有限公司 一种基于交互数据的数据保护方法

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108777678B (zh) * 2018-05-18 2020-12-11 北京邮电大学 一种网络密钥交互***、装置及方法
CN109583238B (zh) * 2018-11-29 2023-03-28 中国电子科技集团公司第四十七研究所 流水线指令流加解密方法
CN114365522A (zh) * 2019-09-27 2022-04-15 华为技术有限公司 数据安全处理的方法和通信装置
CN112751709B (zh) * 2020-12-29 2023-01-10 北京浪潮数据技术有限公司 一种存储集群的管理方法、装置和***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1897500A (zh) * 2006-05-11 2007-01-17 中国电信股份有限公司 一种应用于以太网无源光网络***的搅动密钥更新与同步机制
CN101072094A (zh) * 2006-05-14 2007-11-14 华为技术有限公司 一种pon***中密钥协商的方法和***
CN101183934A (zh) * 2007-10-23 2008-05-21 中兴通讯股份有限公司 无源光网络中密钥更新方法
CN101388806A (zh) * 2007-09-12 2009-03-18 中兴通讯股份有限公司 密钥一致性检测方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1897500A (zh) * 2006-05-11 2007-01-17 中国电信股份有限公司 一种应用于以太网无源光网络***的搅动密钥更新与同步机制
CN101072094A (zh) * 2006-05-14 2007-11-14 华为技术有限公司 一种pon***中密钥协商的方法和***
CN101388806A (zh) * 2007-09-12 2009-03-18 中兴通讯股份有限公司 密钥一致性检测方法和装置
CN101183934A (zh) * 2007-10-23 2008-05-21 中兴通讯股份有限公司 无源光网络中密钥更新方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111935181A (zh) * 2020-09-25 2020-11-13 北京天御云安科技有限公司 一种全密态条件下密钥切换的业务无中断实现方法
CN114268412A (zh) * 2021-11-18 2022-04-01 岚图汽车科技有限公司 车辆通信方法、装置、存储介质及设备
CN114268412B (zh) * 2021-11-18 2023-10-13 岚图汽车科技有限公司 车辆通信方法、装置、存储介质及设备
CN116866902A (zh) * 2023-07-27 2023-10-10 烟台东方威思顿电气有限公司 一种基于交互数据的数据保护方法

Also Published As

Publication number Publication date
CN106817352A (zh) 2017-06-09

Similar Documents

Publication Publication Date Title
WO2017092465A1 (zh) 广播报文加密方法、olt、onu及计算机存储介质
US11335144B2 (en) Method for unlocking intelligent lock, mobile terminal, intelligent lock and server
US11606341B2 (en) Apparatus for use in a can system
JP5288210B2 (ja) ネットワークでのユニキャスト鍵の管理方法およびマルチキャスト鍵の管理方法
US9300468B2 (en) Secure node admission in a communication network
US11617082B2 (en) Methods providing NAS connection identifications and related wireless terminals and network nodes
US20230396606A1 (en) Method and system for communication between server and authenticator
US9264404B1 (en) Encrypting data using time stamps
WO2012003693A1 (zh) 一种处理ecm包的方法及装置
WO2021244489A1 (zh) 光传送网中加密控制开销传输方法及装置
CN110945890B (zh) 使用单独的计数为多个nas连接提供安全性的方法以及相关的网络节点和无线终端
JP7451738B2 (ja) 鍵更新方法および関連装置
CN112511299A (zh) 接口数据传输方法、装置、电子设备及存储介质
CN108337089B (zh) 信令传输加密、解密方法、装置及终端
US20110078444A1 (en) Re-authentication apparatus and method in downloadable conditional access system
CN113632419A (zh) 用于对要在总线***（bu）、特别是机动车辆的总线***中传输的至少一个数据分组进行生成和认证检查的装置和方法
CN108366359A (zh) 一种配置机顶盒连接WiFi的方法、装置及***
KR20100092768A (ko) 무선 네트워크 통신 시스템에서 데이터 통신 보안을 위한 맥 프로토콜 제공 방법
EP2047631B1 (en) Method for establishing a secret key between two nodes in a communication network
WO2006062345A1 (en) Method of distributing keys over epon
CN106301768B (zh) 一种基于光传输网otn的密钥更新的方法、装置和***
JP2004260556A (ja) 局側装置、加入者側装置、通信システムおよび暗号鍵通知方法
US20210400472A1 (en) Secure beacons
CN111163468A (zh) 一种通信连接方法及设备
WO2022105809A1 (zh) 密钥更新方法、装置、电子设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16869776

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16869776

Country of ref document: EP

Kind code of ref document: A1