WO2015196441A1 - Configuration file acquisition method, apparatus and system - Google Patents

Abstract

Disclosed is a configuration file acquisition method, comprising: receiving, by a CMTS, a DHCP response message sent to a CM by a DHCP server, the DHCP response message carrying a configuration file name of a configuration file identifying the CM, an IP address allocated to the CM and address information about a TFTP server storing the configuration file; replacing the address information in the DHCP response message with address information about the CMTS, and then sending same to the CM; requesting the TFTP server for issuing the configuration file; receiving a TFTP request message from the CM, the TFTP request message carrying the configuration file name and a device certificate of the CM; verifying, by utilizing the device certificate of the CM, the legality of the CM ; and after the verification is passed, sending the configuration file to the CM.

Description

 Configuration file acquisition method, device and system

Technical field

 The present invention relates to the field of communications, and in particular, to a method, an apparatus, and a system for acquiring a configuration file.

Background technique

 Figure 1 is a schematic diagram of the system architecture of the DOCSIS (Data Over Cable Service Interface Specification). The service delivery system includes a server such as a DHCP (Dynamic Host Configuration Protocol) server and a TFTP (Trivial File Transfer Protocol) server. According to the provisions of the DOCSIS protocol, the configuration file of the CM (Cable Modem) is deployed on the TFTP server. To get online, the CM needs to obtain the IP (Internet Protocol) address and the TFTP server from the DHCP server through the DHCP protocol. The address and the file name of the configuration file are used. Then, the configuration file corresponding to the file name is obtained from the TFTP server corresponding to the address of the TFTP server using the TFTP protocol, and the configuration file is configured by using the obtained configuration file.

 In the process of the CM obtaining the configuration file from the TFTP server, the TFTP server needs to verify the validity of the CM. The DOCSIS protocol supports several authentication methods:

 1. The CM is authenticated by the TFTP server. Specifically, the CM carries the IP address or MAC (Media Access Control) address of the CM when sending the TFTP request message to the TFTP server. The TFTP server uses the IP address in the TFTP request message. The address or MAC address verifies the CM.

 2. The CM is verified by the CMTS. Specifically, the CMTS (Cable Modem Termination System) receives the TFTP request message from the CM, and uses the IP address or MAC address in the TFTP request message to legally apply to the CM. Sexual verification.

However, there are several verification methods, whether it is the TFTP server to verify the CM or the CMTS to verify the CM. The process of obtaining the configuration file has a great security risk, mainly because of the IP address and MAC address of the CM. It is easier to forge. An illegal CM can forge the IP address and MAC address of the legal CM, and obtain the configuration file of the legal CM from the TFTP server by using the forged IP address or MAC address. Although there are currently relatively secure transmission protocols, such as SFTP (Secure File Transfer Protocol), if you deploy an SFTP server directly in an existing DOCSIS system, you need to modify other servers, such as DHCP servers. The need to change the configuration of the CMTS will affect the compatibility of the existing DOCSIS system, and the existing DOCSIS system will be greatly modified.

 Therefore, it is especially important to ensure that the legal CM configuration files are not stolen by illegal CMs and improve network security without affecting the existing DOCSIS system.

Summary of the invention

 An embodiment of the present invention provides a method for acquiring a configuration file in a DOCSIS system, including:

The CMTS receives a DHCP response message sent by the DHCP server to the CM, where the DHCP response message carries a configuration file name identifying a configuration file of the CM, an IP address assigned to the CM, and an address of a TFTP server storing the configuration file. Information

 The CMTS replaces the address information of the TFTP server in the DHCP response message with the address information of the CMTS, and sends the address information to the CM;

 The CMTS requests the TFTP server to deliver the configuration file;

 The CMTS receives a TFTP request message from the CM, where the TFTP request message carries the configuration file name and the device certificate of the CM; after the verification is passed, the configuration file is sent to the CM.

 An embodiment of the present invention provides a method for acquiring a configuration file in a DOCSIS system, including:

The CM requests an IP address from the DHCP server, and receives a DHCP response message of the DHCP server, where the DHCP response message carries a configuration file name identifying the configuration file, an assigned IP address, and an address information identifying the TFTP server.

 The CM sends a TFTP request message to the TFTP server, where the TFTP request message carries the configuration file name and the device certificate of the CM, where the device certificate of the CM is used by the TFTP server to Verify the legality of the CM; and

 The CM receives a TFTP response message from the TFTP server, and the TFTP response message carries the configuration file.

An embodiment of the present invention provides a CMTS, including: a network side interface, configured to receive a DHCP response message sent by the DHCP server to the CM, where the DHCP response message carries a configuration file name identifying a configuration file of the CM, an IP address assigned to the CM, and an address identifying the TFTP server. And sending, to the TFTP server, the configuration file according to the address information;

 a first processing unit, configured to replace the address information of the TFTP server in the DHCP response message with the address information of the CMTS, and send the information to the CM through a user-side interface;

 The user side interface is configured to receive a TFTP request message from the CM, where the TFTP request message carries the configuration file name and a device certificate of the CM;

 a second processing unit, configured to verify validity of the CM by using a device certificate of the CM; and send the configuration file to the CM through the user side interface after the verification is passed.

 An embodiment of the present invention provides a CM, including:

 a first network side interface, configured to receive a DHCP response message from the network side, where the DHCP response message carries a configuration file name identifying a configuration file of the CM, an IP address assigned to the CM, and an identifier to store the configuration Address information of the network device of the file;

 a processing unit, configured to generate a TFTP request message, where the TFTP request message uses the address information as a destination address, and carries the configuration file name and a device certificate of the CM;

 a second network side interface, configured to send the TFTP request message to the network device, where an embodiment of the present invention provides a DOCSIS system, including a TFTP server, a CMTS, and a CM, where the CM passes the CMTS Connected to the TFTP server;

 The CMTS is configured to receive a DHCP response message sent by the DHCP server to the CM, where the DHCP response message carries a configuration file name identifying a configuration file of the CM, an IP address assigned to the CM, and the TFTP Address information of the server; the address information of the TFTP server in the DHCP response message is replaced with the address information of the CMTS, and then sent to the CM; the TFTP server is requested to deliver the configuration file; a TFTP request message of the CM, where the TFTP request message carries the configuration file name and a device certificate of the CM; verifying the legality of the CM by using the device certificate of the CM; The configuration file is sent to the CM.

The method, device and system provided by the invention, the CM carries its own device in the TFTP request message Certificates, because each CM is shipped with a unique device certificate, the device certificate is used to verify the legality of the CM, so that the legal CM can obtain the configuration file.

DRAWINGS

The drawings used in the background and embodiments are briefly described. Obviously, only a part of the embodiments of the present invention are described in the following drawings, and other drawings or embodiments may be obtained from those of ordinary skill in the art, and the present invention is intended to cover All of these derived figures or embodiments.

 Figure 1 is a schematic diagram of an existing DOCSIS system architecture;

 2 is a schematic structural diagram of a DOCSIS system according to an embodiment of the present invention;

 FIG. 3 is a flowchart of a method for acquiring a configuration file according to an embodiment of the present invention;

 4 is a flowchart of a process for negotiating a device certificate and a key option according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a structure of a CMTS according to an embodiment of the present invention;

 Fig. 6 is a schematic diagram showing the structure of a CM according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention are within the scope of the present invention.

 An embodiment of the present invention provides a DOCSIS system, as shown in FIG. 2, including a CMTS 10, a CM 12, and a service delivery system, wherein the service delivery system includes a DHCP server 16 and a TFTP server 18; and the CM 12 can connect to one or more users. Device 14, user device 14 may be a PC, a voice terminal, or the like.

 In FIG. 2, after the CM12 goes online, it needs to request the DHCP server 16 to allocate an IP address, and the CM12 sends a DHCP Request Message to the DHCP server 16, and the sent DHCP request message carries the MAC of the CM12 (Media Access Control). , Media Access Control) address.

After receiving the DHCP request message, the CMTS10 will send a DHCP request message to the corresponding The DHCP server 16 and the DHCP server 16 assign an IP address to the CM12. The assigned rule may be the correspondence between the MAC address and the IP address of the pre-deployed CM, or the IP address may be assigned to the CM12 from the corresponding IP address pool. Wait. After the IP address is assigned, the DHCP server 16 carries the assigned IP address, the configuration file name required by the CM12, and the address information of the TFTP server storing the configuration file in a DHCP Response Message (DHCP Response Message) to the CM12. The address information of the TFTP server may be an IP address of the TFTP server.

 After receiving the DHCP response message from the DHCP server 16, the CMTS 10 can obtain two ways to enable the CM 12 to obtain the configuration file:

 1) The CMTS 10 modifies the address information of the TFTP server in the DHCP response message to its own address, and sends the modified DHCP response message to the CM12.

 In this manner, since the address information of the TFTP server in the DHCP response message is the address of the CMTS 10, the CM12 sends a TFTP request message to the CMTS 10 after receiving the DHCP response message, and the TFTP request message carries the DHCP response message. In the embodiment, the CMTS 10 sends a corresponding configuration file. In this embodiment, the TFTP request message sent by the CMTS 10 may be a TFTP Request message, or may be a TFTP protocol message with similar functions. In this manner, the CMTS 10 sends a TFTP request message to the TFTP server 18 as a proxy of the CM12, requesting the delivery of the configuration file of the CM12. The specific procedure of the CMTS 10 requesting the configuration of the CM12 to the TFTP server 18 may be performed before the TFTP request message of the CM12 is received, or after the TFTP request message of the CM12 is received, the specific sequence is not limited in this embodiment. After receiving the TFTP request message from the CM12, the CMTS 10 verifies the validity of the CM12, and sends the configuration file to the CM12 after the verification is passed.

 The process of requesting the CMTS 10 to send the configuration file of the CM12 to the TFTP server 18 may be that the CMTS 10 sends a TFTP request message to the TFTP server 18, where the sent TFTP request message carries the configuration file name of the CM12, to which TFTP server The sending TFTP request message may be determined by the address information of the TFTP server in the received DHCP response message.

 The CMTS 10 can verify the legality of the CM12 in a variety of ways.

In the embodiment of the present invention, the TFTP request message sent by the CM12 carries the device certificate of the CM12 and the configuration file name, and may also carry the MAC address and the IP address of the CM12. The sent TFTP request message may be a TFTP Request message, or may be It is another TFTP protocol message with similar functions. Since the device certificate can uniquely identify a CM, as a means of verification, the CMTS10 A device certificate list may be saved for authenticating the CM. After receiving the TFTP request message of the CM12, the CMTS10 determines whether the device certificate in the message exists in the list. If it exists, the CM12 is legal, otherwise It is illegal.

 As another verification method, the CMTS 10 can also store the correspondence between the MAC address of the CM12 and the device certificate. The MAC address of the CM12 can be obtained from the process of requesting the IP address from the CM12 to the DHCP server 16, for example, sending from the CM12. Obtained from the DHCP request message of the DHCP server 16, or obtained from the DHCP response message sent by the DHCP server 16 to the CM12. After the correspondence between the MAC address of the CM12 and the device certificate, when receiving the TFTP request message of the CM12, the MAC address and the device certificate can be extracted from the TFTP request message, and the two are compared. If they are consistent, the CM12 is legal. Otherwise it is illegal.

 If the device certificate itself carries the MAC address, the CMTS 10 may verify the validity of the CM12 by comparing the MAC address in the device certificate with the MAC address in the DHCP response message or the MAC address in the TFTP request message. Comparison, if consistent, indicates that the CM is legal, otherwise it is illegal.

 Of course, the CMTS10 can also directly authenticate the device certificate in the TFTP request message by using the pre-deployed root certificate and the CA (Certificate Authority) certificate. The root certificate and CA certificate can be deployed on the CMTS 10 or independently of the CMTS 10.

 After the CMTS10 verifies the legality of the CM12, if it passes, the corresponding configuration file is sent to the CM12.

2) The CMTS 10 forwards the DHCP response message to the CM12.

 In this manner, the CM12 interacts with the corresponding TFTP server according to the address information of the TFTP server in the DHCP response message to obtain a configuration file.

In the embodiment of the present invention, the TFTP request message sent by the CM12 to the TFTP server 18 carries the configuration file name and the device certificate of the CM12, and may also carry the MAC address and IP address of the CM12. The TFTP server 18 authenticates the legality of the CM12, and sends the corresponding configuration file to the CM12 after the authentication is passed. The process of authenticating the legality of the CM 12 by the TFTP server 18 is similar to that of the CMTS 10 except that the execution subject is different and will not be described here. After verifying the legality of the CM, it can ensure that the legal CM obtains the configuration file to avoid being stolen by the illegal CM. In order to further enhance the security, the embodiment of the present invention can encrypt the configuration file in the process of configuration file transmission, and decrypt the CM to improve the security of the configuration file transmission process.

 There are many ways to encrypt and decrypt, such as setting encryption between TFTP server / CMTS and CM.

/ decryption algorithm, the TFTP server/CMTS uses the set encryption algorithm to calculate the MAC address and/or IP address of the CM, obtains the encryption key, encrypts the configuration file with the encryption key, and the CM receives the TFTP response message. After that, the configuration file is decrypted by using the set decryption algorithm to obtain a configuration file.

 It is also possible to set a password between the TFTP server/CMTS and the CM. The TFTP server/CMTS calculates the password, the MAC address and/or the IP address of the CM based on the set key generation algorithm to obtain the encryption key, and uses the encryption key. The configuration file is encrypted, and the configuration file is decrypted by the CM using a set password and a decryption algorithm to obtain a configuration file.

 It is also possible to set a pair of key pairs between the TFTP server/CMTS and the CM. The TFTP server/CMTS and the CM perform a key exchange before transmitting the configuration file. The TFTP server/CMTS is based on the set key exchange algorithm (eg The DH key exchange algorithm generates a shared encryption key. The TFTP server/CMTS encrypts the configuration file by using an encryption key, and the CM decrypts the configuration file by using an encryption key.

 The above encryption method can also be used in the process of authenticating the CM transmission device certificate, and the CMTS/TFTP server decrypts the device certificate of the CM to verify the legality of the CM.

 In the system provided by the embodiment of the present invention, the CM carries its own device certificate in the TFTP request message. Since each CM carries a unique device certificate when it leaves the factory, the device certificate is used to verify the legality of the CM, which can ensure legality. The CM gets the configuration file. In the transmission process of the configuration file, the configuration file is encrypted and decrypted by the CM, which can further improve the security of the configuration file transmission. An embodiment of the present invention provides a configuration file obtaining method in a DOCSIS system, in which a CMTS is used as a proxy to download a configuration file of a CM from a TFTP server, and the legality of the CM is performed after receiving a TFTP request message of the CM. After the verification is passed, the configuration file is sent to the CM, as shown in Figure 3.

Step S300: The CMTS forwards the DHCP response message of the DHCP server to the CM. After the CM is powered on, the CMTS sends a DHCP request message to the DHCP server to request the DHCP server to assign an IP address. The DHCP request message carries the MAC address of the CM. The DHCP server assigns the IP address corresponding to the MAC address to the pre-planning. The CM sends the assigned IP address to the CM in the DHCP response message, and also carries the configuration file name of the CM configuration file and the address information of the TFTP server storing the configuration file in the DHCP response message.

 After receiving the DHCP response message, the CMTS can save the contents of the DHCP response message and forward the DHCP response message to the CM. The content saved by the CMTS may be the configuration file name, the address information of the TFTP server, and the MAC address and/or IP address of the CM.

 Step S302: The CMTS sends a TFTP request message to the TFTP server, requesting the configuration file of the CM to be delivered.

 In this embodiment, the CMTS proxy CM sends a TFTP request message to the TFTP server, requesting the TFTP server to deliver the CM configuration file.

 The TFTP request message sent by the CMTS carries the configuration file name in the DHCP response message. After receiving the TFTP request message, the TFTP server sends the corresponding configuration file to the CMTS.

 Step S304: The CMTS receives the TFTP request message of the CM, and verifies the validity of the CM. In this embodiment, the TFTP request message sent by the CM carries the configuration file name and the device certificate of the CM, and the CMTS can use the device certificate of the CM to verify the CM. How to verify the foregoing embodiment has been described, and is not described herein.

 It should be noted that steps S302 and S304 in this embodiment are not limited in sequence.

 Step S306, the verification is passed, and the CMTS sends the configuration file to the CM.

The CMTS can send the configuration file to the CM through the TFTP response message. When the configuration file is transmitted, the configuration file can be encrypted, and the configuration file is decrypted by the CM. The specific encryption and decryption process is described in the system embodiment. In this embodiment, the TFTP request message of the CM can also be implemented by using a series of packets specified by the TFTP protocol, such as RRQ (Read Request), OACK (Option Acknowledge), Data, ACK (Acknowledge, Response). ), as well as ERROR and so on. The CM can negotiate the authentication mode with the CMTS through these packets. If the CM is implemented through a series of packets specified by the TFTP protocol, the CM needs to extend the packets to carry the device certificate of the CM. If you need to make a configuration file Encryption, you need to further extend this part of the packet to carry the key option. The following takes the device certificate and key option that carries the CM as an example. As shown in Figure 4, it includes:

 Step S400: The CMTS receives the RRQ of the CM.

 The RRQ of the CM carries the configuration file name. In the RRQ, the certificate authentication and encryption options are added. The RRQ carrying the certificate authentication and encryption options can be as shown in Table 1:

 Where optl...optN is the option name, and value 1... valueN indicates the corresponding option value. Cert, Encrypt are the names of the new options, Cert Info, Encrypt Info indicates the value of the new option. Cert Info can carry information such as certificate subject, and Encrypt Info can be a specific encryption option (such as encryption algorithm or key negotiation algorithm). Step S402: The CMTS sends an OACK to the CM according to the processing result of the RRQ.

 If the CMTS supports the Option option in the RRQ packet, the Option is returned in the OACK packet. If not, the Option is omitted. The Option is not carried in the OACK packet.

 Since the Cert and Encrypt options are added to the RRQ, certificate authentication and encryption negotiation are supported.

The CMTS needs to respond to the OACK carrying the new Option, as shown in Table 2:

 Table 2

 If the CMTS does not support certificate authentication and encryption negotiation, the CACK and Encrypt options are not carried in the OACK. Step S404, receiving an OPT of the CM.

 After receiving the OACK packet, the CM sends an OPT if it needs to send the device certificate and the negotiated key. Otherwise, it responds with ACK 0. In the embodiment of the present invention, the OPT belongs to the newly added packet, and the OPT carrying the device certificate of the CM may be as shown in Table 3:

 table 3

而同时携带有 CM的设备证书与密 项的 OPT可以如表 4所示:

步骤 S406、 CMTS发送 OPT。

The OPT of the device certificate and the secret item carrying the CM at the same time can be as shown in Table 4:

Step S406, the CMTS sends the OPT.

 After receiving the OPT packet sent by the CM, the CMTS verifies the device certificate of the CM if it receives the complete device certificate. If the verification fails, the CM will respond with ERROR, and the ERROR message will be used to inform the specific cause of the failure. The verification succeeds in responding to the CM with an OPT message. For the key exchange scenario, the OPT message in response to the CM also needs to send the server's public key to the CM. An example is shown in Table 5:

 After the above process, the CMTS completes the verification process for the CM, and subsequently encrypts the configuration file with the negotiated key and sends it to the CM.

 The method provided in this embodiment is to verify the validity of the CM by the CMTS. In another embodiment, the DHCP response message is directly forwarded to the CM by the CMTS, and the address information of the TFTP server is not modified, so that the CM is followed. Will interact with the TFTP server to get the configuration file. The TFTP server verifies the legality of the CM by using the device certificate of the CM. For the specific process, refer to the related description of the CMTS in the previous embodiment.

 In the method provided by the embodiment, the CM carries its own device certificate in the TFTP request message. Since each CM carries a unique device certificate when it leaves the factory, the device certificate is used to verify the legality of the CM, and the legal CM can be guaranteed. Get the configuration file. The configuration file is encrypted during the transmission of the configuration file and decrypted by the CM, which can further improve the security of the configuration file transmission. One embodiment of the present invention provides a CMTS, as shown in FIG. 5, including: a network side interface 50, a first processing unit 52, a processing unit 54, and a user side interface 56.

 The network side interface 50 is used to connect to the DHTP server and/or the TFTP server on the network side, and may be a receiver or a module having a receiving function.

The user side interface 56 is used to connect to the CM, and may be a transceiver or a module having a transceiving function. The processing unit 52 and the processing unit 54 can be connected to the network side interface 50 and the user side interface 56 through a series of buses. The processing unit 52 and the processing unit 54 can be two independent processors, or can be one processor, or can be One or more processing modules in a processor, and the like.

 In this embodiment, the network side interface 50 is configured to receive a DHCP response message sent by the DHCP server to the CM, where the DHCP response message carries a configuration file name identifying the configuration file of the CM, and an IP address allocated to the CM. The address and the address information of the TFTP server are determined; and the configuration file is requested to be sent to the TFTP server according to the address information.

 The processing unit 52 is configured to replace the address information of the TFTP server in the DHCP response message with the address information of the CMTS and send the information to the CM through the user side interface 56. The processing unit 52 may also not modify the address information of the TFTP server in the DHCP response message. Send the DHCP response message directly to the CM.

 The user side interface 56 is configured to receive a TFTP request message from the CM, where the TFTP request message carries a configuration file name and a device certificate. The configuration file is sent to the CM through the user side interface 56.

 The CMTS provided in this embodiment may further include a storage unit 58, which may be used to store a device certificate of a legal CM or a correspondence between a MAC address of a legal CM and a device certificate. The processing unit 54 can verify the CM by using the device certificate of the CM. For details on how to verify, refer to the description of the system embodiment.

 In the CMTS provided in this embodiment, the CM carries its own device certificate in the TFTP request message. Since each CM carries a unique device certificate when it leaves the factory, the CMTS can use the device certificate to verify the legality of the CM. The CM gets to the configuration file. In the transmission process of the configuration file, the configuration file is encrypted and decrypted by the CM, which can further improve the security of the configuration file transmission. Further, an embodiment of the present invention further provides a CM. As shown in FIG. 6, the network includes: a network side interface 60, a processing unit 62, and a network side interface 64. The network side interfaces 60 and 64 may be one or more transceivers. The processor may be one or more modules having a transceiving function, and the processing unit 62 may be a processor, a processing module in the processor, or the like.

In this embodiment, the network side interface 60 is configured to receive a DHCP response message from the network side, where the DHCP response message carries a configuration file name that identifies a configuration file of the CM, an IP address that is allocated to the CM, and Identifying address information of a network device storing the configuration file; the network device herein may Can be a TFTP server or CMTS.

 The processing unit 62 is configured to generate a TFTP request message, where the TFTP request message uses the address information as a destination address, and carries the configuration file name and the device certificate of the CM.

 The network side interface 64 is configured to send the TFTP request message to the network device.

 The CM provided in this embodiment may add a device certificate to a TFTP request message and send it to a corresponding network device, such as a CMTS or a TFTP server.

 The CM provided in this embodiment may also use the packet specified by the TFTP protocol and the corresponding network device negotiation key option. For details, refer to the description of the foregoing method embodiment. The device certificate is used to authenticate the legality of the CM, and the legal CM can obtain the configuration file.

 A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be performed by a program to instruct related hardware. The program may be stored in a computer readable storage medium, and the storage medium may include: Flash disk, Read-Only Memory (ROM), Random Access Memory (RAM), disk or optical disk.

 The methods, devices, and systems provided by the embodiments of the present invention are described in detail above. In the description, the details of the embodiments and the scope of application are changed. In summary, the contents of this specification should not be construed as Limitations of the invention.

Claims

Claim A wired data transmission service interface specification A configuration file acquisition method in a DOCSIS system, which is characterized in that:  The cable modem terminal system CMTS receives a DHCP response message sent by the DHCP server to the cable modem CM by the dynamic host configuration protocol, the DHCP response message carrying a configuration file name identifying the configuration file of the CM, and an IP number assigned to the CM Address and address information of a Simple Text Transfer Protocol TFTP server storing the configuration file;  The CMTS replaces the address information of the TFTP server in the DHCP response message with the address information of the CMTS, and sends the address information to the CM;  The CMTS requests the TFTP server to deliver the configuration file;  And the CMTS receives the TFTP request message from the CM, where the TFTP request message carries the configuration file name and the device certificate of the CM; and sends the configuration file to the CM after passing.  The method according to claim 1, wherein the CMTS stores a device certificate list, and the CMTS uses the device certificate of the CM to verify the legality of the CM, and specifically includes:  The CMTS determines whether the device certificate of the CM exists in the device certificate list, and if yes, indicates that the CM is legal, otherwise it is illegal.  The method according to claim 1, wherein the CMTS stores a correspondence between a media access control MAC address of the CM and a legal device certificate of the CM, and the CMTS of the CMTS is The TFTP request message acquires the MAC address of the CM and the device certificate, and compares the obtained MAC address and the device certificate with the stored MAC address and the device certificate. If they are consistent, the CM is legal, otherwise it is illegal. of.  The method according to claim 1, wherein the device certificate of the CM includes the MAC address of the CM, Line verification specifically includes: ^! Capture the TFTF request to eliminate τ JVIAL; corpse / f3⁄4_3⁄4 food" ΐ If it is consistent, it indicates that the CM is legal, otherwise it is illegal. The method according to claim 1, wherein the DHCP response message further carries a MAC address of the M, and the device certificate of the CM includes the MAC address of the CM,

If it is consistent, it indicates that the CM is legal, otherwise it is illegal.  The method according to claim 1, wherein the verifying, by the CMTS, the legality of the CM by using the device certificate of the CM includes:  The CMTS authenticates the device certificate of the CM with a pre-deployed root certificate and a certificate authority CA certificate.  The method according to any one of claims 1-6, wherein the sending, by the CMTS, the configuration file to the CM specifically includes:  The CMTS encrypts the configuration file by using a preset encryption password or a key pair, and sends the encrypted configuration file to the CM.  8. A wired data transmission service interface specification A configuration file acquisition method in a DOCSIS system, which is characterized in that:  The cable modem CM requests an IP address from the dynamic host configuration protocol DHCP server, and receives a DHCP response message of the DHCP server, where the DHCP response message carries the configuration file name of the identification configuration file, the assigned IP address, and the identifier simple text transmission protocol TFTP. Address information of the server; the CM sends a TFTP request message to the TFTP server, where the TFTP request message carries the configuration file name and the device certificate of the CM, where the device certificate of the CM is used for the The TFTP server verifies the legality of the CM;  The CM receives a TFTP response message from the TFTP server, and the TFTP response message carries the configuration file.  The method according to claim 8, wherein the method further comprises:  And decrypting the configuration file carried in the TFTP response message by using a preset decryption password or a key to extract the configuration file. 10. A cable modem terminal system CMTS, characterized in that: a network side interface, configured to receive a DHCP response message sent by the dynamic host configuration protocol DHCP server to the cable modem CM, where the DHCP response message carries a configuration file name identifying the configuration file of the CM, and an IP address assigned to the CM And the address information of the TFTP server that identifies the simple text transfer protocol; and requesting the configuration file to be sent to the TFTP server according to the address information; the first processing unit is configured to: use the TFTP server in the DHCP response message The address information is replaced by the address information of the CMTS and sent to the CM through the user side interface;  The user-side interface is configured to receive a TFTP request message from the CM, where the TFTP request message carries the configuration file name and a device certificate of the CM; and after the verification is passed, the user-side interface is used. The configuration file is sent to the CM.  The CMTS according to claim 10, further comprising a storage unit, configured to store a device certificate list; and the second processing unit is configured to determine whether the device certificate of the CM exists in the In the device certificate list, if it exists, it indicates that the CM is legal, otherwise it is illegal.  The CMTS according to claim 10, further comprising a storage unit, configured to store the second processing unit, specifically for acquiring a MAC address of the CM and a device certificate from the TFTP request message. The MAC address and the device certificate are compared with the stored MAC address and the device certificate. If they are consistent, the CM is legal, otherwise it is illegal.  The CMTS according to claim 10, wherein the device certificate of the CM includes a MAC address of the CM, and the second processing unit is specifically configured to use the TFTF request message as a legal Otherwise it is illegal.  14. A cable modem CM, comprising:  a first network side interface, configured to receive a dynamic host configuration protocol DHCP response message from the network side, where the DHCP response message carries a configuration file name that identifies the configuration file of the CM, an IP address assigned to the CM, and an identifier. Address information of a network device storing the configuration file;  a processing unit, configured to generate a TFTP request message, where the TFTP request message uses the address information as a destination address, and carries the configuration file name and a device certificate of the CM; a second network side interface, configured to send the TFTP request message to the network device, where Ding corpse / r I»J 食食 Ding 3⁄4, υινι ^  The CM according to claim 14, wherein the network device is a cable modem demodulation terminal system.  A wired data transmission service interface specification system, comprising: a simple text transfer protocol TFTP server, a cable modem terminal system CMTS, and a cable modem CM, wherein the CM is connected to the TFTP server through the CMTS ;  The CMTS is configured to receive a DHCP response message sent by the dynamic host configuration protocol DHCP server to the CM, where the DHCP response message carries a configuration file name that identifies a configuration file of the CM, and an IP address assigned to the CM. And the address information of the TFTP server; the address information of the TFTP server in the DHCP response message is replaced with the address information of the CMTS, and then sent to the CM; and the TFTP server is requested to deliver the configuration. Receiving a TFTP request message from the CM, the TFTP request message carrying the configuration file name and a device certificate of the CM; verifying the legality of the CM by using the device certificate of the CM; The configuration file is sent to the CM after verification is passed.