Granted Patent B2

US 8,495,371 · App. 12/652,949 · Granted Jul 23, 2013

Abstract

Claims (93)

1. A method comprising:

generating, via a first optical network device comprising one or more ports, a first authentication message comprising first message data and a first authentication code computed based on the first message data and a first key, without accessing a database storing unique credentials for subscribers;

transmitting, via the first optical network device, the first authentication message to a second optical network device;

receiving, via the first optical network device, a second authentication message comprising second message data and a second authentication code generated via the second optical network device based on the second message data and a second key;

generating, via the first optical network device, a third key based on the first key and a second client identification field of the second message data;

generating, via the first optical network device, a third authentication code by applying the third key and a message digest algorithm to the second message data;

authorizing, via the first optical network device, communication between the first optical network device and the second optical network device, at least in part by comparing the second authentication code with the third authentication code; and

when the second authentication code matches the third authentication code, transmitting, via the first optical network device, a third authentication message to the second optical network device, and unblocking at least one of the one or more ports.

2. The method of claim 1 ,

wherein computing the first authentication code comprises applying the first key and the message digest algorithm to the first message data, and

wherein computing the second authentication code comprises applying the second key and the message digest algorithm to the second message data.

3. The method of claim 1 , wherein generating the first authentication message comprises:

generating the first authentication code by applying the first key and the message digest algorithm to the first message data; and

applying a layer two header comprising a reserved media access control address to the first authentication message.

4. The method of claim 1 , wherein the first key is the same as the second key.

5. The method of claim 1 , wherein the first message data comprises a message type field, a server identification field, a server opaque data field, a first client type field, and a client configuration field, and

wherein the second message data comprises the message type field, the server identification field, the server opaque data field, a second client type field, and the client configuration field.

6. The method of claim 1 , further comprising receiving, from an administration interface of the first optical network device, configuration information comprising a key corresponding to at least one of a model, a type, and a manufacturer of the second optical network device.

7. The method of claim 1 , wherein the first optical network device is an optical network aggregation device, and wherein the second optical network device is an optical network termination device.

8. The method of claim 1 , wherein the message digest algorithm is based on at least one of a model, a type, and a manufacturer of the second optical network device.

9. An optical network device comprising one or more ports and a processor configured to:

generate a first authentication message comprising first message data and a first authentication code computed based on the first message data and a first key, without accessing a database storing unique credentials for subscribers;

transmit the first authentication message to a second optical network device;

receive a second authentication message comprising second message data and a second authentication code generated via the second optical network device based on the second message data and a second key;

generate a third key based on the first key and a second client identification field of the second message data;

generating a third authentication code by applying the third key and a message digest algorithm to the second message data;

authorize communication between the optical network device and the second optical network device, at least in part by comparing the second authentication code with the third authentication code; and

when the second authentication code matches the third authentication code, transmit a third authentication message to the second optical network device, and unblock at least one of the one or more ports.

10. The optical network device of claim 9 , wherein the processor is further configured to:

compute the first authentication code by applying the first key and the message digest algorithm to the first message data; and

receive the second authentication code, wherein the second authentication code is generated via the second optical network device by applying the second key and the message digest algorithm to the second message data.

11. The optical network device of claim 9 , wherein the processor is further configured to:

generate the first authentication message by applying the first key and the message digest algorithm to the first message data; and

apply a layer two header comprising a reserved media access control address to the first authentication message.

12. The optical network device of claim 9 , wherein the first key is the same as the second key.

13. The optical network device of claim 9 ,

wherein the first message data comprises a message type field, a server identification field, a server opaque data field, a first client type field, and a client configuration field, and

wherein the second message data comprises the message type field, the server identification field, the server opaque data field, a second client type field, and the client configuration field.

14. The optical network device of claim 9 , wherein the processor is further configured to receive, from an administration interface of the optical network device, configuration information comprising a key corresponding to at least one of a model, a type, and a manufacturer of the second optical network device.

15. The optical network device of claim 9 , wherein the optical network device is an optical network aggregation device, and wherein the second optical network device is an optical network termination device.

16. The optical network device of claim 9 , wherein the message digest algorithm is based on at least one of a model, a type, and a manufacturer of the second optical network device.

17. A non-transitory computer-readable storage medium comprising instructions that, upon execution, cause one or more processors of a first optical network device comprising one or more ports to:

generate, a first authentication message comprising first message data and a first authentication code computed based on the first message data and a first key, without accessing a database storing unique credentials for subscribers;

transmit the first authentication message to a second optical network device;

receive a second authentication message comprising second message data and a second authentication code generated via the second optical network device based on the second message data and a second key;

generate a third key based on the first key and a second client identification field of the second message data;

generate a third authentication code by applying the third key and a message digest algorithm to the second message data; and

authorize, via the first optical network device, communication between the first optical network device and the second optical network device, at least in part by comparing the second authentication code with the third authentication code; and

when the second authentication code matches the third authentication code, transmit a third authentication message to the second optical network device, and unblock at least one of the one or more ports.

18. The non-transitory computer-readable storage medium of claim 17 ,

wherein the instructions that, upon execution, cause the one or more processors to compute the first authentication code further comprise instructions that cause the one or more processor to apply the first key and the message digest algorithm to the first message data, and

wherein the second authentication code generated via the second optical network device is generated by applying the second key and the message digest algorithm to the second message data.

19. The non-transitory computer-readable storage medium of claim 17 , wherein the instructions that, upon execution, cause the one or more processors to generate the first authentication message further comprise instructions that cause the one or more processors to:

generate the first authentication code by applying the first key and the message digest algorithm to the first message data; and

apply a layer two header comprising a reserved media access control address to the first authentication message.

20. The non-transitory computer-readable storage medium of claim 17 , wherein the first key is the same as the second key.

21. The non-transitory computer-readable storage medium of claim 17 ,

wherein the first message data comprises a message type field, a server identification field, a server opaque data field, a first client type field, and a client configuration field, and

wherein the second message data comprises the message type field, the server identification field, the server opaque data field, a second client type field, and the client configuration field.

22. The non-transitory computer-readable storage medium of claim 17 , further comprising instructions that, upon execution, cause the one or more processors to receive, from an administration interface of the first optical network device, configuration information comprising a key corresponding to at least one of a model, a type, and a manufacturer of the second optical network device.

23. The non-transitory computer-readable storage medium of claim 17 , wherein the first optical network device is an optical network aggregation device, and wherein the second optical network device is an optical network termination device.

24. The non-transitory computer-readable storage medium of claim 17 , wherein the message digest algorithm is based on at least one of a model, a type, and a manufacturer of the second optical network device.

25. An optical network device comprising:

one or more ports;

means for generating a first authentication message comprising first message data and a first authentication code computed based on the first message data and a first key, without accessing a database storing unique credentials for subscribers;

means for transmitting the first authentication message to a second optical network device;

means for receiving a second authentication message comprising second message data and a second authentication code generated via the second optical network device based on the second message data and a second key;

means for generating a third key based on the first key and a second client identification field of the second message data;

means for generating a third authentication code by applying the third key and a message digest algorithm to the second message data;

means for authorizing communication between the optical network device and the second optical network device, at least in part by comparing the second authentication code with the third authentication code; and

means for, when the second authentication code matches the third authentication code, transmitting a third authentication message to the second optical network device, and unblocking at least one of the one or more ports.

26. The optical network device of claim 25 ,

wherein the means for computing the first authentication code comprises means for applying the first key and the message digest algorithm to the first message data, and

wherein the second authentication code generated via the second optical network device is generated by applying the second key and the message digest algorithm to the second message data.

27. The optical network device of claim 25 , wherein the means for generating the first authentication message comprises:

means for generating the first authentication code by applying the first key and the message digest algorithm to the first message data; and

means for applying a layer two header comprising a reserved media access control address to the first authentication message.

28. The optical network device of claim 25 , wherein the first key is the same as the second key.

29. The optical network device of claim 25 , wherein the first message data comprises a message type field, a server identification field, a server opaque data field, a first client type field, and a client configuration field, and

wherein the second message data comprises the message type field, the server identification field, the server opaque data field, a second client type field, and the client configuration field.

30. The optical network device of claim 25 , further comprising means for receiving, from an administration interface of the optical network device, configuration information comprising a key corresponding to at least one of a model, a type, and a manufacturer of the second optical network device.

31. The optical network device of claim 25 , wherein the optical network device is an optical network aggregation device, and wherein the second optical network device is an optical network termination device.

32. The optical network device of claim 25 , wherein the message digest algorithm is based on at least one of a model, a type, and a manufacturer of the second optical network device.

33. A system comprising:

an optical network termination device; and

an optical network aggregation device, wherein the optical network aggregation device comprises one or more ports and one or more processors configured to:

generate a first authentication message comprising first message data and a first authentication code computed based on the first message data and a first key, without accessing a database storing unique credentials for subscribers;

transmit the first authentication message to the optical network termination device;

receive a second authentication message comprising second message data and a second authentication code generated via the second optical network device based on the second message data and a second key;

generate a third key based on the first key and a second client identification field of the second message data;

generate a third authentication code by applying the third key and a message digest algorithm to the second message data;

authorize communication between the optical network aggregation device and the optical network termination device, at least in part by comparing the second authentication code with the third authentication code; and

when the second authentication code matches the third authentication code, transmit a third authentication message to the second optical network device, and unblock at least one of the one or more ports.

Assignments (8)