An endogenous optical network physical layer security protection system

Abstract

The present invention belongs to the field of optical communication technology and optical network, and specifically relates to a physical layer security protection system based on endogenous optical network. The purpose of the present invention is to provide a key generation optical network physical layer security protection method based on channel characteristics in an optical network, which plays an important role in building and promoting the development of endogenous optical communication systems. The present invention combines the randomness of physical noise with a suitable algorithm to implement a data protection scheme to achieve high-speed encryption based on the extraction of passwords based on physical layer channel characteristics. Specifically, a seed key with a low generation rate is used to encrypt a high-speed optical link, and a high-order signal is formed by using a running key / state base and a data signal in a high-speed optical channel, and optical quantum noise stream encryption is performed, and physical layer damage suppression is performed through digital signal processing methods, thereby improving the transmission performance of the system while ensuring the security of the optical transmission system.

Description

Technical Field

[0001] The present invention belongs to the field of optical communication technology and optical network, and in particular relates to an endogenous optical network physical layer security protection system. Background Art

[0002] As the main body of the basic transmission layer of the telecommunications network, the optical cable network is a public transmission platform for various services, providing high-speed and large-capacity transmission guarantee for various business information. The current optical fiber communication system has inherent defects in anti-eavesdropping and optical layer attacks, and it is difficult to resist signal eavesdropping from lines or nodes, as well as various attacks and intentional threats. Therefore, the optical network faces the security challenges of information "being wired" and "being connected in series". With the substantial increase in the rate and distance of optical communication, the security threat of optical networks will become more serious. In response to the security issues of optical networks, the industry has conducted cutting-edge explorations of security protection technologies at all levels of the network. However, in view of the future development trend of large capacity (high speed, long distance), physical layer secure optical communication faces the constraints of mathematical complexity and physical complexity. Quantum noise stream encrypted optical communication (QNSC) is an encryption technology that has emerged in recent years. It is based on the principle of quantum measurement collapse and encrypts optical signals by expanding short keys into long keys. It has great application potential.

[0003] At the same time, the industry has proposed an innovative concept of endogenous secure optical communication that integrates communication and encryption. Endogenous secure optical communication is an endogenous protection for information transmission that does not rely on additional external negotiation processes. It is completely provided by the optical communication system itself, and can simultaneously achieve secure transmission and key negotiation based on the channel. However, when QNSC forms a seed key, the typical method is to generate it through an external random device, such as in the form of quantum key distribution (QKD).

[0004] The main factors involved in the evaluation of encryption technology implementation in optical networks are:

[0005] Complexity and cost: The higher you go in the network, the greater the complexity and cost of implementing and managing end-to-end encryption.

[0006] Network latency: Dynamic data protection must not affect business transmission and the user experience of key services.

[0007] Network throughput / utilization: Any network efficiency tradeoffs introduced by encryption need to be carefully evaluated, given that new network capacity additions will impact both capital expenditures (CAPEX) and operating expenditures (OPEX).

[0008] Flexibility and scalability: Operators must carefully evaluate the compatibility and impact of encryption technology on today’s networks in terms of customers, rates, services and network technology and architecture choices used. Summary of the invention

[0009] The purpose of the present invention is to provide a key generation optical network physical layer security protection method based on channel characteristics in an optical network, which plays an important role in building and promoting the development of endogenous optical communication systems. The present invention combines physical randomness with a suitable algorithm to achieve a data protection scheme based on physical cryptography. Specifically, a quantum key with a low generation rate is used to encrypt a high-speed optical link. Specifically, a high-order signal is formed by using a running key / state basis and a data signal in a high-speed optical channel, and optical noise stream encryption is performed. Physical layer damage suppression is performed by digital signal processing methods, which improves the transmission performance of the system while ensuring the security of the optical transmission system.

[0010] The technical solution adopted by the present invention is:

[0011] An endogenous optical network physical layer security protection system, the transmitting side includes: a plaintext data generation module, a seed key module, an operating key module, a symbol mapping module, a digital-to-analog conversion module, an electro-optical modulation module and a laser; the legal side includes: an optoelectronic conversion module, an analog-to-digital conversion module, a symbol digital signal processing module, a symbol phase noise quantization module, a symbol decryption module, a symbol demapping module, a plaintext data recovery module and a key extraction module;

[0012] The processing of the transmitter:

[0013] The plaintext data generation module is used to generate plaintext data and send it to the symbol mapping module;

[0014] The seed key module is used to receive the seed key of the legal party and send the seed key to the running key module after passing the key consistency test and randomness test;

[0015] The running key module is used to expand the seed key by means of a shift register and send it to the symbol mapping module;

[0016] The symbol mapping module is used to perform symbol mapping between the plaintext data and the expanded seed key, and send the symbol-mapped data to the digital-to-analog conversion module;

[0017] The digital-to-analog conversion module is used to perform digital-to-analog conversion on the data after the symbol mapping module, and send the converted analog data to the electro-optical modulation module;

[0018] The electro-optic modulator module is used to use the optical signal generated by the laser as an optical carrier, modulate the analog data, and transmit the electro-optically modulated signal through an optical fiber link;

[0019] Processing of legal parties:

[0020] The photoelectric conversion module is used to convert the received optical signal and the local oscillator into an electrical signal, and send the analog data after the photoelectric conversion to the analog-to-digital conversion module;

[0021] The analog-to-digital conversion module is used to convert the analog data after the photoelectric conversion into digital data and send it to the symbolic digital signal processing module;

[0022] The symbol digital signal processing module is used to perform digital signal processing on the received data and then send it to the symbol phase noise quantization module;

[0023] The symbol phase noise quantization module is used to perform noise quantization on the phase of the data after digital signal processing, send the data after phase randomness quantization to the key extraction module, and send the data after digital signal processing to the symbol decryption module;

[0024] The key extraction module is used to generate a seed key from the data after phase randomness quantization, and send the generated seed key to the transmitter and the symbol decryption module;

[0025] The symbol decryption module is used to decrypt the data after digital signal processing according to the encryption rules, and send the decrypted data to the symbol demapping module;

[0026] The symbol demapping module is used to demap the decrypted data and send it to the plaintext data recovery module;

[0027] The plaintext data recovery module is used to recover the plaintext data from the demapped data.

[0028] Further, the symbol phase noise quantization module includes a phase rotation angle calculation module, a phase rotation angle quantization module and an angle quantization post-processing module;

[0029] The phase rotation angle calculation module is used to calculate the phase rotation of the symbol constellation diagram caused by the line width of the laser and the nonlinearity in the optical fiber transmission process according to the data after digital signal processing;

[0030] The phase rotation angle quantization module is used to quantize the phase rotation angle of the symbol constellation diagram into a random sequence of 0 and 1 by a uniform quantization method;

[0031] The angle quantization post-processing module is used to enhance the key generation rate, consistency rate and randomness of the random sequence of 0 and 1 generated by quantization and send it to the key extraction module.

[0032] Further, the symbol digital signal processing module includes a front-end hardware imperfect compensation module, a dispersion compensation module, a timing recovery module, a polarization tracking and equalization module, a frequency estimation module and a phase estimation module;

[0033] The front-end hardware non-ideal compensation module is used to compensate for the amplitude power imbalance and phase imbalance of the orthogonal components and phase increments of the signal in the digital data based on the Schmidt orthogonal transformation principle;

[0034] The dispersion compensation module is used to compensate for large dispersion in digital data by constructing an optical fiber channel transfer function;

[0035] The timing recovery module is used to correct the deviation of the clocks at both ends of the transmitter and receiver using the Gardner algorithm;

[0036] The polarization tracking and equalization module is used to perform polarization demultiplexing of digital data using a blind equalization algorithm of a constant modulus algorithm and to compensate for signal damage caused by polarization film dispersion of the optical fiber link;

[0037] The frequency estimation module is used to track the carrier frequency using a quartic algorithm and compensate for the carrier frequency offset in the digital data;

[0038] The phase estimation module is used to track the carrier phase using the VV algorithm and compensate for the carrier phase offset in the digital data.

[0039] The present invention brings the following beneficial results:

[0040] The present invention provides a highly flexible quantum noise stream encryption secure transmission method for an optical network that guarantees service types and rates. The present invention significantly improves the security of the optical communication system while achieving high-rate, long-distance optical transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a schematic diagram of the overall endogenous optical network physical layer security protection encryption scheme proposed by the present invention.

[0042] Figure 2 This is a schematic diagram of the seed key generation architecture based on optical channel characteristics proposed by the present invention.

[0043] Figure 3 Schematic diagram of receiver digital signal processing of seed key based on optical channel characteristics updated by the present invention. DETAILED DESCRIPTION

[0044] In order to better understand the present invention, the present invention is described in detail below with reference to the accompanying drawings and the following examples:

[0045] The present invention utilizes the special properties of the optical fiber channel, such as randomness, reciprocity, and non-replicability, to generate a seed key internally, and uses the physical optical noise inherent in the optical transmission system as a parameter to express the randomness of the signal physical state and modulate the "basis" that carries user information. However, since illegal users do not know how to generate the signal "basis", they cannot effectively identify the state of the intercepted optical signal.

[0046] Physical layer data encryption in optical networks can effectively, efficiently and flexibly protect data security transmission, which is attractive to network operators and other fields without affecting service performance or optical fiber transmission efficiency. Figure 1 shown.

[0047] The overall scheme includes the optical transmitter (Alice), the optical fiber link, the legal party (Bob) and the optical receiver of the eavesdropping party (EVE). Among them, Alice's transmitter includes a plaintext data generation module, a seed key module, a running key module, a symbol mapping module, a digital-to-analog conversion module, an electro-optical modulation module and a laser. The optical fiber link part is composed of an ordinary standard single-mode fiber (SSMF). The legal party Bob's part includes an optical-to-electrical conversion module, an analog-to-digital conversion module, a symbol digital signal processing module, a symbol phase noise quantization module, a symbol decryption module, a symbol demapping module, a plaintext data recovery module and a secret key extraction module. Among them, the seed key is generated after the symbol phase noise quantization module. The seed key is sent to the transmitter through the key negotiation channel and used as the subsequent decryption key of the receiver. Alice expands the short pre-shared key into a long running key. Unlike Bob's receiver, the eavesdropping party EVE's receiver includes an optical-to-electrical conversion module, an analog-to-digital conversion module, a symbol decryption module, a symbol demapping module and a plaintext data recovery module. In this process, according to quantum signal detection theory, in the process of quantum measurement, due to the non-orthogonality of the coherent state of light and the influence of quantum noise, the eavesdropper cannot accurately distinguish the signal. If the modulation order is further increased, the error probability of the eavesdropper's best quantum receiver in this attack can be close to 0.5. This means that the eavesdropper has no other choice in this attack except pure guessing.

[0048] The processing of the transmitter:

[0049] The plaintext data generation module is used to generate plaintext data and send it to the symbol mapping module;

[0050] The seed key module is used to receive the seed key of the legal party and send the seed key to the running key module after passing the key consistency test and randomness test;

[0051] The running key module expands the seed key by means of a shift register and sends it to the symbol mapping module;

[0052] The symbol mapping module is used to perform symbol mapping between the plaintext data and the expanded seed key, and send the symbol-mapped data to the digital-to-analog conversion module;

[0053] The digital-to-analog conversion module is used to perform digital-to-analog conversion on the data after the symbol mapping module, and send the converted analog data to the electro-optical modulation module;

[0054] The electro-optic modulator module is used to use the optical signal generated by the laser as an optical carrier, modulate the analog data, and transmit the electro-optically modulated signal through an optical fiber link;

[0055] Processing of legal parties:

[0056] The photoelectric conversion module is used to convert the received optical signal and the local oscillator into an electrical signal, and send the analog data after the photoelectric conversion to the analog-to-digital conversion module;

[0057] The analog-to-digital conversion module is used to convert the analog data after the photoelectric conversion into digital data and send it to the symbolic digital signal processing module;

[0058] The symbol digital signal processing module is used to perform digital signal processing on the received data and then send it to the symbol phase noise quantization module;

[0059] The symbol phase noise quantization module is used to perform noise quantization on the phase of the data after digital signal processing, send the data after phase randomness quantization to the key extraction module, and send the data after digital signal processing to the symbol decryption module;

[0060] The key extraction module is used to generate a seed key from the data after phase randomness quantization, and send the generated seed key to the transmitter and the symbol decryption module;

[0061] The symbol decryption module is used to decrypt the data after digital signal processing according to the encryption rules, and send the decrypted data to the symbol demapping module;

[0062] The symbol demapping module is used to demap the decrypted data and send it to the plaintext data recovery module;

[0063] The plaintext data recovery module is used to recover the plaintext data from the demapped data.

[0064] The eavesdropper's processing process:

[0065] The photoelectric conversion module is used to convert the received optical signal and the local oscillator into an electrical signal through a 90-degree mixer;

[0066] The analog-to-digital conversion module is used to convert the analog data after photoelectric conversion into digital signals;

[0067] The symbolic digital signal module is used to perform digital signal processing on the received signal to avoid the influence of various undesirable factors and damages in the physical layer of the optical network;

[0068] The symbol decryption module is used to decrypt the signal after digital signal processing according to the encryption rules;

[0069] The symbol demapping module is used for demapping symbols;

[0070] The plaintext data module is used to recover plaintext data.

[0071] The schematic diagram of the seed key generation architecture based on optical channel characteristics proposed by the present invention is as follows: Figure 2 As shown. After the BOB receiver estimates the carrier phase, the seed key is extracted according to the randomness and uniqueness of the phase noise. Specifically, it includes a phase rotation angle calculation module, a phase rotation angle quantization module and an angle quantization post-processing module.

[0072] The phase rotation angle calculation module is used to calculate the phase rotation of the symbol constellation diagram caused by the line width of the laser and the nonlinearity in the optical fiber transmission process according to the data after digital signal processing;

[0073] The phase rotation angle quantization module is used to quantize the phase rotation angle of the symbol constellation diagram into a random sequence of 0 and 1 by a uniform quantization method;

[0074] The angle quantization post-processing module is used to enhance the key generation rate, consistency rate and randomness of the random sequence of 0 and 1 generated by quantization and send it to the key extraction module.

[0075] Since the field modulation coherent detection mechanism has higher spectral efficiency than the traditional direct detection system, in order to realize the high-speed and long-distance confidential communication system, the present invention adopts the field modulation coherent detection mechanism, thereby ensuring the transmission performance of the system while ensuring secure transmission. The receiver part of the present invention is as follows Figure 3 shown.

[0076] Among them, the signal received by the receiver is mixed with the local oscillator laser through an optical mixer, and then passes through PD and amplification for analog-to-digital conversion (ADC). The symbol digital signal processing module of the subsequent receiver digital signal processing includes a front-end hardware imperfect compensation module, a dispersion compensation module, a timing recovery module, a polarization tracking and equalization module, a frequency estimation module, and a phase estimation module.

[0077] The front-end hardware non-ideal compensation module is used to compensate for the amplitude power imbalance and phase imbalance of the orthogonal components and phase increments of the signal in the digital data based on the Schmidt orthogonal transformation principle;

[0078] The dispersion compensation module is used to compensate for large dispersion in digital data by constructing an optical fiber channel transfer function;

[0079] The timing recovery module is used to correct the deviation of the clocks at both ends of the transmitter and receiver using the Gardner algorithm;

[0080] The polarization tracking and equalization module is used to perform polarization demultiplexing of digital data using a blind equalization algorithm of a constant modulus algorithm and to compensate for signal damage caused by polarization film dispersion of the optical fiber link;

[0081] The frequency estimation module is used to track the carrier frequency using a quartic algorithm and compensate for the carrier frequency offset in the digital data;

[0082] The phase estimation module is used to track the carrier phase using the VV algorithm and compensate for the carrier phase offset in the digital data.

[0083] By using the above digital signal processing technology to compensate for linear and nonlinear damage, the impact of various physical layer damage factors in the optical transmission link can be effectively avoided, so that the coherent receiver can achieve reliable data transmission.

[0084] In summary, the present invention implements a security protection method based on the endogenous optical network physical layer, which performs security protection at the optical network physical layer by generating keys based on simple and easy-to-implement channel characteristics.

[0085] The above description is only a specific implementation of the present invention in the embodiment, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. An endogenous optical network physical layer security protection system, characterized in that: The transmitting side includes: a plaintext data generation module, a seed key module, an operating key module, a symbol mapping module, a digital-to-analog conversion module, an electro-optical modulation module and a laser; the legal side includes: an optical-to-electrical conversion module, an analog-to-digital conversion module, a symbol digital signal processing module, a symbol phase noise quantization module, a symbol decryption module, a symbol demapping module, a plaintext data recovery module and a secret key extraction module; The processing of the transmitter: The plaintext data generation module is used to generate plaintext data and send it to the symbol mapping module; The seed key module is used to receive the seed key of the legal party and send the seed key to the running key module after passing the key consistency test and randomness test; The running key module is used to expand the seed key by means of a shift register and send it to the symbol mapping module; The symbol mapping module is used to perform symbol mapping between the plaintext data and the expanded seed key, and send the symbol-mapped data to the digital-to-analog conversion module; The digital-to-analog conversion module is used to perform digital-to-analog conversion on the data after the symbol mapping module, and send the converted analog data to the electro-optical modulation module; The electro-optic modulator module is used to use the optical signal generated by the laser as an optical carrier, modulate the analog data, and transmit the electro-optically modulated signal through an optical fiber link; Processing of legal parties: The photoelectric conversion module is used to convert the received optical signal and the local oscillator into an electrical signal, and send the analog data after the photoelectric conversion to the analog-to-digital conversion module; The analog-to-digital conversion module is used to convert the analog data after the photoelectric conversion into digital data and send it to the symbolic digital signal processing module; The symbol digital signal processing module is used to perform digital signal processing on the received data and then send it to the symbol phase noise quantization module; The symbol phase noise quantization module is used to perform noise quantization on the phase of the data after digital signal processing, send the data after phase randomness quantization to the key extraction module, and send the data after digital signal processing to the symbol decryption module; The key extraction module is used to generate a seed key from the data after phase randomness quantization, and send the generated seed key to the transmitter and the symbol decryption module; The symbol decryption module is used to decrypt the data after digital signal processing according to the encryption rules, and send the decrypted data to the symbol demapping module; The symbol demapping module is used to demap the decrypted data and send it to the plaintext data recovery module; The plaintext data recovery module is used to recover the plaintext data from the demapped data.

2. According to claim 1, the endogenous optical network physical layer security protection system is characterized in that: The symbol phase noise quantization module includes a phase rotation angle calculation module, a phase rotation angle quantization module and an angle quantization post-processing module; The phase rotation angle calculation module is used to calculate the phase rotation of the symbol constellation diagram caused by the line width of the laser and the nonlinearity in the optical fiber transmission process according to the data after digital signal processing; The phase rotation angle quantization module is used to quantize the phase rotation angle of the symbol constellation diagram into a random sequence of 0 and 1 by a uniform quantization method; The angle quantization post-processing module is used to enhance the key generation rate, consistency rate and randomness of the random sequence of 0 and 1 generated by quantization and send it to the key extraction module.

3. According to claim 1, the endogenous optical network physical layer security protection system is characterized in that: The symbol digital signal processing module includes a front-end hardware imperfect compensation module, a dispersion compensation module, a timing recovery module, a polarization tracking and equalization module, a frequency estimation module, and a phase estimation module; The front-end hardware non-ideal compensation module is used to compensate for the amplitude power imbalance and phase imbalance of the orthogonal components and phase increments of the signal in the digital data based on the Schmidt orthogonal transformation principle; The dispersion compensation module is used to compensate for large dispersion in digital data by constructing an optical fiber channel transfer function; The timing recovery module is used to correct the deviation of the clocks at both ends of the transmitter and receiver using the Gardner algorithm; The polarization tracking and equalization module is used to perform polarization demultiplexing of digital data using a blind equalization algorithm of a constant modulus algorithm and to compensate for signal damage caused by polarization film dispersion of the optical fiber link; The frequency estimation module is used to track the carrier frequency using a quartic algorithm and compensate for the carrier frequency offset in the digital data; The phase estimation module is used to track the carrier phase using the VV algorithm and compensate for the carrier phase offset in the digital data.

Images