WO2016169260A1

WO2016169260A1 - Authentication and registration method, device and system for optical access module

Info

Publication number: WO2016169260A1
Application number: PCT/CN2015/094729
Authority: WO
Inventors: 刁渊炯; 江晓林; 李明生
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-04-24
Filing date: 2015-11-16
Publication date: 2016-10-27
Also published as: CN106162387B; CN106162387A

Abstract

The present invention provides an authentication and registration method, device and system for an optical access module. The method comprises: a virtualization optical line terminal (vOLT) receives physical position information about an optical access module and device identification of the optical access module; the vOLT performs authentication on the optical access module according to the device identification of the optical access module; and in the case of passing the authentication of the vOLT on the optical access module, the vOLT sends management and configuration information to the optical access module corresponding to the physical position information, and the vOLT establishes a management channel with the optical access module according to the management and configuration information. The problem of impossibility of effectively performing authentication and registration on an optical access module under a virtualization structure is solved, thereby realizing discovery, authentication and registration of a vOLT on the optical access module.

Description

Authentication registration method, device and system for optical access module

Technical field

The present invention relates to the field of communications, and in particular to a method, device, and system for authenticating an optical access module.

Background technique

A point-to-multipoint (PtoMP) communication technology/system of a Passive Optical Network (PON) in an access network, and a virtualized optical line terminal involved in the virtualized optical line (virtualization optical) Line Terminal (referred to as vOLT) architecture, the method and process of optical access module authentication and registration to vOLT. The passive optical network device can be divided into an Ethernet-based passive optical network device (Ethernet Passive Optical Network, EPON for short) and a Gigabit-capable Passive Optical Network (G). -PON), 10G Gigabit-capable passive optical networks (XG-PON1), and other working mechanisms such as Next Next Passive Optical Networks (NGPON2) Passive optical network devices; these passive optical network devices have a consistent system architecture, including Optical Line Terminals (OLTs) and Optical Network Units (ONUs).

In the related art, a centralized OLT device discovers changes in the state of the PON port through power-up and loading of the integrated PON line card. Under the virtualized optical line terminal (vOLT) architecture, the discovery and management mechanism of the PON port under the traditional centralized OLT architecture is no longer applicable. Under the virtualization architecture, vOLT is the management and control center of the entire system. How to solve the authentication and registration of optical access modules has become an urgent problem to be solved.

In the related technology, under the virtualization architecture, the vOLT cannot effectively authenticate the optical access module, and no effective solution has been proposed yet.

Summary of the invention

In the related art, in the virtualized architecture, the vOLT cannot effectively register the optical access module, and the present invention provides an authentication registration method, device, and system for the optical access module, to at least solve the above problem.

According to an embodiment of the present invention, a method for authenticating an optical access module is provided, including: a virtualized optical line terminal vOLT receiving physical location information of an optical access module and a device identifier of the optical access module; The vOLT authenticates the optical access module according to the device identifier of the optical access module; if the vOLT authenticates the optical access module, the vOLT corresponds to the physical location information. The optical access module sends management configuration information, and the vOLT establishes a management channel with the optical access module according to the management configuration information.

In an embodiment of the present invention, in the case that the vOLT is authenticated by the optical access module, the vOLT sends the management configuration information to the optical access module, including at least one of: at the vOLT When the authentication of the optical access module is passed, the vOLT receives a management IP request of the optical access module, and the vOLT delivers the optical The management MAC and the management IP configured by the access module; in the case that the vOLT is authenticated by the optical access module, and the optical access module initiates 802.1x authentication, the vOLT passes the local area network The extended authentication protocol EAPoL replies to the optical access module, and the vOLT carries the management MAC and management IP of the vOLT by a type length value TLV.

In an embodiment of the present invention, the vOLT establishes a management channel with the optical access module according to the management configuration information, and includes at least one of the following: establishing, by using the management IP, the optical access module and the vOLT A channel is established between the optical access module and the vOLT through an Ethernet maintenance communication channel ETH-MCC.

In the embodiment of the present invention, the physical location information of the optical access module includes: a port number where the optical access module is located, and a slot number where the optical access module is located.

In the embodiment of the present invention, the device identifier of the optical access module includes: a MAC address of the optical access module, and a sequence number of the optical access module.

According to another embodiment of the present invention, an authentication registration method for an optical access module is provided, including: an authentication request of a first vOLT of the plurality of virtualized optical line terminals vOLT to receive an optical access module; The vOLT forwards the authentication request to the centralized authentication and authorization charging AAA server; when the AAA server authenticates the optical access module, the first vOLT sends a corresponding response to the optical access module. vOLT management configuration information.

In the embodiment of the present invention, the sending, by the first vOLT, the corresponding vOLT management configuration information to the optical access module includes: sending, by the first vOLT, an 802.1x response message to the optical access module, The response message includes: a management IP of the corresponding vOLT and a MAC of the corresponding vOLT; the first vOLT allocates a management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.

According to another embodiment of the present invention, an authentication registration method of an optical access module is further provided, including: when the access aggregation device finds that the optical access module is in place, accessing the convergence device to read Receiving the device identifier of the optical access module; the access aggregation device reporting the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT; receiving the vOLT An authentication message of the optical access module, where the vOLT authenticates the optical access module according to the device identifier of the optical access module.

In an embodiment of the present invention, in the case that the access aggregation device is a universal Ethernet switch, before the access aggregation device reads the device identifier of the optical access module, the method further includes: The access aggregation device receives the notification of the management IP and the interface information of the vOLT; the access aggregation device notifies the vOLT of the management IP and interface information of the access aggregation device; the access aggregation device and the The vOLT establishes a management control channel.

In the embodiment of the present invention, the access aggregation device advertises the management IP of the access aggregation device to the vOLT, including: a static pre-configuration management IP, and a management IP obtained by using a dynamic host configuration protocol.

In the embodiment of the present invention, the access aggregation device reads the device identifier of the optical access module, and the access aggregation device reads the device identifier of the optical access module through the two-wire serial bus I2C control bus. .

In the embodiment of the present invention, the access aggregation device reports the optical access module to the virtualized optical line terminal vOLT. The physical location information and the device identifier of the optical access module include: the access aggregation device reports the physical location information of the optical access module to the virtualized optical line terminal vOLT through the network configuration protocol NETCONF or the network management protocol SNMP. And device identification of the optical access module.

According to another embodiment of the present invention, an authentication registration device for an optical access module is provided, including: a first receiving module, configured to virtualize an optical line terminal vOLT, receive physical location information of the optical access module, and a device identifier of the optical access module; the first authentication module is configured to: the vOLT authenticates the optical access module according to the device identifier of the optical access module; and the first sending module is configured to be in the vOLT pair When the authentication of the optical access module is passed, the vOLT sends the management configuration information to the optical access module corresponding to the physical location information; and the establishing module is configured to be configured by the vOLT according to the management configuration information. The optical access module establishes a management channel.

In an embodiment of the present invention, the first sending module includes: a sending unit, configured to: when the vOLT authenticates the optical access module, the vOLT receives the optical access module The management IP request, the vOLT sends a management MAC and a management IP configured to the optical access module; and the carrying unit is configured to be in the case that the vOLT authenticates the optical access module, and In the case that the optical access module initiates the 802.1x authentication, the vOLT responds to the optical access module by using the LAN-based extended authentication protocol EAPoL, and the vOLT carries the management MAC and management IP of the vOLT by using a type length value TLV. .

In an embodiment of the present invention, the establishing module includes: a first management channel unit, configured to establish a management channel between the optical access module and the vOLT by using a management IP; and a second management channel unit, configured as a A management channel is established between the optical access module and the vOLT through the Ethernet maintenance communication channel ETH-MCC.

According to another embodiment of the present invention, an authentication registration device for an optical access module is further provided, comprising: a second receiving module, configured to receive the first vOLT in the plurality of virtualized optical line terminals vOLT An authentication request of the optical access module; the second authentication module is configured to forward the authentication request to the centralized authentication and authorization charging AAA server by the first vOLT; and the second sending module is configured to be in the AAA server When the optical access module is authenticated, the first vOLT sends the management configuration information corresponding to the vOLT to the optical access module.

In an embodiment of the present invention, the second sending module includes: a response unit, configured to send the 802.1x response message to the optical access module by the first vOLT, where the response message includes: a management IP of the corresponding vOLT And the corresponding vOLT MAC; the configuration unit is configured to allocate, by the first vOLT, the management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.

According to another embodiment of the present invention, an authentication registration device for an optical access module is further provided, comprising: a reading module, configured to find that the optical access module is in place at the access aggregation device The access aggregation device reads the device identifier of the optical access module, and the reporting module sets the access aggregation device to the virtualized optical line terminal. The vOLT reports the physical location information of the optical access module and the device identifier of the optical access module, and the third authentication module is configured to receive the authentication message of the vOLT to the optical access module, where the vOLT And authenticating the optical access module according to the device identifier of the optical access module.

In an embodiment of the present invention, in a case where the access aggregation device is a universal Ethernet switch, the device further includes: an advertisement receiving module, configured to receive, by the access aggregation device, a management IP of the vOLT An advertisement of the interface information, the notification sending module is configured to notify the vOLT of the management IP and interface information of the access aggregation device, and the management control module is configured to be the access aggregation device and the The vOLT establishes a management control channel.

According to another embodiment of the present invention, an authentication registration system for an optical access module is further provided, including: an optical access module, an access aggregation device, and a virtualized optical line terminal vOLT; the vOLT includes the foregoing device, The access aggregation device includes the above devices.

The physical location information of the optical access module and the device identifier of the optical access module are received by the virtualized optical line terminal vOLT; the vOLT authenticates the optical access module according to the device identifier of the optical access module; And the vOLT sends management configuration information to the optical access module corresponding to the physical location information, where the vOLT establishes management with the optical access module according to the management configuration information, where the vOLT is authenticated by the optical access module. The channel solves the problem that the vOLT cannot effectively authenticate and register the optical access module under the virtualization architecture, and realizes the discovery, authentication, and registration of the optical access module by the vOLT.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart 1 of an authentication registration method of an optical access module according to an embodiment of the present invention;

2 is a second flowchart of a method for authenticating an optical access module according to an embodiment of the present invention;

3 is a third flowchart of an authentication registration method of an optical access module according to an embodiment of the present invention;

4 is a structural block diagram 1 of an authentication registration apparatus of an optical access module according to an embodiment of the present invention;

FIG. 5 is a structural block diagram 2 of an authentication and registration device of an optical access module according to an embodiment of the present invention; FIG.

6 is a structural block diagram 3 of an authentication registration apparatus of an optical access module according to an embodiment of the present invention;

7 is a schematic diagram of a network architecture of a virtual access network in accordance with a preferred implementation of the present invention;

8 is a flow chart showing the authentication and registration of an optical access module on a general-purpose Ethernet switch (access aggregation device B) according to a preferred implementation of the present invention;

9 is a flow chart showing the authentication and registration on a network card port of a general-purpose server (access aggregation device A) according to a preferred embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

In this embodiment, an authentication registration method for an optical access module is provided. FIG. 1 is a flowchart 1 of an authentication registration method of an optical access module according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps. step:

Step S102: The virtualized optical line terminal vOLT receives the physical location information of the optical access module and the device identifier of the optical access module.

Step S104: The vOLT authenticates the optical access module according to the device identifier of the optical access module.

Step S106, in the case that the vOLT is authenticated by the optical access module, the vOLT sends management configuration information to the optical access module corresponding to the physical location information, and the vOLT is configured according to the management configuration information and the optical access module. Establish a management channel.

Through the above steps, the virtualized optical line terminal vOLT receives the physical location information of the optical access module and the device identifier of the optical access module, and the vOLT authenticates the optical access module according to the device identifier, and accesses the optical access at the vOLT. When the authentication of the module is passed, the vOLT establishes a management channel with the optical access module according to the management configuration information, and solves the problem that the vOLT cannot effectively register the optical access module by using the above authentication registration mode, and implements the vOLT pair. Discovery, authentication and registration of optical access modules.

In this embodiment, the vOLT may send the management configuration information to the optical access module in multiple manners, where the vOLT receives the optical interface in the case that the vOLT passes the authentication of the optical access module. The management IP address of the incoming module, the vOLT sends a management MAC and a management IP configured for the optical access module; if the vOLT authenticates the optical access module, and the optical access module initiates 802.1x In the case of the authentication, the vOLT answers the optical access module through the LAN-based extended authentication protocol EAPoL, and the vOLT carries the management MAC and the management IP of the vOLT through the type length value TLV.

In this embodiment, the vOLT establishes a management channel with the optical access module according to the management configuration information, and the method includes: establishing, by the management module, the management channel between the optical access module and the vOLT; A management channel is established between the optical access module and the vOLT through the Ethernet maintenance communication channel ETH-MCC.

In the embodiment of the present invention, the physical location information of the optical access module includes: a port number where the optical access module is located, and a slot number where the optical access module is located. The device identifier of the optical access module includes: a MAC address of the optical access module, and a serial number of the optical access module.

In this embodiment, an interface processing method is provided. FIG. 2 is a flowchart 2 of an authentication registration method of an optical access module according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:

Step S202, the first vOLT of the plurality of virtualized optical line terminals vOLT receives the authentication request of the optical access module;

Step S204, the first vOLT forwards the authentication request to the centralized authentication and authorization charging AAA server;

Step S206: When the AAA server authenticates the optical access module, the first vOLT sends the management configuration information corresponding to the vOLT to the optical access module.

Through the above steps, the first vOLT of the plurality of virtualized optical line terminals vOLT receives the authentication request of the optical access module, and the first vOLT forwards the authentication request to the centralized authentication and authorization accounting server (Authentication, Authorization and Accounting, for short AAA), in the case that the AAA server authenticates the optical access module, the first vOLT sends the management configuration information corresponding to the vOLT to the optical access module. In the foregoing embodiment, the optical access module In the case of accessing multiple vOLTs, the vOLT becomes a proxy server, which completes the cross-vOLT authentication of the optical access module, and solves the problem that the vOLT cannot effectively authenticate the optical access module, and implements the vOLT optical access module. Discovery, certification and registration.

In this embodiment, the first vOLT sends the corresponding vOLT management configuration information to the optical access module in multiple manners, where the method includes: the first vOLT sends an 802.1x response message to the optical access module, The response message includes: a management IP of the corresponding vOLT and a MAC of the corresponding vOLT; the first vOLT allocates a management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.

In this embodiment, an interface processing method is provided. FIG. 3 is a flowchart 3 of an authentication registration method of an optical access module according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:

Step S302, the access aggregation device reads the device identifier of the optical access module when the access aggregation device finds that the optical access module is in place;

Step S304, the access aggregation device reports the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT.

Step S306: Receive an authentication message of the vOLT to the optical access module, where the vOLT authenticates the optical access module according to the device identifier of the optical access module.

After the above steps are performed, the access aggregation device uploads the authentication information of the optical access module to the vOLT. After the optical access module authenticates the optical access module, the vOLT receives the authentication message from the vOLT to the optical access module, thereby solving the problem that the vOLT cannot effectively provide light. The access module performs authentication and registration, and realizes the discovery, authentication, and registration of the optical access module by the vOLT.

In this embodiment, in the case that the access aggregation device is a universal Ethernet switch, the access aggregation device receives the management IP address of the vOLT before the access aggregation device reads the device identifier of the optical access module. The interface information is advertised to the vOLT to advertise the management IP and interface information of the access aggregation device; the access aggregation device establishes a management control channel with the vOLT. The IP address of the access aggregation device that the access aggregation device advertises to the vOLT may include: a static pre-configuration management IP, and a management IP obtained by using a dynamic host configuration protocol. Thus the access aggregation device

In the above embodiment, the access aggregation device reads the device identification of the optical access module through the two-wire serial bus I2C control bus. The access aggregation device virtualizes the light through the network configuration protocol NETCONF or the network management protocol SNMP The line terminal vOLT reports the physical location information of the optical access module and the device identifier of the optical access module.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of various embodiments of the present invention.

In this embodiment, an authentication registration device for an optical access module is further provided, and the device is located in the terminal. The device is used to implement the above embodiments and preferred embodiments, and the description thereof has been omitted. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 4 is a structural block diagram 1 of an authentication registration apparatus of an optical access module according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes:

The first receiving module 42 is configured to receive the physical location information of the optical access module and the device identifier of the optical access module by the virtualized optical line terminal vOLT;

The first authentication module 44 is configured to: the vOLT authenticates the optical access module according to the device identifier of the optical access module;

The first sending module 46 is configured to send, by the vOLT, the management configuration information to the optical access module corresponding to the physical location information, in the case that the vOLT is authenticated by the optical access module;

The establishing module 48 is configured to establish, by the vOLT, a management channel with the optical access module according to the management configuration information.

In this embodiment, the first sending module 46 may include:

a sending unit, configured to receive a management IP request of the optical access module, where the vOLT receives a management IP request of the optical access module, where the vOLT sends a management MAC and a configuration of the optical access module Management IP;

The portable unit is configured to answer the optical access by using the extended authentication protocol EAPoL based on the local area network, in the case that the vOLT passes the authentication of the optical access module, and the optical access module initiates the 802.1x authentication. The module, the vOLT carries the management MAC and the management IP of the vOLT by the type length value TLV.

In this embodiment, the establishing module 48 includes: a first management channel unit, configured to establish a management channel between the optical access module and the vOLT through management IP; and a second management channel unit, configured as the optical access module A management channel is established between the vOLT and the vOLT through the Ethernet maintenance communication channel ETH-MCC.

5 is a structural block diagram 2 of an authentication and registration device of an optical access module according to an embodiment of the present invention. As shown in FIG. 5, the device includes:

The second receiving module 52 is configured to receive the optical access module by the first vOLT in the plurality of virtualized optical line terminals vOLT Authentication request;

The second authentication module 54 is configured to forward the authentication request to the centralized authentication and authorization charging AAA server by the first vOLT;

The second sending module 56 is configured to send, when the AAA server authenticates the optical access module, the first vOLT sends the management configuration information corresponding to the vOLT to the optical access module.

In this embodiment, the second sending module 56 may include:

The response unit is configured to send the 802.1x response message to the optical access module, where the response message includes: a management IP of the corresponding vOLT and a MAC of the corresponding vOLT;

The configuration unit is configured to allocate, by the first vOLT, the management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.

FIG. 6 is a structural block diagram 3 of an authentication and registration device of an optical access module according to an embodiment of the present invention. As shown in FIG. 6, the device includes:

The reading module 62 is configured to: when the access aggregation device finds that the optical access module is in place, the access aggregation device reads the device identifier of the optical access module;

The reporting module 64 is configured to report, by the access aggregation device, the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT;

The third authentication module 66 is configured to receive the authentication message of the vOLT to the optical access module, where the vOLT authenticates the optical access module according to the device identifier of the optical access module.

In this embodiment, in the case that the access aggregation device is a universal Ethernet switch, the device further includes: an advertisement receiving module, configured to receive, by the access aggregation device, a management IP and interface information of the vOLT; The sending module is configured to notify the vOLT of the management IP and interface information of the access aggregation device, and the management control module is configured to establish a management control channel between the access aggregation device and the vOLT.

In this embodiment, an authentication registration system for an optical access module is further provided, including: an optical access module, an access aggregation device, and a virtualized optical line terminal vOLT; the vOLT includes the device in the foregoing embodiment; The incoming convergence device includes the apparatus of the above embodiment.

The invention will now be described in detail in conjunction with the preferred embodiments and embodiments.

FIG. 7 is a schematic diagram of a network architecture of a virtual access network according to a preferred implementation of the present invention. As shown in FIG. 7, the network is composed of a network cloud platform, access aggregation devices A and B, and user-side network terminals. The network cloud platform can use a common data infrastructure such as an Internet Data Center (IDC) or a data center. The access aggregation devices A and B remotely connect to the network cloud platform through the metropolitan area network. Access aggregation device A includes the capabilities of the general server's IT infrastructure, so the network function virtualization module can be distributed on the access aggregation device A and the network cloud platform as needed, such as vOLT, virtual broadband network gateway control device (virtualization Broadband) Network Gateway, referred to as vBNG), virtual communication Functional modules such as the Control Communications Control Application (vCCAP) and the Virtualization Custom Premise Equipment (vCPE) can be flexibly deployed to the virtual machines in the access aggregation device A and the network cloud platform. Run on. The access aggregation device B uses a universal Ethernet switch and does not have the capability of loading a virtual machine. It needs to rely on the network function virtualization function provided by the access aggregation device A to assist the work. The access aggregation device B supports the OpenFlow protocol and is controlled by a Software Defined Network (SDN) controller in the aggregation device A. Access aggregation devices A and B provide standard Ethernet interfaces, such as the 10G network port of the Institute of Electrical and Electronics Engineers (IEEE), or multi-source agreement (Multi-Source Agreement). Standard Small Form-Factor Pluggable (SFP+) slots for MSA). These interfaces connect optical access modules to the user side. The optical access module performs the medium conversion function of the PON to Ethernet data message.

The preferred embodiment provides automatic discovery of the optical access module through the vOLT under the virtualized optical line terminal (vOLT) architecture, and authenticates and registers them to realize plug and play. The optical access module may be an SFP physical package optical module that resides on a universal Ethernet switch (access aggregation device B) or a general-purpose server (access aggregation device A) network card port where the vOLT is located.

In the preferred implementation, the method for the vOLT to automatically discover, authenticate, and register the optical access module includes the following steps:

In the first step, after the optical access module is inserted into the access aggregation device A or B, the access aggregation device finds that the optical access module is in place.

In the second step, the access aggregation device A or B reads the management MAC address and serial number (as the device identifier) of the optical access module through the I2C control bus.

In the third step, the access aggregation device A or B reports the optical access module by using a Network Configuration Protocol (NETCONF) or a Simple Network Management Protocol (SNMP) trap. The physical location information of the port and the slot and the physical address (Media Access Control, MAC) and serial number of the optical access module are reported to the vOLT. The vOLT checks the serial number of the optical access module to check whether it is a resource managed by itself. If it is authenticated (or the optical access module is required to further initiate 802.1x authentication).

In the fourth step, the vOLT tells the access aggregation device A or B (Authenticator) to pass the authentication. When the subsequent optical access module requests the management IP through the Dynamic Host Configuration Protocol (DHCP), the configuration is delivered. The parameter includes the MAC and IP of the vOLT. (If the optical access module is required to further initiate 802.1x authentication, the vOLT can be in the Extensible Authentication Protocol OVER LAN (EAPOL) response to the optical access module. The vMAC management MAC and IP can also be carried by the type-length-value (TLV).

At this point, the topology discovery between the optical access module and the vOLT is completed. The optical access module and the vOLT can establish a management channel by using the management IP, or can also use a layer 2 connection, such as the Ethernet maintenance communication channel of the Y.1731 (Ethernet maintenance). The communication channel (referred to as ETH-MCC) establishes a management channel, and the optical access module directly accepts the management and control of the vOLT. The authentication and registration of the optical access module is completed.

Through the above preferred embodiment, the optical access module is automatically discovered, authenticated, and registered to implement the optical access module. Plug and play, in line with the need for network operators to automate and simplify network configuration and operation and maintenance under the access network virtualization architecture.

In another embodiment, the optical access module on the universal Ethernet switch (accessing the aggregation device B) is summarized in the preferred embodiment, and one vOLT instance represents a certain management domain, in order to let the vOLT know its own management boundary. The operator should first assign all the resource identifiers that the vOLT needs to manage to the vOLT through the human-computer interaction interface. This can be defined by the data model such as the SNMP Management Information Base (MIB) or the YANG language. In this solution, the binding relationship between the optical access module and the vOLT is software definable.

8 is a flow chart showing the authentication and registration of an optical access module on a general-purpose Ethernet switch (access aggregation device B) according to a preferred embodiment of the present invention, as shown in FIG.

In step S802, the vOLT control virtual switch (vSwitch) in the access aggregation device A advertises its management IP address to the access aggregation device B through the Link Layer Discovery Protocol (LLDP) protocol.

Step S804, after the access aggregation device B is powered on, the LLDP advertises its own management IP to the vOLT. The management IP address can be statically pre-configured or obtained through a DHCP client.

The topology discovery is performed between the aggregation device B and the vOLT. The aggregation device B registers with the vOLT authentication and accepts the vOLT control with the vOLT as the virtual network controller. In the authentication, the Chassis ID (such as the bridge MAC address) of the LLDP of the two parties is used as one of the authentication factors, and the vOLT and the access aggregation device B are uniquely identified. The vOLT and the access aggregation device B complete the mutual discovery. The vOLT can establish a management control channel to the access aggregation device B, and then perform management control on the access aggregation device B through the NetConf protocol/OpenFlow protocol.

Step S806, after the optical access module is inserted into the access aggregation device B, the access aggregation device B finds that the optical access module is in place.

Step S808, the access aggregation device B reads the management MAC address and the serial number (as the device identifier) of the optical access module through the I2C control bus.

In step S810, the access aggregation device B reports the physical location information such as the port and the slot where the optical access module is located, and the MAC address and serial number of the optical access module, and reports the vOLT to the vOLT. The vOLT checks the serial number of the optical access module to check whether it is a resource managed by itself. If yes, the optical access module is required to initiate 802.1x authentication.

Step S812, the optical access module (suppliant) initiates the authentication of the 802.1x EAPoL to the vOLT authentication server (Authentication Server).

Step S814, the vOLT tells the access aggregation device B (Authenticator) that the optical access module passes the authentication, and the vOLT can carry the management MAC and IP of the vOLT through the extended TLV in the EAPoL response to the optical access module, or in the subsequent light. When the access module manages the IP address through DHCP, the configuration parameters are delivered including the MAC and IP of the vOLT.

The topology discovery is completed between the optical access module and the vOLT, and the vOLT is controlled by the vOLT as a virtual network controller. The management module can be used to establish a management channel between the access module and the vOLT, or a Layer 2 connection, such as the ETH-MCC of the Y.1731.

In this embodiment, the topology discovery is performed between the optical access module and the vOLT. The optical access module and the vOLT can establish a management channel by using the management IP, or can be connected by using a layer 2, such as the ETH-MCC of the Y.1731. Management channel, the optical access module directly accepts the management and control of the vOLT.

The optical access module obtains the authorization of the vOLT, accepts the authentication registration of the ONT to the vOLT, completes the topology discovery between the ONT and the vOLT, and the management channel between the access module and the ONT follows the existing methods such as OMCC.

The above embodiment illustrates that one aggregation access network is one management domain and only one vOLT. When there are multiple management domains, that is, multiple vOLT instances exist, the authentication of the optical access module can be centralized authentication across the vOLT. At this time, the first vOLT acts as a proxy server (Radius Proxy), and the optical access module is authenticated. The request is forwarded to the centralized AAA (Authentication, Authorization, Accounting) server. After the authentication is passed, the content of the response message is extended by the 802.1x, or when the DHCP assigns the optical access module to manage the IP. The configuration is delivered, the management IP and MAC of the corresponding vOLT are rewritten, and the optical access module is reset to register with the correct vOLT.

9 is a flow chart showing the process of authentication and registration on a network card port of a general-purpose server (access aggregation device A) according to a preferred embodiment of the present invention, as shown in FIG. Including the following steps:

Step S902: After the optical access module is inserted into the NIC port of the general-purpose server (accessing the aggregation device A), the access aggregation device A finds that the optical access module is in place.

Step S904, the access aggregation device A reads the management MAC address and serial number (as the device identifier) of the optical access module through the I2C control bus.

In step S906, the access aggregation device A reports the physical location information such as the port where the optical access module is located, and the MAC address and serial number of the optical access module, and reports the vOLT to the vOLT. The vOLT checks the serial number of the optical access module to check whether it is a resource managed by itself. If yes, the optical access module is required to initiate 802.1x authentication.

Step S908, the optical access module (suppliant) initiates authentication of the 802.1x EAPoL to the vOLT (Authentication Server)

In step S910, the vOLT tells the access aggregation device A (Authenticator) that the optical access module passes the authentication, and the vOLT can carry the management MAC address and IP of the vOLT through the extended TLV in the EAPoL response to the optical access module, or in the subsequent light. When the access module manages the IP address through DHCP, the configuration parameters are delivered including the MAC and IP of the vOLT.

In this embodiment, the topology discovery is performed between the optical access module and the vOLT, and a Layer 3 or Layer 2 management channel is established between the optical access module and the vOLT, and the optical access module directly accepts management and control of the vOLT.

In step S912, the optical access module obtains the authorization of the vOLT, accepts the authentication registration of the ONT to the vOLT, completes the topology discovery between the ONT and the vOLT, and the management channel between the access module and the ONT follows the existing methods such as OMCC.

Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be used with general calculations. The devices are implemented, they may be centralized on a single computing device, or distributed over a network of multiple computing devices, optionally they may be implemented in program code executable by the computing device, such that they may be stored Executed by the computing device in a storage device, and in some cases, the steps shown or described may be performed in an order different than that herein, or separately fabricated into individual integrated circuit modules, or Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

Based on the foregoing technical solution provided by the embodiment of the present invention, the virtualized optical line terminal vOLT receives the physical location information of the optical access module and the device identifier of the optical access module; the vOLT uses the device according to the device identifier of the optical access module. The access module performs authentication. When the vOLT passes the authentication of the optical access module, the vOLT sends management configuration information to the optical access module corresponding to the physical location information, where the vOLT is configured according to the management configuration information. The optical access module establishes a management channel, which solves the problem that the vOLT cannot effectively register and register the optical access module under the virtualization architecture, and realizes the discovery, authentication, and registration of the optical access module by the vOLT.

Claims

An authentication registration method for an optical access module includes:

The virtualized optical line terminal vOLT receives the physical location information of the optical access module and the device identifier of the optical access module;

The vOLT authenticates the optical access module according to the device identifier of the optical access module;

And the vOLT sends the management configuration information to the optical access module corresponding to the physical location information, where the vOLT is configured according to the management configuration information, in the case that the vOLT is authenticated by the optical access module. The optical access module establishes a management channel.
The method according to claim 1, wherein, in the case that the vOLT is authenticated by the optical access module, the vOLT sending the management configuration information to the optical access module comprises at least one of the following:

And the vOLT receives the management IP request of the optical access module, where the vOLT sends a management media connection configured to the optical access module, where the vOLT is authenticated by the optical access module. Incoming control MAC and management IP;

In the case that the vOLT is authenticated by the optical access module, and the optical access module initiates 802.1x authentication, the vOLT answers the optical access by using a LAN-based extended authentication protocol EAPoL. And the vOLT carries the management MAC and the management IP of the vOLT by using a type length value TLV.
The method according to claim 1, wherein the vOLT establishes a management channel with the optical access module according to the management configuration information, including at least one of the following:

Establishing a management channel between the optical access module and the vOLT through management IP;

A management channel is established between the optical access module and the vOLT through an Ethernet maintenance communication channel ETH-MCC.
The method according to any one of claims 1 to 3, wherein the physical location information of the optical access module comprises: a port number where the optical access module is located, and a slot number where the optical access module is located. .
The device according to any one of claims 1 to 3, wherein the device identifier of the optical access module comprises: a MAC address of the optical access module, and a sequence number of the optical access module.
An authentication registration method for an optical access module includes:

The first vOLT of the plurality of virtualized optical line terminals vOLT receives the authentication request of the optical access module;

Transmitting, by the first vOLT, the authentication request to a centralized authentication and authorization charging AAA server;

When the AAA server authenticates the optical access module, the first vOLT sends the management configuration information corresponding to the vOLT to the optical access module.
The method of claim 6, wherein the sending, by the first vOLT, the corresponding vOLT management configuration information to the optical access module comprises:

The first vOLT sends an 802.1x response message to the optical access module, where the response message includes: a management IP of the corresponding vOLT and a MAC of the corresponding vOLT;

The first vOLT allocates a management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.
An authentication registration method for an optical access module includes:

When the access aggregation device finds that the optical access module is in place, the access aggregation device reads the device identifier of the optical access module;

The access aggregation device reports the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT;

Receiving an authentication message of the vOLT to the optical access module, where the vOLT authenticates the optical access module according to the device identifier of the optical access module.
The method according to claim 8, wherein, in the case that the access aggregation device is a general-purpose Ethernet switch, before the access aggregation device reads the device identifier of the optical access module, the method further includes :

The access aggregation device receives an advertisement of the management IP and interface information of the vOLT;

The access aggregation device notifies the vOLT of the management IP and interface information of the access aggregation device;

The access aggregation device establishes a management control channel with the vOLT.
The method of claim 9, wherein the accessing the aggregation device to notify the vOLT of the management IP of the access aggregation device comprises:

Static pre-configuration management IP and management IP obtained through dynamic host configuration protocol.
The method according to claim 8, wherein the access aggregation device reads the device identifier of the optical access module, comprising: the access aggregation device reads the optical access module through the two-wire serial bus I2C control bus Device identification.
The method of claim 8, wherein the accessing the aggregation device to report the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT comprises:

The access aggregation device reports the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT through the network configuration protocol NETCONF or the network management protocol SNMP.
The method according to any one of claims 8 to 10, wherein the physical location information of the optical access module comprises: a port number where the optical access module is located, and a slot number where the optical access module is located. .
The method according to any one of claims 8 to 10, wherein the device identifier of the optical access module comprises: a MAC address of the optical access module, and a sequence number of the optical access module.
An authentication and registration device for an optical access module is applied to a virtualized optical line terminal vOLT, including:

a first receiving module, configured to receive physical location information of the optical access module and a device identifier of the optical access module;

The first authentication module is configured to authenticate the optical access module according to the device identifier of the optical access module;

The first sending module is configured to send the management configuration information to the optical access module corresponding to the physical location information, if the vOLT passes the authentication of the optical access module;

And establishing a module, where the vOLT establishes a management channel with the optical access module according to the management configuration information.
The apparatus of claim 15, wherein the first transmitting module comprises:

a sending unit, configured to: when the vOLT authenticates the optical access module, the vOLT receives a management IP request of the optical access module, where the vOLT sends the optical access Management MAC and management IP of the module configuration;

a carrying unit, configured to: when the vOLT authenticates the optical access module, and the optical access module initiates 802.1x authentication, the vOLT responds by using a local area network-based extended authentication protocol EAPoL The optical access module, the vOLT carries a management MAC and a management IP of the vOLT by using a type length value TLV.
The apparatus of claim 15 wherein said establishing module comprises:

a first management channel unit, configured to establish a management channel between the optical access module and the vOLT by using a management IP;

The second management channel unit is configured to establish a management channel between the optical access module and the vOLT through an Ethernet maintenance communication channel ETH-MCC.
An authentication registration device for an optical access module, comprising:

a second receiving module, configured to receive, by the first vOLT of the plurality of virtualized optical line terminals vOLT, an authentication request of the optical access module;

a second authentication module, configured to forward, by the first vOLT, the authentication request to a centralized authentication and authorization charging AAA server;

The second sending module is configured to send, when the AAA server authenticates the optical access module, the first vOLT sends the management configuration information of the corresponding vOLT to the optical access module.
The apparatus of claim 18, wherein the second transmitting module comprises:

The response unit is configured to send an 802.1x response message to the optical access module, where the response message includes: a management IP of the corresponding vOLT and a MAC of the corresponding vOLT;

The configuration unit is configured to allocate, by the first vOLT, the management IP of the vOLT corresponding to the optical access module by using a dynamic host configuration protocol subsequent protocol.
An authentication registration device for an optical access module, comprising:

a reading module, configured to: when the access aggregation device finds that the optical access module is in place, the access aggregation device reads the device identifier of the optical access module;

The reporting module is configured to report, by the access aggregation device, the physical location information of the optical access module and the device identifier of the optical access module to the virtualized optical line terminal vOLT;

The third authentication module is configured to receive the authentication message of the vOLT to the optical access module, where the vOLT authenticates the optical access module according to the device identifier of the optical access module.
The device of claim 20, wherein, in the case that the access aggregation device is a universal Ethernet switch, the device further comprises:

An advertisement receiving module, configured to receive, by the access aggregation device, an advertisement of the management IP and interface information of the vOLT;

An advertisement sending module, configured to notify, by the access aggregation device, the management IP and interface information of the access aggregation device to the vOLT;

The management control module is configured to establish a management control channel between the access aggregation device and the vOLT.
An authentication registration system for an optical access module, comprising: an optical access module, an access aggregation device, and a virtualized optical line terminal vOLT;

The vOLT includes the apparatus of any one of claims 14 to 18;

The access aggregation device includes the device of any one of claims 19 or 20.