1、 International Telecommunication Union ITU-T Series GTELECOMMUNICATION STANDARDIZATION SECTOR OF ITU Supplement 49(02/2011) SERIES G: TRANSMISSION SYSTEMS AND MEDIA, DIGITAL SYSTEMS AND NETWORKS Rogue optical network unit (ONU) considerations ITU-T G-series Recommendations Supplement 49 ITU-T G-SERI
2、ES RECOMMENDATIONS TRANSMISSION SYSTEMS AND MEDIA, DIGITAL SYSTEMS AND NETWORKS INTERNATIONAL TELEPHONE CONNECTIONS AND CIRCUITS G.100G.199 GENERAL CHARACTERISTICS COMMON TO ALL ANALOGUE CARRIER-TRANSMISSION SYSTEMS G.200G.299 INDIVIDUAL CHARACTERISTICS OF INTERNATIONAL CARRIER TELEPHONE SYSTEMS ON
3、METALLIC LINES G.300G.399 GENERAL CHARACTERISTICS OF INTERNATIONAL CARRIER TELEPHONE SYSTEMS ON RADIO-RELAY OR SATELLITE LINKS AND INTERCONNECTION WITH METALLIC LINES G.400G.449 COORDINATION OF RADIOTELEPHONY AND LINE TELEPHONY G.450G.499 TRANSMISSION MEDIA AND OPTICAL SYSTEMS CHARACTERISTICS G.600G
4、.699 DIGITAL TERMINAL EQUIPMENTS G.700G.799 DIGITAL NETWORKS G.800G.899 DIGITAL SECTIONS AND DIGITAL LINE SYSTEM G.900G.999 MULTIMEDIA QUALITY OF SERVICE AND PERFORMANCE GENERIC AND USER-RELATED ASPECTS G.1000G.1999 TRANSMISSION MEDIA CHARACTERISTICS G.6000G.6999 DATA OVER TRANSPORT GENERIC ASPECTS
5、G.7000G.7999 PACKET OVER TRANSPORT ASPECTS G.8000G.8999 ACCESS NETWORKS G.9000G.9999 For further details, please refer to the list of ITU-T Recommendations. G series Supplement 49 (02/2011) i Supplement 49 to ITU-T G-series Recommendations Rogue optical network unit (ONU) considerations Summary Supp
6、lement 49 to ITU-T G-series Recommendations provides additional guidelines relative to ITU-T G.984.x-series and ITU-T G.987.x-series Recommendations, and other passive optical networks (PONs). It addresses the issue of rogue optical network units (ONUs), their prevention, detection, isolation and mi
7、tigation. History Edition Recommendation Approval Study Group 1.0 ITU-T G Suppl. 49 2011-02-25 15 ii G series Supplement 49 (02/2011) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communication te
8、chnologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World Tel
9、ecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In some
10、areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this publication, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recognized ope
11、rating agency. Compliance with this publication is voluntary. However, the publication may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the publication is achieved when all of these mandatory provisions are met. The words “shall“ or so
12、me other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the publication is required of any party. INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or im
13、plementation of this publication may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the publication development process. A
14、s of the date of approval of this publication, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this publication. However, implementers are cautioned that this may not represent the latest information and are therefore strongly urged to c
15、onsult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2011 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. G series Supplement 49 (02/2011) iii Table of Contents Page 1 Scope 1 2 Rogue condition c
16、auses and prevention . 1 2.1 Unauthorized transmission errors . 1 2.2 Software errors . 2 2.3 Media access control errors 3 2.4 Transceiver error 3 3 Rogue detection, isolation, and mitigation . 4 3.1 General . 4 3.2 Detection . 4 3.3 Isolation 5 4 Abbreviations and acronyms 6 G series Supplement 49
17、 (02/2011) 1 Supplement 49 to ITU-T G-series Recommendations Rogue optical network unit (ONU) considerations 1 Scope A passive optical network has a shared medium in the upstream direction, and the passive ODN combines all ONU outputs towards the OLT. Therefore, an ONU that is not transmitting in a
18、manner consistent with parameters specified in the standard can threaten all upstream transmissions on the PON causing interference and disrupting communications of all ONUs on the PON. An ONU that transmits optical power up the PON in violation of the parameters of the standard is called a “rogue O
19、NU“. This kind of situation is not unique to PONs, as many wireless and RF-based systems use the same shared channel scheme. However, under certain hardware and software conditions (attributed to circumstances including design, manufacturing, device failure, environmental, external, or other influen
20、ces), an ONU may exhibit behaviour that disrupts the operation of other ONUs on the same PON. Such rogue ONU behaviour can cause performance issues or outages for one or more ONUs on the PON. Also, diagnosing and isolating the offending ONU can be difficult since the affected ONUs are not always the
21、 ONUs causing the disruption. This Supplement raises the awareness of rogue ONU behaviour and provides system designers and implementers with techniques and tools to facilitate the prevention, detection, isolation, and removal of the offending ONU to avert or minimize service interruptions to other
22、ONUs on the PON. This treatment distinguishes a rogue ONU from a unit that intentionally or maliciously transmits optical signals that are not in accordance with the standard. In the strictest sense, these devices or intentional jammers are not ONUs, since they are not following the ITU-T Recommenda
23、tions that describe ONUs. They are essentially illegal devices that intend to deny or steal service from the network. However, these devices may exhibit behaviour and use processes that are similar to rogue ONUs and, therefore, considerations contained in this Supplement may assist in mitigating the
24、ir potential impact. Security measures are specified in the standard to further assist in reducing threats from malicious sources. The following clauses consider several rogue conditions that can occur and the design measures that can be employed to address them. Rogue ONU prevention, detection, iso
25、lation, and mitigation techniques are intended to avert or minimize service interruptions on a PON when a rogue condition occurs, and are not intended to be a substitute for solid engineering practice and adherence to the standards. Clause 4 provides the expansion of abbreviations and acronyms. 2 Ro
26、gue condition causes and prevention The key requirements in the standard that can be used to determine rogue behaviour are as follows: the ONU should only transmit at its specified “on power“ in timeslots that are allocated to it by the OLT, and the ONU should emit less than the “off power“ at all o
27、ther times. (The exact values of the power levels are given in the PMD specification.) An ONU that emits power outside of its allocated timeslot is a rogue ONU. The following clauses describe several conditions that can cause a rogue ONU, and the measures that can be employed to stop them. 2.1 Unaut
28、horized transmission errors One possible cause of rogue behaviour to consider is the reception by the ONU of errored transmissions from the OLT. It is possible that the bandwidth map allocations can contain errors. The hybrid error correction (HEC) in each entry can correct up to two errors, and det
29、ect three positively. Therefore, in most cases, when errors occur, they will be corrected or at least detected. 2 G series Supplement 49 (02/2011) It is exceedingly unlikely to get a four bit error combination. At the specified post-FEC BER of 1012, the chances of this happening are 6E-43. If the tr
30、ansmission averages 125 bandwidth map entries per frame, the PON will transmit one million entries per second. The mean time before seeing an undetected error is then 5E+28 years. In addition, such a fault would be transient; therefore, errors of this type are not practically significant. In the cas
31、es where the ONU cannot repair the allocation, then that allocation must be discarded (as required). Using the same assumptions as above, the mean time to an uncorrectable error in an allocation is 7E+17 years (in other words, a very long time). Thus, HEC-13 essentially eliminates the transmission e
32、rrors. If each allocation record stood on its own, then that would be the end of the consideration. However, XG-PON specifies an option for concatenated allocations. In cases where an allocation is lost, the ONU should treat the remaining allocations in that burst as lost also, since the content of
33、the lost allocation is not known. Many types of algorithms can be hypothesized that the ONU might use to confirm ownership of the lost allocation. However, the analysis above shows that such errors are so rare that these algorithms may not provide appreciable benefit. 2.2 Software errors A much more
34、 likely source of incorrect transmission can be classified as “software error“. Nearly every ONU implementation has a microprocessor that operates under stored program control and that is responsible for configuring the ONUs MAC device. By its very nature, software is very likely to have hidden fail
35、ure cases that may only emerge years after release. So, it can be envisioned (although hard to quantify) that the software on an ONU might become unstable at some point in its lifetime. In most cases, a failed software instance will just “hang up“. In these cases, the ONU will likely stop responding
36、 to commands, and possibly stop passing data, but it is unlikely to exhibit rogue behaviour. The common design solution for this is for the MAC (or processor chip itself) to have a watchdog timer. If the software does not reset this timer periodically, then the timer circuit can assume the software
37、has hung-up, and the circuit will reset the processor and cause a reboot of the ONUs program. In other cases, the failed software might misconfigure the MAC device. In cases where the MAC device is an application-specific integrated circuit (ASIC), it would be unlikely for the software to accidental
38、ly configure parameters that would cause the MAC to enter rogue behaviour. The ASIC will have most of its basic transmission control circuits hard-wired, and the software cannot change them. It is desirable to design the MAC ASIC in such a way that accidental misconfiguration that would result in ro
39、gue behaviour is minimized. A cautionary example: many MACs have debugging modes that turn the laser on continuous wave (CW) to make power measurements easier. Activating such a mode should be intentionally difficult, with several unrelated register settings required. This will make a malfunction, i
40、ncluding the possibility of intentionally or unintentionally setting the laser into continuous mode, less likely. However, if the MAC device is a field programmable gate array (FPGA), then it is easy for failed software to overwrite the FPGAs programming with damaging consequences. Essentially, this
41、 would mean that the software error condition would have spread to the MAC. This case could be solved using the methods in the next clause. In the case where the software has failed and induced the ONU to rogue behaviour, the protocol has a disable serial number message that may assist in recovery.
42、It is desirable that the disable message be processed in the MAC itself, outside of the softwares area of control. In that way, if an ONUs software has failed and the ONU has entered a rogue state, the OLT can positively force the rogue ONU to shut down by issuing the disable message to it. G series
43、 Supplement 49 (02/2011) 3 2.3 Media access control errors The media access control (MAC) device is the hardware that controls the optical transceiver. If the MAC has become defective for some reason, it can easily make the ONU rogue. As mentioned above, ASIC-based MACs are very reliable, since they
44、 are hard-wired to obey the recommended transmission protocols, and they are tested to a degree that design errors are quite rare. So, the source of an ASIC error is most likely a hardware-layer fault (a faulty transistor, for example). FPGA-based MAC failures are much more likely, in that their pro
45、gramming could be loaded incorrectly, and then the behaviour is undefined. A cautionary example: when an FPGA-based ONU reboots, reloading the firmware into the FPGA is typically part of the boot sequence. While this is happening, the MAC is essentially broken. Care should be taken to ensure the las
46、er remains off during this time. Therefore, it is possible for MAC errors to occur that result in rogue behaviour. In some cases, the faulty MAC may still be responsive to the disable message, and the problem could be resolved in this way. In other cases, the disable feature will be unresponsive. To
47、 recover from this type of failure, another part of the ONU must shut down the laser. There are two possibilities: the software, and the transceiver itself. It is desirable for the processor to have a negative control (forcing off) on the transmitter, for this purpose. If this is true, then when the
48、 software detects (through an algorithm) that the ONU is improperly transmitting a signal, it can shut down the transmitter by overriding the MAC. This negative control may also have applications in power saving as well. It is desirable for the transceiver to be able to ignore the MACs faulty instru
49、ctions. If this is true, the transmitter can become a “conscientious objector“, and it will ignore the illegal orders from its MAC. The range of invalid commands is large, and the transceiver circuitry is very simple; therefore, it is impossible to detect all invalid errors. But, simple errors are easy to detect. For example, if the Tx-enable signal goes on for a very long time (e.g., more than 1 ms), that is most likely a mistake. It is desirable that a simple burst duration monitor (anti-babbling) be incorporated into the transceiver. 2.4 Trans
