# US 11,909,885 B2 · Passive optical network security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,885 B2 - Document ID: US11909885B2 - Status: Granted - Kind: B2 - Application number: 17/452,535 - Filed: 2021-10-27 - Published: 2023-04-27 - Granted: 2024-02-20 - Earliest claimed: 2021-10-27 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Joseph Soryal; Dylan Chamberlain Reid - Web page: https://patentgrep.com/patent/US11909885B2 ## CPC - H04L 9/3236: {using cryptographic hash functions} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Improved optical network security (e.g., using a computerized tool) is enabled. Various embodiments herein can send (e.g., via a network) to a group of network devices comprising a first network device and a second network device, a first encrypted data stream, a second encrypted data stream, a first hash code, and a second hash code, wherein the first network device deletes the second encrypted data stream after the first network device hashes the second encrypted data stream, and in response to the second network device being determined not to have received the second hash code within a defined threshold time, determine that the first network device is unauthorized to use the network. ## Claims ### Claim 1 A system, comprising: a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising: generating a first encrypted data stream associated with first information and a second encrypted data stream associated with second information; generating a first hash code corresponding to the first encrypted data stream and a second hash code corresponding to the second encrypted data stream, wherein a decryption key corresponding to the first encrypted data stream comprises a combination of a key associated with a first network device and the second hash code; sending, via a network to a group of network devices comprising the first network device and a second network device, the first encrypted data stream, the second encrypted data stream, the first hash code, and the second hash code, wherein the first network device deletes the second encrypted data stream after the first network device hashes the second encrypted data stream; and in response to the second network device being determined not to have received the second hash code within a defined threshold time, determining that the first network device is unauthorized to use the network. ### Claim 2 (depends on 1) The system of claim 1, wherein the first network device is determined to be unauthorized to use the network in response to the second network device being determined not to have received the second hash code from the first network device within the defined threshold time. ### Claim 3 (depends on 1) The system of claim 1, wherein the first network device is determined to be unauthorized to use the network in response to the second network device being determined not to have received the second hash code from the system within the defined threshold time. ### Claim 4 (depends on 1) The system of claim 1, wherein the network is a first network, and wherein the first network device sends the second hash code to the second network device via a second network, different from the first network. ### Claim 5 (depends on 4) The system of claim 4, wherein the first network comprises a fiber optic network. ### Claim 6 (depends on 5) The system of claim 5, wherein the second network comprises a fiber optic network. ### Claim 7 (depends on 5) The system of claim 5, wherein the second network comprises a wireless radio frequency network. ### Claim 8 (depends on 1) The system of claim 1, wherein the system further comprises a virtual machine that generates and sends encrypted data streams comprising the first encrypted data stream and the second encrypted data stream. ### Claim 9 (depends on 1) The system of claim 1, wherein the group of network devices comprises respective virtual machines that generate and send encrypted hash codes based on encrypted data streams comprising the first encrypted data stream and the second encrypted data stream. ### Claim 10 (depends on 1) The system of claim 1, wherein the operations further comprise: generating a third encrypted data stream; generating a third hash code corresponding to the third encrypted data stream, wherein the decryption key corresponding to the first encrypted data stream comprises a combination of the key associated with the first network device, the second hash code, and the third hash code; sending, via the network to the group of network devices comprising the first network device, the second network device, and a third network device, the first encrypted data stream, the second encrypted data stream, the third encrypted data stream, the first hash code, the second hash code, and the third hash code, wherein the first network device deletes the second encrypted data stream after the first network device hashes the second encrypted data stream and the first network device deletes the third encrypted data stream after the first network device hashes hashing the third encrypted data stream; and in response to the second network device being determined not to have received the second hash code from the first network device within the defined threshold time, or the third network device being determined not to have received the third hash code from the first network device within the defined threshold time, determining that the first network device is unauthorized to use the network. ### Claim 11 A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising: generating first encrypted data associated with first information and second encrypted data associated with second information; generating a first hash code corresponding to the first encrypted data and a second hash code corresponding to the second encrypted data, wherein a decryption key corresponding to the first encrypted data comprises a combination of a key associated with first network equipment and the second hash code; sending, via a network to a group of network equipment comprising the first network equipment and second network equipment, the first encrypted data, the second encrypted data, the first hash code, and the second hash code, wherein the first network equipment deletes the second encrypted data after the first network equipment hashes the second encrypted data; and in response to the second network equipment being determined not to have received the second hash code within a defined threshold time, determining that the first network equipment is unauthorized to use the network. ### Claim 12 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the operations further comprise: in response to the first network equipment being determined to be unauthorized to use the network, generating alarm information representative of an alarm indicative of the determining that the first network equipment is unauthorized to use the network. ### Claim 13 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the key associated with a first network equipment comprises a unique key associated with the first network equipment. ### Claim 14 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the first network equipment comprises a first network terminal and the second network equipment comprises a second network terminal. ### Claim 15 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the operations further comprise: generating third encrypted data; generating a third hash code corresponding to the third encrypted data, wherein the decryption key corresponding to the first encrypted data comprises a combination of the key associated with the first network equipment, the second hash code, and the third hash code; sending, via the network to the group of network equipment comprising the first network equipment, the second network equipment, and third network equipment, the first encrypted data, the second encrypted data, the third encrypted data, the first hash code, the second hash code, and the third hash code, wherein the first network equipment deletes the second encrypted data after the first network device hashes the second encrypted data and the first network equipment deletes the third encrypted data after the first network equipment hashes hashing the third encrypted data; and in response to the second network equipment being determined not to have received the second hash code within the defined threshold time, or the third network equipment being determined not to have received the third hash code within the defined threshold time, determining that the first network equipment is unauthorized to use the network. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the first network equipment is determined to be unauthorized to use the network in response to the second network equipment being determined not to have received the second hash code from the first network equipment within the defined threshold time or the third network equipment being determined not to have received the third hash code from the first network equipment within the defined threshold time. ### Claim 17 A method, comprising: generating, by network equipment comprising a processor, a first encrypted data stream associated with first information and a second encrypted data stream associated with second information; generating, by the network equipment, a first hash code corresponding to the first encrypted data stream and a second hash code corresponding to the second encrypted data stream, wherein a decryption key corresponding to the first encrypted data stream comprises a combination of a key associated with a first network device and the second hash code; sending, by the network equipment via a network to a group of network devices comprising the first network device and a second network device, the first encrypted data stream, the second encrypted data stream, the first hash code, and the second hash code, wherein the first network device deletes the second encrypted data stream after the first network device hashes the second encrypted data stream; and in response to the second network device being determined not to have received the second hash code within a defined threshold time, determining, by the network equipment, that the first network device is unauthorized to use the network. ### Claim 18 (depends on 17) The method of claim 17, wherein the network equipment comprises an optical line terminal. ### Claim 19 (depends on 17) The method of claim 17, wherein the first network device comprises a first optical network terminal and the second network device comprises a second optical network terminal. ### Claim 20 (depends on 17) The method of claim 17, wherein the network comprises a fiber optic network, and wherein the first network device sends the second hash code to the second network device via a wireless radio access network.