Hello,
Today, I would like to share with you a special description of the following aspects of the security mechanisms of the FTTx network.
ONU equipment access and authentication;
User authentication and binding;
Business isolation;
Data confidentiality;
Network and business security;
Equipment safety;
System redundancy backup;
System protection;
1- ONU equipment access and authentication
ONU equipment is generally deployed in users' homes, corridors, communities, etc., and there are security risks such as counterfeiting, camouflage, fraud, and network intrusion, and ONU access must be authenticated.
ONU authentication mainly includes MAC authentication and logical identification authentication (LOID). The MAC is the physical address of the ONU, and the LOID is the logical identifier configured in the ONU in advance. After the ONU is connected to the PON network and registered with the OLT, it must provide MAC or logical identification LOID for authentication. The MAC and LOID information of the ONU can be configured in the OLT through the network management system for comparison, or the MAC or LOID information of the ONU can be sent to The back-end authentication system performs centralized authentication. Only the ONU that has passed the authentication is a legal ONU and is allowed to access the PON network.
2- User authentication and binding
The user's access authentication and service authentication are mainly carried out in the BRAS based on PPPoE or DHCP.
In order to avoid security risks such as theft and sharing of user accounts, the binding of user accounts and physical lines/devices must also be provided. Currently, two technologies, PPPoE+ and DCHP Option 82, are mainly used to achieve user binding.
Compared with the DSLAM system, the user's port/line/device information is only inserted once in the DSLAM. In the PON system, the user's port/line/PVC/VLAN information can be inserted into the PPPoE or DHCP message exchange process in the ONU, and When the OLT inserts the OLT's port/board/VLAN information into the PPPoE or DHCP message exchange process again, the above-mentioned physical information registered in advance is compared through the authentication system such as the background Radius, and the user can access only after authentication. And it can realize the binding of the above-mentioned information with user MAC and other information.
3- Business isolation
The user and service isolation at the PON system level is mainly based on VLAN. For PUPV, the isolation of services between different users is realized; for PUPSPV, the isolation of services between different users is realized, and the isolation between different services of the same user is also realized.
The PON technology itself uses a burst mode to achieve natural isolation between different ONUs. Physical isolation can also be achieved between PON port and PON MAC.
On the user side of the ONU, users and services can also be isolated based on PVC and port isolation.
4- Data confidentiality
The downstream of PON adopts the broadcast mode, and the message will be sent to all ONUs under the PON port. In order to ensure the security of downstream data communication, PON provides data encryption, and generally adopts three-layer stirring encryption technology. The OLT requests a different key from each ONU, and the ONU provides its own key. The key is updated and synchronized regularly between the OLT and a specific ONU. The OLT uses a matching ONU key to encrypt the downstream data of each ONU to ensure Other ONUs cannot crack the encrypted data of other ONUs, thereby ensuring the security of downstream communications.
5- Cyber Security
Typical cyber security measures include:
Broadcast/multicast/DLF suppression: In order to prevent the formation of broadcast storms, ONU/OLT limits the rate of protocol-specific broadcasts (DHCP, ARP), multicast packets (IGMP, etc.), DLF packets and other Layer 2 broadcast messages.
MAC anti-theft: Prevent users from embezzling other users' MAC addresses, and refuse to provide services to users with duplicate MAC addresses.
MAC address table protection: prevent MAC flooding attacks and limit the number of MAC addresses learned from each user port.
MAC frame filtering: Set filtering entries for MAC source address and/or destination address. Filter specific MAC frames.
Illegal multicast source control: In order to prevent the misappropriation of multicast resources, PON equipment blocks the multicast stream sent from the user port. PON equipment supports the configuration of legal multicast sources on the network side and the configuration of filtering illegal multicast sources.
Anti-DoS attack: Limit the rate of specific ICMP/DHCP/IGMP and other protocol messages to effectively prevent DoS attacks against equipment.
User-side ring network detection: When a loop occurs on a single or multiple Ethernet ports/DSL ports of the OLT/ONU, close the loopback port and give an alarm, without affecting the normal operation of other ports and the system.
Traffic mirroring: Through configuration or automatic identification, the traffic of a certain port or sub-interface is mirrored to a specific port or remotely output for further analysis by a special system to eliminate network security threats. Provide local mirroring and remote mirroring function diagram Remote traffic mirroring function.
6- Equipment safety
Typical equipment safety measures include:
Device management account and authority control: Perform account and password authentication for logging in to the device through various methods such as network management, CLI, Telnet, etc., and control the account's management authority for the device, and realize authentication, authorization, and audit based on the AAA mechanism.
System log: Log records of various operations on equipment and systems through various methods such as network management, CLI, Telnet, etc., and can transmit the logs to the back-end network management system and other systems and platforms to the operating personnel of the system and equipment And activities for inquiries and traceability.
System alarm: Provide system alarm when various faults and safety problems occur in the equipment; ONU provides Dying Gasp.
System monitoring: monitor the operating status of key components such as system load, power supply, fan, etc. and provide alarms.
Equipment environment monitoring: The equipment provides environmental monitoring and alarms, and the environment temperature, humidity, smoke, water stains, access control, etc. monitor and provide alarms.
7- System redundancy and backup
Provide redundant backup protection for key components and boards such as fans, power supplies, power supplies, main control switch boards, and uplink boards. It can be manually switched or automatically switched to spare parts and panels when the main components and panels fail.
8- System protection
The PON system adopts a centralized control architecture. The control module is located on the main control switch board. The main control switch board supports 1:1 backup and protection.
There are three types of master/standby switchover of the master control switch board:
Passive switching under manual intervention. When a single board needs to be replaced or an abnormality is found manually, the switching can be commanded through EMS or CLI;
If the software is abnormal, it will be automatically switched. When the software of the main main board is running abnormally, the main board will abandon the main function and restart, and the standby board will automatically switch to the main function;
The control module performs real-time detection of the main modules in the single board. When a hardware abnormality is detected, the main board abandons the main use and restarts, and the standby board automatically switches to the main use.
