re message to the next node upstream. Alternatively, this node might have noticed Chapter 8 the LoL under its own stream, SO it might have already propagated the ChannelFailure upstream. 5. If the corresponding incoming data link has not failed, then the upstream node has localized the fault, responds to the downstream node with a ChannelFailureNack message, and reports the error locally. The results of the process are An indication that a particular data link has failed An indication of whether the failure has been localized to this node- precisely, to the downstream link at this node LMP also includes a mechanism for nodes to indicate when particular data links recover again via the exchange of ChannelActive/ChannelAc- tiveAck messages. 8.6.6 Authentication Because the control channel between a pair of LMP nodes may pass through an arbitrary IP cloud (even the Internet), it is important to be able to authenticate the messages that are received over this channel. To see why this is necessary, consider the denial of service (DoS) that could be caused by sending a fake LMP Begin Verify message to a core opti- cal switch to instruct it to begin verification of all of its data links. If the link verification proceeded, normal data forwarding would be suspended for the duration of the testing. Optionally, therefore, LMP sessions may negotiate the use of an MD5 hash algorithm to authenticate control messages. When authentication is agreed, each control message is signed by adding to it a 16-byte signature calculated from a shared secret key and an MD5 hash of the message contents. 8.7 Optical User-Network Interface (O-UNI) The GMPLS extensions provide a way to use MPLS for provisioning in opti- cal networks. In a real-world network, optical-networking equipment is typ- ically used at the center of the network, providing a high-capacity, GMPLS in Optical Networks fast-backbone service for client devices that use existing low-cost and low- bandwidth networking technologies (for example, IP routers or ATM switches). This