CN116684768A - A management method for secure cloud OLT equipment - Google Patents

Abstract

The invention discloses a management method of a security cloud OLT device, which relates to the field of device management. The specific management method of the security cloud OLT device is as follows: S1, the OLT device sends an encrypted discovery message; S2, the client receives the OLT device After discovering the message, decrypt the discovery message; the management method of the security cloud OLT device sends an encrypted discovery message through the OLT device, and after the client receives the discovery message of the OLT device, it decrypts the discovery message, which can ensure access to the client The devices at the end are all allowed devices, so as to prevent the connected devices from causing system damage due to unauthorized devices. By checking whether the MAC address of the device is bound by the user, the waste of resources caused by sending empty devices can be avoided. By generating The passing tunnel can be used for users to access the OLT equipment, and by setting the inspection function of the overlapping area of adjacent passing tunnels, the signal passing rate of adjacent passing tunnels can be guaranteed and signal interference can be avoided.

Description

A management method for secure cloud OLT equipment

technical field

The present invention relates to equipment management technology, in particular to a management method for secure cloud OLT equipment.

Background technique

Under the optical fiber access network architecture, there are a large number of optical network units or optical network terminal equipment in the access network. For the convenience of description, they are collectively referred to as optical network units ONU. The line terminal manages the ONU as an agent through the operation management and maintenance or ONT management control interface.

The specific implementation of this solution is as follows: OLT releases a unified public network management IP address to the outside, and can access the ONU carried by the OLT through the public network management IP address and perform simple management protocol management on it. The network management IP address sends an SNMP message to access the ONU. The SNMP message carries the frame number/slot number/port optical network terminal identification information of the OLT. The OLT receives the SNMP message forwarded through the public network and obtains the SNMP message. OLT/box/slot/port/ONTID information in the system, and convert SNMP messages into OAM/OMCI messages (OAM is used in EPON systems, and OMCI is used in GPON systems), and sent through the passive optical network line management channel to the corresponding ONU device.

When the existing OLT equipment is in use, it is extremely difficult to troubleshoot the OLT that is continuously sinking on the access network side. At the same time, when the existing OLT equipment is networked, there is mutual interference between two adjacent communication lines.

Contents of the invention

The purpose of the present invention is to provide a management method for a secure cloud OLT device, so as to solve the above-mentioned deficiencies in the prior art.

In order to achieve the above object, the present invention provides the following technical solutions: a management method of a secure cloud OLT device, the specific management method of the secure cloud OLT device is:

S1, the OLT device sends an encrypted discovery message;

S2, the client decrypts the discovery message after receiving the discovery message from the OLT device;

S3, checking whether the MAC address of the device is bound by the user, if the result of the check is that the MAC address is not bound by the user, discarding the message sent in S1;

S4, if the check result of step S3 is that the MAC address is bound by the user equipment, perform key negotiation;

S5, if the key negotiation in step S4 is passed, dynamically generate a pass-through tunnel, and the generated pass-through tunnel can be used for the user to access the OLT device.

Further, the specific manner of encrypting the message of the OLT device is:

A1, after the client scans the message to be encrypted, it will pass the message path of the original message and the new message to the message filter driver, and the message filter driver will call a custom function StaticFileEncrypt for processing;

A2, call the IoCreatFile function to open the original message, obtain the message handle, and call the rdbuf function to obtain the byte stream of the message;

A3. The client invokes the key generation function to generate a symmetric encryption key for message encryption, and uses the public key to complete asymmetric encryption and then passes it to the message filter driver. The message filter driver combines this key with other information to construct an encryption identifier And write the head of the byte stream;

A4. Redirect the byte stream to a new message, that is, write the original message content into the new message. During this process, the IRP_MJ_WRITE message of the IO manager is triggered. After the message filter driver intercepts it, it enters the PreWrite callback routine , first preprocess the IRP, and filter out the IRP that does not meet the encryption conditions;

A5, obtain the buffer where the data to be encrypted is located through the iopb in the callback information;

A6. Obtain the encryption and decryption key in ciphertext form from the EncryptKey parameter of the encryption identifier, and use the private key to perform asymmetric decryption to obtain the key in plaintext form;

A7, call the ExAllocatePoolWithTag function to apply for a data buffer with a length of iopb->Parameters.Write.Length in the kernel space;

A8, calling the RtlCopyMemory function to copy the data in the buffer obtained in step A2 to the newly applied buffer;

A9, through the File_EncryptBuffer function, use the AES encryption algorithm and key to encrypt the data in the buffer.

Further, the specific method for decrypting the message in the cloud is as follows:

B1, enter the PreWrite callback routine, first preprocess the IRP, and filter out the IRP that does not meet the decryption conditions;

B2. The IRP that meets the decryption conditions will be sent to the message system driver. When the message system driver reads the ciphertext data of the message and returns the request to the IO manager, the message filter driver intercepts the request and enters the PostRead callback example Procedure;

B3, obtain the buffer of the data to be decrypted and processed through iopb in the callback information, and obtain the buffer in two ways to determine whether iopb->Parameters.Read.MdlAddress is empty;

B4, get the data length of the message, judge whether the data length is 0 through Data->IoStatus.Information, if the read data length is 0, do not perform any processing, and return the request to the I/O manager;

B5, obtaining the decryption identifier of the message, analyzing the decryption identifier, and determining whether the message needs to be decrypted according to the flag in the identifier;

B6. Obtain the encryption and decryption key in ciphertext form from the EncryptKey parameter of the decryption identifier, and use the private key to perform asymmetric decryption to obtain the key in plaintext form;

B7, call the ExAllocatePoolWithTag function to apply for a data buffer with a length of iopb->Parameters.Read.Length in the kernel space;

B8, through the File_EncryptBuffer function, use the AES decryption algorithm and key to decrypt the data in the original buffer and put it into the new buffer;

B9, copy the message text data in the kernel buffer to the buffer of the monitoring layer space;

B10, release the memory space for storing the key in plain text form, and release the buffer for storing plain text data of the message, complete the PostRead callback routine, return the request, and the decryption process ends.

Further, the preparation steps for key agreement are as follows:

C1, public key generation:

Determine the security parameter l, select the cyclic group G, where the order of G is a large prime number q, and the generator is P, where q>2 ^l , the receiver selects the private key s∈Z _q ^* , calculates P _pub =sP, and selects the hash Function H ₁ ; {0, 1} ^LU × G ² → Z _q ^* , H ₂ ; {0, 1} ^LU × {0, 1} ^LU × G ² → Z _q ^* , H ₃ ; {0, 1} ^LU ×{0, 1} ^LU ×G ⁵ →{0, 1} ^K , where _LU is the number of digits of the identity, set the MAC address as user A, and the user device as user B;

C2, node registration:

1. Secret value generation: User A selects X _A ∈ Z _q ^* , and calculates X _A = x _A P:

2. Partial private key generation; A sends X _A and ID _A to the receiving end through a secure channel, and the receiving end selects a random number r _A ∈ Z _q ^*, calculates R _A =r _A P, and generates the user's partial private key D _A = sH ₁ (ID _A , _RA , X _A )+r _A , the system sends DA, _RA to user _A , where _DA is sent by the secure channel, and _RA is sent by the public channel:

3. Verify the validity of part of the private key: pass D _A P ⁿ = R _A + H ₁ (ID _A , R _A , X _A ) P _pub ;

C3. After the node registration is completed, the complete public key of node A is composed of <X _A , R _A >, and the complete private key is composed of <x _A , D _A >.

Further, the specific way of performing key agreement is as follows:

D1. User A chooses a random temporary private key a∈Z _q ^* , calculates T _A =aP, signs g _A =a+H ₂ (ID _A , ID _B , X _B , T _A ), sends g _A , ID _A , R _A , T _A , X _A to user B;

D2, verify whether the equation of g _A P ⁿ = T _A + H ₂ (ID _A , ID _B , X _B , T _A ) (R _A +H ₁ (ID _A , R _A , X _A ) P _pub ) is established;

D3. If the equation in step D2 holds, the key negotiation is passed.

Further, the generation method of the tunnel is as follows:

E1, calculate the received power through the tunnel, the specific calculation formula is as follows:

,

Among them, P _r and _Pi represent the received and transmitted power through the tunnel, Gi is the signal gain, Gr is the loss of the signal on the radius, and l is the distance between the side wall of the passageway and the signal;

E2, calculate the distance l _r between two adjacent passageways, the specific calculation formula is as follows:

;

E3. Calculate the half-central angle θ between the intersection point of the intersection passing through the tunnel and the center of the signal circle. The specific calculation formula is as follows:

;

E4, calculate the fan-shaped area on one side, the specific calculation formula is as follows:

;

E5. Calculate the overlapping area of adjacent passing tunnels on the same plane. The specific calculation formula is as follows:

.

Compared with the prior art, the present invention provides a management method for a secure cloud OLT device, which sends an encrypted discovery message through the OLT device, and after the client receives the discovery message of the OLT device, it decrypts the discovery message, which can ensure the connection The devices that enter the client are all allowed devices, to avoid system damage caused by unapproved devices. By checking whether the MAC address of the device is bound by the user, it is possible to avoid the waste of resources caused by sending empty devices. The generated passing tunnel can be used for users to access the OLT equipment, and at the same time, by setting the inspection function of the overlapping area of adjacent passing tunnels, the signal passing rate of adjacent passing tunnels can be guaranteed to avoid signal interference.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings that are required in the embodiments. Obviously, the accompanying drawings in the following description are only described in the present invention For some embodiments of the present invention, those skilled in the art can also obtain other drawings according to these drawings.

FIG. 1 is a schematic diagram of the overall process structure provided by the embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings.

Please refer to Figure 1, a management method for a secure cloud OLT device, the specific management method for a secure cloud OLT device is:

S1, the OLT device sends an encrypted discovery message;

S2, the client decrypts the discovery message after receiving the discovery message from the OLT device;

S3, checking whether the MAC address of the device is bound by the user, if the result of the check is that the MAC address is not bound by the user, discarding the message sent in S1;

S4, if the check result of step S3 is that the MAC address is bound by the user equipment, perform key negotiation;

S5, if the key negotiation in step S4 is passed, dynamically generate a pass-through tunnel, and the generated pass-through tunnel can be used for the user to access the OLT device.

The specific management method of setting up the security cloud OLT device in this way is to send an encrypted discovery message through the OLT device. After receiving the discovery message from the OLT device, the client decrypts the discovery message. This setting can ensure that all devices connected to the client are allowed. To prevent the access device from causing system damage due to an unauthorized device, check whether the MAC address of the device is bound by the user. If the result of the check is that the MAC address is not bound by the user, the sent message will be discarded. The result of the check is that the MAC address is bound by the user device. This setting can ensure that all OLT devices are bound by the user, and avoid resource waste caused by sending empty devices. Then, the key negotiation will be performed. If the key negotiation passes , the tunnel is dynamically generated, and the generated tunnel can be used for users to access the OLT device. At the same time, by setting the inspection function of the overlapping area of adjacent tunnels, the signal passing rate of adjacent tunnels can be guaranteed to avoid signal interference.

The specific method for the OLT device to encrypt packets is as follows:

A1, after the client scans the message to be encrypted, it will pass the message path of the original message and the new message to the message filter driver, and the message filter driver will call a custom function StaticFileEncrypt for processing;

A2, call the IoCreatFile function to open the original message, obtain the message handle, and call the rdbuf function to obtain the byte stream of the message;

A3. The client invokes the key generation function to generate a symmetric encryption key for message encryption, and uses the public key to complete asymmetric encryption and then passes it to the message filter driver. The message filter driver combines this key with other information to construct an encryption identifier And write the head of the byte stream;

A4. Redirect the byte stream to a new message, that is, write the original message content into the new message. During this process, the IRP_MJ_WRITE message of the IO manager is triggered. After the message filter driver intercepts it, it enters the PreWrite callback routine , first preprocess the IRP, and filter out the IRP that does not meet the encryption conditions;

A5, obtain the buffer where the data to be encrypted is located through the iopb in the callback information;

A6. Obtain the encryption and decryption key in ciphertext form from the EncryptKey parameter of the encryption identifier, and use the private key to perform asymmetric decryption to obtain the key in plaintext form;

A7, call the ExAllocatePoolWithTag function to apply for a data buffer with a length of iopb->Parameters.Write.Length in the kernel space;

A8, calling the RtlCopyMemory function to copy the data in the buffer obtained in step A2 to the newly applied buffer;

A9, through the File_EncryptBuffer function, use the AES encryption algorithm and key to encrypt the data in the buffer.

set like this

The specific method of cloud decryption message is as follows:

B1, enter the PreWrite callback routine, first preprocess the IRP, and filter out the IRP that does not meet the decryption conditions;

B2. The IRP that meets the decryption conditions will be sent to the message system driver. When the message system driver reads the ciphertext data of the message and returns the request to the IO manager, the message filter driver intercepts the request and enters the PostRead callback example Procedure;

B3, obtain the buffer of the data to be decrypted and processed through iopb in the callback information, and obtain the buffer in two ways to determine whether iopb->Parameters.Read.MdlAddress is empty;

B4, get the data length of the message, judge whether the data length is 0 through Data->IoStatus.Information, if the read data length is 0, do not perform any processing, and return the request to the I/O manager;

B5, obtaining the decryption identifier of the message, analyzing the decryption identifier, and determining whether the message needs to be decrypted according to the flag in the identifier;

B6. Obtain the encryption and decryption key in ciphertext form from the EncryptKey parameter of the decryption identifier, and use the private key to perform asymmetric decryption to obtain the key in plaintext form;

B7, call the ExAllocatePoolWithTag function to apply for a data buffer with a length of iopb->Parameters.Read.Length in the kernel space;

B8, through the File_EncryptBuffer function, use the AES decryption algorithm and key to decrypt the data in the original buffer and put it into the new buffer;

B9, copy the message text data in the kernel buffer to the buffer of the monitoring layer space;

B10, release the memory space for storing the key in plain text form, and release the buffer for storing plain text data of the message, complete the PostRead callback routine, return the request, and the decryption process ends.

set like this

The preparatory steps for key agreement are:

C1, public key generation:

Determine the security parameter l, select the cyclic group G, where the order of G is a large prime number q, and the generator is P, where q>2 ^l , the receiver selects the private key s∈Z _q ^* , calculates P _pub =sP, and selects the hash Function H ₁ ; {0, 1} ^LU × G ² → Z _q ^* , H ₂ ; {0, 1} ^LU × {0, 1} ^LU × G ² → Z _q ^* , H ₃ ; {0, 1} ^LU ×{0, 1} ^LU ×G ⁵ →{0, 1} ^K , where _LU is the number of digits of the identity, set the MAC address as user A, and the user device as user B;

C2, node registration:

1. Secret value generation: User A selects X _A ∈ Z _q ^* , and calculates X _A = x _A P:

2. Partial private key generation; A sends X _A and ID _A to the receiving end through a secure channel, and the receiving end selects a random number r _A ∈ Z _q ^*, calculates R _A =r _A P, and generates the user's partial private key D _A = sH ₁ (ID _A , _RA , X _A )+r _A , the system sends DA, _RA to user _A , where _DA is sent by the secure channel, and _RA is sent by the public channel:

3. Verify the validity of part of the private key: pass D _A P ⁿ = R _A + H ₁ (ID _A , R _A , X _A ) P _pub ;

C3. After the node registration is completed, the complete public key of node A is composed of <X _A , R _A >, and the complete private key is composed of <x _A , D _A >.

The specific method for key negotiation is as follows:

D1. User A chooses a random temporary private key a∈Z _q ^* , calculates T _A =aP, signs g _A =a+H ₂ (ID _A , ID _B , X _B , T _A ), sends g _A , ID _A , R _A , T _A , X _A to user B;

D2, verify whether the equation of g _A P ⁿ = T _A + H ₂ (ID _A , ID _B , X _B , T _A ) (R _A +H ₁ (ID _A , R _A , X _A ) P _pub ) is established;

D3. If the equation in step D2 holds, the key negotiation is passed.

The generation method through the tunnel is:

E1, calculate the received power through the tunnel, the specific calculation formula is as follows:

,

Among them, P _r and _Pi represent the received and transmitted power through the tunnel, Gi is the signal gain, Gr is the loss of the signal on the radius, and l is the distance between the side wall of the passageway and the signal;

E2, calculate the distance l _r between two adjacent passageways, the specific calculation formula is as follows:

;

E3. Calculate the half-central angle θ between the intersection point of the intersection passing through the tunnel and the center of the signal circle. The specific calculation formula is as follows:

;

E4, calculate the fan-shaped area on one side, the specific calculation formula is as follows:

;

E5. Calculate the overlapping area of adjacent passing tunnels on the same plane. The specific calculation formula is as follows:

,

In the process of tunnel generation, it is only necessary to ensure that S is the minimum value to ensure the minimum mutual interference between adjacent tunnels.

Working principle: When in use, an encrypted discovery message is sent through the OLT device, and the client decrypts the discovery message after receiving the discovery message from the OLT device. If the incoming device is an unauthorized device and causes system damage, check whether the MAC address of the device is bound by the user. If the result of the check is that the MAC address is not bound by the user, the sent message will be discarded. Binding by user equipment, this setting can ensure that all OLT devices are bound by the user, avoiding the waste of resources caused by sending empty devices, then carry out key negotiation, if the middle key negotiation passes, then dynamically generate pass Tunnel, through the generated passing tunnel, users can access the OLT equipment. At the same time, by setting the inspection function of the overlapping area of adjacent passing tunnels, the signal passing rate of adjacent passing tunnels can be guaranteed to avoid signal interference.

Certain exemplary embodiments of the present invention have been described above only by way of illustration, and it goes without saying that those skilled in the art can use various methods without departing from the spirit and scope of the present invention. The described embodiments are modified. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the protection scope of the claims of the present invention.

Claims (6)

1. The management method of the security cloud OLT equipment is characterized by comprising the following steps of:

s1, an OLT device sends an encryption discovery message;

s2, after receiving the discovery message of the OLT equipment, the client decrypts the discovery message;

s3, checking whether the MAC address of the equipment is bound by the user, and discarding the message sent in S1 if the checking result is that the MAC address is not bound by the user;

s4, if the checking result in the step S3 is that the MAC address is bound by the user equipment, key negotiation is carried out;

and S5, if the key negotiation is passed in the step S4, dynamically generating a pass-through tunnel, and enabling the user to access the OLT equipment through the generated pass-through tunnel.

2. The method for managing the secure cloud OLT apparatus according to claim 1, wherein the specific manner of encrypting the message by the OLT apparatus is:

a1, after the client performs the scanning of the message to be encrypted, the message paths of the original message and the newly-built message are transmitted to a message filtering driver, and the message filtering driver calls a self-defined function for processing;

a2, opening an original message, obtaining a message Wen Goubing, and obtaining a byte stream of the message;

a3, the client calls a key generation function to generate a symmetric encryption key for encrypting the message, and the symmetric encryption key is transmitted to a message filtering driver after the asymmetric encryption is completed by using a public key, and the message filtering driver combines the key with other information to construct an encryption identifier and writes the encryption identifier into the head of the byte stream;

a4, redirecting the byte stream into a new message, namely writing the content of the original message into the new message, triggering the IRP_MJ_WRITE message of the IO manager in the process, entering a PreWrite callback routine after message filtering and driving interception, preprocessing the IRP, and filtering out the IRP which does not accord with the encryption condition;

a5, obtaining a buffer area where the data to be encrypted are located through the iopb in the callback information;

a6, obtaining an encryption and decryption key in a ciphertext form from the encrypteKey parameter of the encryption identifier, and performing asymmetric decryption by using a private key to obtain a key in a plaintext form;

a7, applying a data buffer area with the length of iopb- > parameters.

A8, copying the data in the buffer area obtained in the step A2 into a newly applied buffer area;

and A9, encrypting the data in the buffer area by using an AES encryption algorithm and a secret key.

3. The method for managing the secure cloud OLT apparatus according to claim 1, wherein the specific method for decrypting the message in the cloud is as follows:

b1, entering a PreWrite callback routine, firstly preprocessing IRPs, and filtering out the IRPs which do not meet decryption conditions;

b2, the IRP meeting the decryption conditions is sent to a message system driver, and when the message system driver reads out the message ciphertext data and returns a request to the IO manager, the message filtering driver intercepts the request and enters a PostRead callback routine;

b3, obtaining a buffer area where the data to be decrypted is located through the iopb in the callback information, obtaining the buffer area through two ways, and judging whether the iopb- > parameters. Read. Mdldldaddress is empty or not;

b4, acquiring the Data length of the message, judging whether the Data length is 0 through Data- > IoStatus information, if the read Data length is 0, not performing any processing, and returning the request to the I/O manager;

b5, obtaining a decryption identifier of the message, analyzing the decryption identifier, and determining whether the message needs decryption or not according to the flag bit in the identifier;

b6, obtaining an encryption and decryption key in a ciphertext form from the encryption key parameter of the decryption identifier, and performing asymmetric decryption by using a private key to obtain a key in a plaintext form;

b7, applying a data buffer area with the length of iopb- > parameters.

B8, decrypting the data in the original buffer area by using an AES decryption algorithm and a secret key, and putting the data into a new buffer area;

b9, copying the message data in the kernel buffer area to a buffer area of the monitoring layer space;

and B10, releasing the memory space for storing the plaintext form key, releasing the buffer for storing the plaintext data of the message, completing the PostRead callback routine, returning to the request, and ending the decryption process.

4. The method for managing a secure cloud OLT apparatus according to claim 1, wherein the preparing step of performing key negotiation is:

c1, public key generation:

determining a safety parameter l, selecting a cyclic group G, wherein the order of G is a large prime number q, and the generating element is P, wherein q>2 ^l The receiving end selects the private key s epsilon Z _q ^* Calculate P _pub =sp, select hash function H ₁ ；{0，1} ^LU ×G ² →Z _q ^* ，H ₂ ；{0，1} ^LU ×{0，1} ^LU ×G ² →Z _q ^* ，H ₃ ；{0，1} ^LU ×{0，1} ^LU ×G ⁵ →{0，1} ^K Wherein L is _U Setting the MAC address as a user A and the user equipment as a user B for the number of digits of the identity;

and C2, node registration:

1, secret value generation: user A selects X _A ∈Z _q ^* Calculate X _A =x _A P：

2, generating partial private keys; a uses secure channel to transfer X _A 、ID _A Transmitting to the receiving end, which selects the random number r _A ∈Z _q ^*， Calculating R _A =r _A P, generating a user part private key D _A =sH ₁ （ID _A ，R _A ，X _A ）+r _A The system will D _A ，R _A To user A, wherein the secure channel transmits D _A ，R _A Transmitted by a common channel:

3, verifying the validity of the partial private key: through D _A P ⁿ =R _A +H ₁ （ID _A ，R _A ，X _A ）P _pub ；

C3, complete public of node A after node registration is completed<X _A ，R _A >The complete private key is composed of<x _A ，D _A >Is formed by the following components.

5. The method for managing the secure cloud OLT apparatus according to claim 4, wherein the specific manner of performing the key negotiation is:

d1, user A selects a random temporary private key a E Z _q ^* Calculate T _A =ap, signature g _A =a+H ₂ （ID _A ，ID _B ，X _B ，T _A ) Send g _A 、ID _A 、R _A 、T _A 、X _A To user B;

d2, verify g _A P ⁿ =T _A +H ₂ （ID _A ，ID _B ，X _B ，T _A ）（R _A +H ₁ （ID _A ，R _A ，X _A ）P _pub ) Whether or not the equation is true;

d3, if the formula is established in the step D2, the key negotiation is passed.

6. The method for managing the secure cloud OLT apparatus according to claim 1, wherein the tunnel-passing generation mode is:

e1, calculating the receiving power of the tunnel, wherein the specific calculation formula is as follows:

，

wherein P is _r And P _i Respectively representing the receiving power and the transmitting power through the tunnel, wherein Gi is the signal gain, gr is the loss of the signal on the radius, and l is the distance between the side wall of the passenger channel and the signal;

e2, calculating the distance l between two adjacent passenger channels _r The specific calculation formula is as follows:

；

and E3, calculating a half central angle theta of the intersection point of the intersecting passing tunnel and the center of the signal circle, wherein the specific calculation formula is as follows:

；

and E4, calculating the fan-shaped area of one side, wherein the specific calculation formula is as follows:

；

and E5, calculating the overlapping area of adjacent passing tunnels on the same plane, wherein the specific calculation formula is as follows:

。