Security processing method and device and storage medium

Abstract

The invention discloses a security processing method and device and a storage medium, and belongs to the field of communication. The method comprises the following steps: a first device and a second device perform security processing operation, wherein the security processing operation comprises one or more of the following operations: bidirectional authentication or key negotiation; after the first equipment successfully carries out the safety processing operation, the state of a link between the first equipment and the second equipment is monitored; and the first device re-performs the security processing operation with the second device based on a first moment, wherein the first moment is a moment when the state of the link is monitored to be changed from an online state to an offline state. According to the invention, the communication security can be improved.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a security processing method, device and storage medium. Background Art

[0002] For any two Ethernet devices, for the sake of convenience, the two Ethernet devices are referred to as the first device and the second device. In order to improve the communication security between the first device and the second device, the first device and the second device need to undergo security processing. For example, the security processing includes two-way authentication, and the first device and the second device perform two-way authentication to authenticate whether each other is a legitimate device. After authenticating that each other is a legitimate device, the first device and the second device perform data transmission.

[0003] For another example, the security processing includes key negotiation, which means that a key generation device is elected between the first device and the second device. Assuming that the first device is elected as the key generation device, the first device generates a key and sends the key to the second device. After that, the data to be transmitted between the first device and the second device can be encrypted using the key.

[0004] The security processing may include two processes: two-way authentication and key negotiation. That is, the first device and the second device use two-way authentication. After two-way authentication proves that each other is a legitimate device, key negotiation is used to obtain a key. The first device and the second device use the key to encrypt the transmitted data.

[0005] After the first device and the second device have two-way authentication, the second device goes offline abnormally, but the port on the first device that communicates with the second device is still open. At this time, an illegal device may access the port, which will cause a big security problem. Or, after the illegal device accesses the port, it encounters the situation where the first device sends a key through the port. At this time, the illegal device will receive the key, causing the key to be leaked, which also causes a big security problem. Summary of the invention

[0006] The present application provides a security processing method, device and storage medium to improve communication security. The technical solution is as follows:

[0007] In a first aspect, the present application provides a security processing method, in which a first device performs a security processing operation with a second device, and the security processing operation includes one or more of the following operations: two-way authentication or key negotiation. After successfully performing the security processing operation, the first device monitors the state of a link between the first device and the second device. The first device performs the security processing operation again with the second device based on a first moment, and the first moment is the moment when the state of the link is monitored to change from an online state to an offline state.

[0008] When the second device is replaced with an illegal device or the optical module connected to the second device is replaced with an illegal optical module, the state of the link between the first device and the second device changes from an online state to an offline state. The first device can timely monitor the change in the state of the link at the first moment, so that it can timely re-perform two-way authentication with the second device, so that the illegal device or illegal optical module has no time to communicate with the first device, thereby improving the security of communication. Alternatively, when the second device is replaced with an illegal device, the state of the link between the first device and the second device changes from an online state to an offline state, and the first key may have been leaked. The first device can timely monitor the change in the state of the link at the first moment, so that it can timely re-negotiate the key with the second device and use the second key to communicate, thereby improving the security of communication.

[0009] In a possible implementation, the security processing operation includes two-way authentication, and the first device re-performs two-way authentication with the second device at a first moment, that is, when the state of the link changes from an online state to an offline state, the first device re-performs two-way authentication with the second device. In other words, when the second device is replaced with an illegal device or the optical module connected to the second device is replaced with an illegal optical module, the first device re-performs two-way authentication with the second device in a timely manner, thereby improving the security of communication.

[0010] In another possible implementation, if the state of the link of the first device has changed to an online state at the second moment, the first device re-performs two-way authentication with the second device, and the second moment is located after the first moment and the time difference between the first moment and the second moment is a specified difference. Alternatively, if the state of the link of the first device is still an offline state at the second moment, the first device re-performs two-way authentication with the second device when it is detected that the state of the link changes to an online state after the second moment. The second device may go online or offline frequently. If the second device goes online or offline frequently, delaying the re-perform of two-way authentication between the first device and the second device can avoid frequent two-way authentication and save computing resources and bandwidth resources.

[0011] In another possible implementation, the first device sends a first random number to the second device. The first device receives first authentication information sent by the second device, the first authentication information includes one or more of the following: a second random number of the second device, a device identification of the second device, or first encrypted information, the first encrypted information is obtained by encrypting the first random number, the second random number, and the device identification of the second device. After the first device authenticates the second device based on the first authentication information, the first device sends second authentication information to the second device, the second authentication information includes one or more of the following: a device identification of the first device or second encrypted information, the second encrypted information is obtained by encrypting the second random number and the device identification of the first device, and the second device is used to authenticate the first device based on the second authentication information.

[0012] In another possible implementation, the first encrypted information is obtained by encrypting the module identification of the first optical module, the first random number, the second random number and the device identification of the second device, and the first optical module is an optical module located on the link and connected to the second device. The first device decrypts the first encrypted information to obtain the module identification of the first optical module. When the first device determines that the first optical module is legal based on the module identification of the first optical module, the first device encrypts the first random number, the second random number, the device identification of the second device and the module identification of the first optical module to obtain the third encrypted information. When the first encrypted information and the third encrypted information are the same, the first device authenticates the second device. Since the first encrypted information includes the module identification of the first optical module, when the first optical module is replaced with an illegal optical module, it is ensured that the authentication between the first device and the second device fails, thereby avoiding the first device from communicating with the illegal optical module and improving the security of communication.

[0013] In another possible implementation, the second encrypted information is obtained by encrypting the module identification of the second optical module, the second random number and the device identification of the first device, and the second optical module is an optical module located on the link and connected to the first device. Since the second encrypted information includes the module identification of the second optical module, when the second optical module is replaced with an illegal optical module, it is ensured that the first device and the second device fail to authenticate, and the second device is prevented from communicating with the illegal optical module, thereby improving the security of communication.

[0014] In another possible implementation manner, the first device receives at least one first multiframe sent by the second device, where the at least one first multiframe carries the first authentication information.

[0015] In another possible implementation, each first multiframe in the at least one first multiframe includes m alignment markers AM, where m is an integer greater than 1, and the bits carrying the first authentication information are idle reserved bits included in the 2nd to mth AMs of each first multiframe.

[0016] In another possible implementation, the security processing operation includes key negotiation, and the result obtained by the first device and the second device performing key negotiation includes a first key, and the first key is an encryption and decryption key for data transmitted between the first device and the second device. The result obtained by the first device performing key negotiation again with the second device includes a second key, and the encryption and decryption key for data transmitted between the first device and the second device is changed from the first key to the second key. When the second device is replaced with an illegal device, the state of the link between the first device and the second device changes from an online state to an offline state, and the first key may have been leaked. The first device can timely monitor the change in the state of the link at the first moment, so that it can timely re-negotiate the key with the second device. If the negotiation between the first device and the illegal device fails, the first device stops communicating with the illegal device. If the first device and the second device negotiate a second key, the second key is used for communication, thereby improving the security of communication.

[0017] In a possible implementation, the first device renegotiates the key with the second device at a first moment, that is, when the link status changes from an online state to an offline state, the first device renegotiates the key with the second device. In other words, when the second device is replaced with an illegal device, the first device renegotiates the key with the second device in a timely manner, thereby improving the security of communication.

[0018] In another possible implementation, if the first device detects that the link status has changed to an online state at the second moment, it re-negotiates the key with the second device, and the second moment is after the first moment and the time difference between the first moment and the second moment is a specified difference; or, if the first device detects that the link status is still offline at the second moment, it re-negotiates the key with the second device when it detects that the link status has changed to an online state after the second moment. The second device may go online or offline frequently. If the second device goes online or offline frequently, delaying the re-negotiation of the key between the first device and the second device can avoid frequent key negotiation and save computing resources and bandwidth resources.

[0019] In another possible implementation, the first device sends a first priority to the second device, where the first priority is the priority of the first device. The first device receives a second priority sent by the second device, where the second priority is the priority of the second device. When the first priority is higher than the second priority, the first device generates a first key. The first device sends the first key to the second device.

[0020] In another possible implementation manner, the first device sends at least one second multiframe to the second device, where the at least one second multiframe carries the first priority.

[0021] In another possible implementation, each second multiframe in the at least one second multiframe includes n AMs, where n is an integer greater than 1, and the bits carrying the first priority are idle reserved bits included in the 2nd to nth AMs of each second multiframe.

[0022] In a second aspect, the present application provides a secure processing device for executing the method in the first aspect or any possible implementation of the first aspect. Specifically, the device includes a unit for executing the method in the first aspect or any possible implementation of the first aspect.

[0023] In a third aspect, the present application provides a secure processing device comprising at least one processor and a memory, wherein the at least one processor is used to couple with the memory, read and execute instructions in the memory to implement the method in the first aspect or any possible implementation of the first aspect.

[0024] In a fourth aspect, the present application provides a computer program product, which includes a computer program stored in a computer-readable storage medium, and the computer program is loaded by a processor to implement the method of the above-mentioned first aspect or any possible implementation method of the first aspect.

[0025] In a fifth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program is loaded by a processor to execute the method of the first aspect or any possible implementation of the first aspect.

[0026] In a sixth aspect, the present application provides a chip comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the method of the above-mentioned first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of a security processing solution provided by an embodiment of the present application;

[0028] Figure 2 This is a schematic diagram of a network architecture provided by an embodiment of the present application;

[0029] Figure 3 This is a flow chart of a two-way authentication method provided by an embodiment of the present application;

[0030] Figure 4 This is a flow chart of a key negotiation method provided by an embodiment of the present application;

[0031] Figure 5 It is a flow chart of a security processing method provided by an embodiment of the present application;

[0032] Figure 6 This is another flow chart of a two-way authentication method provided by an embodiment of the present application;

[0033] Figure 7 This is a schematic diagram of a multi-frame structure provided in an embodiment of the present application;

[0034] Figure 8 is a flow chart of another security processing method provided in an embodiment of the present application;

[0035] Fig. 9 is a flow chart of another key negotiation method provided by an embodiment of the present application;

[0036] Fig.10 This is a schematic diagram of a security information frame structure provided by an embodiment of the present application;

[0037] Fig.11 is another flow chart of a secure processing device method provided by an embodiment of the present application;

[0038] Fig.12 is a schematic diagram of the structure of another secure processing device provided in an embodiment of the present application;

[0039] Fig.13 It is a schematic diagram of a device structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0041] See also Figure 1 ,The Ethernet security processing solution may include three solutions, which are ,described one by one below.

[0042] The first solution is the identity authentication mechanism, which refers to the two Ethernet devices communicating with each other to perform two-way authentication. After the two-way authentication is passed, the two Ethernet devices determine that each other is a legitimate device, thereby ensuring that the two Ethernet devices communicating with each other are legitimate devices. Figure 1 The Ethernet device 1 and the Ethernet device 2 shown in the figure use a two-way authentication process to perform mutual identity authentication, thereby ensuring that the Ethernet device 2 communicating with the Ethernet device 1 is a legitimate device, and the Ethernet device 1 communicating with the Ethernet device 2 is a legitimate device.

[0043] The second solution is the key negotiation mechanism, which is a key negotiation mechanism where two communicating Ethernet devices negotiate a key between each other. The key is the encryption and decryption key used for data transmitted between the two Ethernet devices, providing a secure key source for the data encryption and decryption process. Figure 1The Ethernet device 1 and the Ethernet device 2 shown in the figure use a key negotiation mechanism to negotiate a key, and the key is used to encrypt data transmitted between the Ethernet device 1 and the Ethernet device 2.

[0044] The third solution is data encryption, which means using the negotiated key to encrypt the data transmitted between the two Ethernet devices to protect the confidentiality of customer data and upper-layer protocols from being leaked. Figure 1 In the Ethernet device 1 and the Ethernet device 2 shown, the Ethernet device 1 can use the negotiated key to encrypt the first data to be sent to the Ethernet device 2 to obtain the first encrypted data, and send the first encrypted data to the Ethernet device 2, and the Ethernet device 2 can use the key to decrypt the first encrypted data to obtain the first data. Similarly, the Ethernet device 2 uses the negotiated key to encrypt the second data to be sent to the Ethernet device 1 to obtain the second encrypted data, and sends the second encrypted data to the Ethernet device 1, and the Ethernet device 1 can use the key to decrypt the second encrypted data to obtain the second data.

[0045] In some embodiments, for two Ethernet devices, the two Ethernet devices may first use two-way authentication to perform identity authentication. After authenticating that the two devices are legal, the two Ethernet devices may use plain text communication or cipher text communication.

[0046] In the case where the two Ethernet devices communicate in plain text, after the two Ethernet devices authenticate each other as legitimate devices, they believe that the communication between the two Ethernet devices is secure, so one of the Ethernet devices can directly send unencrypted data to the other Ethernet device.

[0047] For example, Figure 1 As shown in the Ethernet device 1 and the Ethernet device 2, after the Ethernet device 1 and the Ethernet device 2 authenticate each other as legitimate devices, the Ethernet device 1 may not encrypt the first data to be sent to the Ethernet device 2, but directly send the first data to the Ethernet device 2; similarly, the Ethernet device 2 may not encrypt the second data to be sent to the Ethernet device 1, but directly send the second data to the Ethernet device 1.

[0048] In the case where the two Ethernet devices use ciphertext communication, after the two Ethernet devices authenticate each other as legitimate devices, the two Ethernet devices perform key negotiation to negotiate a key, so that one of the Ethernet devices uses the key to encrypt data to be sent to the other Ethernet device to obtain ciphertext, and sends the ciphertext to the other Ethernet device.

[0049] For example, Figure 1The Ethernet device 1 and the Ethernet device 2 shown in the figure, after the Ethernet device 1 and the Ethernet device 2 authenticate that each other is a legitimate device, the Ethernet device 1 and the Ethernet device 2 perform key negotiation to negotiate a key. The Ethernet device 1 uses the key to encrypt the first data to be sent to the Ethernet device 2 to obtain the first encrypted data, and sends the first encrypted data to the Ethernet device 2. The Ethernet device 2 uses the key to encrypt the second data to be sent to the Ethernet device 1 to obtain the second encrypted data, and sends the second encrypted data to the Ethernet device 1.

[0050] In some embodiments, for two Ethernet devices, the two Ethernet devices may not undergo identity authentication, and the two Ethernet devices directly perform key negotiation to obtain a key, so that one of the Ethernet devices uses the key to encrypt data to be sent to the other Ethernet device to obtain a ciphertext, and sends the ciphertext to the other Ethernet device.

[0051] Optionally, the two Ethernet devices may belong to the same company or the same organization, and the two devices are legal devices, and identity authentication is not required. Figure 1 The Ethernet device 1 and the Ethernet device 2 shown are two devices of the same organization. The Ethernet device 1 and the Ethernet device 2 perform key negotiation to negotiate a key. The Ethernet device 1 uses the key to encrypt the first data to be sent to the Ethernet device 2 to obtain the first encrypted data, and sends the first encrypted data to the Ethernet device 2. The Ethernet device 2 uses the key to encrypt the second data to be sent to the Ethernet device 1 to obtain the second encrypted data, and sends the second encrypted data to the Ethernet device 1.

[0052] See also Figure 2 , the embodiment of the present application provides a network architecture 200, which includes a first device 201, a second device 202 and a management device 203. The first device 201 and the second device 202 both communicate with the management device 203.

[0053] The first device 201 and the second device 202 may perform security processing, and the management device 203 may provide the first device 201 and the second device 202 with information required for the security processing.

[0054] In some embodiments, the network architecture 200 may be an Ethernet architecture, and the first device 201 and the second device 202 may both be Ethernet devices.

[0055] In some embodiments, the security process may include identity authentication, and the first device 201 may perform two-way authentication with the second device 202 to implement identity authentication. Figure 3 , the two-way authentication process can be:

[0056] The management device 203 sends a first shared key (expressed as PSK) to the first device 201 and the second device 202 .

[0057] The first device 201 receives the first shared key, generates a first random number (denoted by A), and sends the first random number to the second device 202 .

[0058] The second device 202 receives the first shared key and generates a second random number (denoted by B). The first shared key is used to identify the first random number, the second random number, and the device identifier of the second device 202 (denoted by ID B indicates) to encrypt the first encrypted information (using MAC 1 (PSK, A, B and ID B ) indicates). Sending first authentication information to the first device 201, the first authentication information including one or more of the following: a second random number, a device identifier of the second device 202, or first encryption information.

[0059] The first device 201 receives the first authentication information, and uses the first shared key to encrypt the first random number, the second random number, and the device identifier of the second device 202 to obtain the third encrypted information (using MAC 2 (PSK, A, B and ID B )). When the first encryption information and the third encryption information are the same, the second device 202 is authenticated as a legitimate device, that is, the second device 202 is authenticated. The first shared key is used to identify the second random number and the device ID of the first device 201 (using ID A indicates) to encrypt the second encrypted information (using MAC 3 (PSK, B and ID A ) indicates that), second authentication information is sent to the second device 202, and the second authentication information includes the device identification of the first device 201 and the second encryption information.

[0060] The second device 202 receives the second authentication information, encrypts the second random number and the device identification of the first device 201 using the first shared key, and obtains the fourth encrypted information (using MAC 4 (PSK, B and ID A ), when the second encrypted information and the fourth encrypted information are the same, the first device 201 is authenticated as a legitimate device, that is, the first device 201 is authenticated. In this way, a successful two-way authentication is achieved. After a successful two-way authentication, the first device 201 and the second device 202 periodically send handshake keep-alive messages to each other to inform each other of the online status.

[0061] After the first device 201 and the second device 202 successfully perform two-way authentication, the first device 201 includes a first port, the second device 202 includes a second port, the first port of the first device 201 is open and communicates with the second device 202, and the second port of the second device 202 is open and communicates with the first device 201.

[0062] If the second device 202 communicating with the first port of the first device 201 goes offline abnormally, the first device 201 determines that the second device 202 goes offline abnormally only if it does not receive the handshake keep-alive message sent by the second device 202 in multiple consecutive cycles. The cycle length for sending the handshake keep-alive message is relatively long, for example, the cycle length may be 20 seconds, 25 seconds or 30 seconds. The cumulative value of the lengths of the multiple cycles may reach tens of seconds. In the first time period of tens of seconds (such as 90 seconds) after the second device 202 goes offline abnormally, the first device 201 does not determine that the second device 202 goes offline abnormally, and the first port of the first device 201 is still open. In the first time period, an illegal device may replace the second device 202 and communicate with the first port of the first device 201. The illegal device may receive the legitimate data sent by the first device 201, causing data leakage, or send illegal data to the first device 201 to attack the first device 201, which brings great security problems.

[0063] In some embodiments, the security process may include key negotiation, and the first device 201 may negotiate a key with the second device 202 to obtain a first key, where the first key is an encryption and decryption key for data transmitted between the first device 201 and the second device 202. Figure 4 , the key negotiation process can be:

[0064] The management device 203 sends a second shared key (expressed as CAK) to the first device 201 and the second device 202 .

[0065] The first device 201 receives the second shared key and generates a secondary working key (expressed by KEK) based on the second shared key. The second device 202 receives the second shared key and generates a secondary working key (expressed by KEK) based on the second shared key.

[0066] The first device 201 and the second device 202 elect a key generating device.

[0067] Assuming that the elected key generation device is the first device 201, the first device 201 generates a secure random number, generates a first key (expressed as SAK) based on the second shared key and the secure random number, encrypts the first key using the local secondary working key to obtain a ciphertext, and sends the ciphertext to the second device 202. The second device 202 decrypts the ciphertext using the local secondary working key to obtain the first key. In this way, both the first device 201 and the second device 202 obtain the first key and implement key negotiation. After the key negotiation is successful, the first device 201 and the second device 202 periodically send each other hello (Hello) keep-alive messages to inform each other of the online status.

[0068] If the second device 202 communicating with the first port of the first device 201 goes offline abnormally, the first device 201 determines that the second device 202 goes offline abnormally only if it does not receive the Hello keep-alive message sent by the second device 202 in multiple consecutive cycles. The cycle length for sending the Hello keep-alive message is several seconds long, for example, the cycle length may be 3 seconds, 4 seconds or 5 seconds. The cumulative value of the lengths of the multiple cycles may reach several seconds. In the second time period of several seconds (such as 9 seconds) after the second device 202 goes offline abnormally, the first device 201 does not determine that the second device 202 goes offline abnormally, and the first port of the first device 201 is still open. In the second time period, an illegal device may replace the second device 202 and communicate with the first port of the first device 201. If the first device 201 sends the first key in the second time period, the illegal device will receive the first key, resulting in key leakage, which brings great security problems.

[0069] In some embodiments, see Figure 2 The link for communication between the first device 201 and the second device 202 passes through the first optical module 204 and the second optical module 205. The second port of the second device 202 is connected to the first optical module 204, and the first port of the first device 201 is connected to the second optical module 205.

[0070] See also Figure 4When the first optical module 204 and the second optical module 205 are optical modules with encryption and decryption functions, the first device 201 configures the first key to the second optical module 205, and the second device 202 configures the first key to the first optical module 204. When the first device 201 needs to send the first data to the second device 202, it sends the first data to the second optical module 205, and the second optical module 205 encrypts the first data using the first key to obtain the first encrypted data, converts the first encrypted data into a first optical signal, and sends the first optical signal to the first optical module 204. The first optical module 204 converts the first optical signal into the first encrypted data, decrypts the first encrypted data using the first key, obtains the first data, and sends the first data to the second device 202. Similarly, when the second device 202 needs to send second data to the first device 201, it sends the second data to the first optical module 204. The first optical module 204 encrypts the second data using the first key to obtain second encrypted data, converts the second encrypted data into a second optical signal, and sends the second optical signal to the second optical module 205. The second optical module 205 converts the second optical signal into second encrypted data, decrypts the second encrypted data using the first key, obtains second data, and sends the second data to the first device 201.

[0071] After the first device 201 and the second device 202 successfully perform two-way authentication, if the first optical module 204 connected to the second port of the second device 202 is replaced with an illegal optical module, the second device 202 may configure the first key to the illegal optical module, causing the first key to be leaked. In this way, the illegal optical module can decrypt the transmitted encrypted data, causing great security problems for the transmitted data.

[0072] In order to solve the above-mentioned security problems, the first device 201 and the second device 202 can perform security processing through any of the following embodiments.

[0073] See also Figure 5 The present application embodiment provides a security processing method 500, which is applied to Figure 2 In the network architecture 200 shown, the security processing method 500 includes the following two-way authentication process.

[0074] Step 501: The first device and the second device perform two-way authentication.

[0075] Bidirectional authentication is to authenticate the identity of the first device and the second device. The first device and the second device can communicate only when the first device and the second device mutually authenticate that each is a legitimate device.

[0076] In step 501, see Figure 6 , the first device and the second device perform two-way authentication through the following steps 51-57.

[0077] Step 51: The first device sends a first random number to the second device.

[0078] The first random number may be randomly generated by the first device, or randomly generated by the management device and sent to the first device, or a random number stored in the first device.

[0079] The first random number is a random number including a plurality of bits, for example, a random number including 256 bits, or a random number including 128 bits, etc.

[0080] In step 51, the first device sends at least one first multiframe to the second device, the at least one first multiframe carrying a first random number. Optionally, the at least one first multiframe carries the first random number together, and each first multiframe carries part of the first random number.

[0081] See also Figure 7 The first multiframe includes m alignment marker (AM) periods, where m is an integer greater than 1. Each AM period includes an AM and a data portion, so the first multiframe includes m AMs. The first AM serves as a boundary of the first multiframe and is used to locate the start position of the first multiframe. Each AM from the second AM to the m-th AM includes a plurality of reserved bits, some of which are idle. Therefore, the idle reserved bits from the second AM to the m-th AM of each first multiframe can be used to carry the first random number.

[0082] For example, see Figure 7 , assuming m = 39, that is, the first multiframe includes 39 AMs, and for each AM from the 2nd to the 39th AM, the AM includes 12 reserved bits, so the first multiframe has a total of 468 reserved bits, 468 = 39 * 12, * is a multiplication operation. Among the 468 reserved bits, 304 reserved bits are used to transmit security information, so the first multiframe includes 164 idle reserved bits, which can be used to transmit the first random number.

[0083] Assuming that the length of the first random number is 256 bits, a total of 32 bytes, the first device uses two first multiframes to jointly carry the first random number. The idle reserved bits in the 2nd to 39th AM of the first first multiframe carry the first 17 bytes of the first random number, and the idle reserved bits in the 2nd to 39th AM of the second first multiframe carry the last 15 bytes of the first random number.

[0084] Step 52: The second device receives the first random number, and encrypts the first random number, the second random number, and the device identification of the second device to obtain first encrypted information.

[0085] The second random number may be randomly generated by the second device, or randomly generated by the management device and sent to the second device, or a random number stored in the second device.

[0086] The second random number is also a random number including multiple bits, for example, a random number including 256 bits, or a random number including 128 bits.

[0087] In step 52, the second device uses the first shared key to encrypt the first random number, the second random number and the device identification of the second device to obtain first encrypted information. The first shared key is sent by the management device.

[0088] In some embodiments, the second device may read the module identification of the first optical module from the first optical module, and encrypt the first random number, the second random number, the device identification of the second device, and the module identification of the first optical module to obtain the first encrypted information.

[0089] The module identification of the first optical module may include at least one type identification. For example, referring to Table 1 below, at least one type identification in the module identification of the first optical module includes one or more of the following type identifications: vendor organizationally unique identifier (Vendor OUI), vendor part number (Vendor PN), vendor optical module serial number (Vendor serial number, Vendor SN), Year, Month or Day, etc. Year, Month and Day are respectively the year, month and day of the production date of the first optical module.

[0090] Among them, at least one type identifier can be selected from the multiple type identifiers shown in Table 1 as the module identifier of the first optical module, and the principle of selecting the type identifier is to be able to represent the uniqueness of the module identifier of the first optical module. For example, six type identifiers in Table 1 can be selected as the module identifier of the first optical module, and the length of the module identifier of the first optical module is 304 bits.

[0091] Table 1

[0092] length The name of the type identifier describe 24 Vendor OUI Manufacturer Organization Unique Identifier 128 Vendor PN Manufacturer Part Number 128 Vendor SN Manufacturer's optical module serial number 8 Year Optical module production date-year 8 Month Optical module production date-month 8 Day Optical module production date - day

[0093] Step 53: The second device sends first authentication information to the first device, where the first authentication information includes one or more of the following: a second random number, a device identifier of the second device, or first encryption information.

[0094] In step 53, the second device sends at least one second multiframe to the first device, the at least one second multiframe carrying the first authentication information. Optionally, the at least one second multiframe carries the first authentication information together, and each second multiframe carries part of the first authentication information.

[0095] For example, assuming that the second random number includes 32 bytes, the device identification of the second device includes 38 bytes, the first encrypted information includes 140 bytes, and the structure of the second multiframe is Figure 7 The structure of the first multiframe shown is the same, and each second multiframe includes 164 idle reserved bits. Therefore, the second device uses 13 second multiframes to carry the first authentication information.

[0096] Step 54: The first device receives the first authentication information, and authenticates the second device based on the first authentication information.

[0097] In some embodiments, the first device uses the first shared key to encrypt the first random number, the second random number and the device identification of the second device to obtain the third encrypted information. When the first encrypted information and the third encrypted information are the same, the second device is authenticated as a legitimate device, that is, the second device is authenticated.

[0098] In some embodiments, the first device uses the first shared key to decrypt the first encrypted information to obtain the module identification of the first optical module; based on the module identification of the first optical module, determine whether the first optical module is legal. When determining that the first optical module is legal, encrypt the first random number, the second random number, the device identification of the second device, and the module identification of the first optical module to obtain third encrypted information. When the first encrypted information and the third encrypted information are the same, the second device is authenticated as a legal device, that is, the second device is authenticated.

[0099] Optionally, the module identification of the first optical module may include the manufacturer information of the first optical module, and the background of the manufacturer of the first optical module includes the module identification of a legal optical module. Based on the manufacturer information, the first device queries whether the background corresponding to the manufacturer includes the module identification of the first optical module. If it is found that the background corresponding to the manufacturer includes the module identification of the first optical module, it is determined that the first optical module is legal; if it is found that the background corresponding to the manufacturer does not include the module identification of the first optical module, it is determined that the first optical module is illegal.

[0100] Since the first encryption information is obtained by encrypting the module identifier of the first optical module, when the first optical module is replaced with an illegal optical module, the first device will determine the illegal optical module and fail to authenticate the second device. In this way, the first device may not communicate with the second device, thereby avoiding configuring a key for the first optical module and avoiding the first optical module using a key to decrypt encrypted data sent by the first device, thereby improving data security.

[0101] Step 55: After the first device successfully authenticates the second device, the first device encrypts the second random number and the device identification of the first device to obtain second encrypted information.

[0102] In step 55, the second device uses the first shared key to encrypt the second random number and the device identification of the first device to obtain second encrypted information. The first shared key is sent by the management device.

[0103] In some embodiments, the first device may read the module identification of the second optical module from the second optical module, and encrypt the second random number, the device identification of the first device, and the module identification of the second optical module to obtain the second encrypted information.

[0104] Step 56: The first device sends second authentication information to the second device, where the second authentication information includes one or more of the following: a device identifier of the first device or second encryption information.

[0105] In step 56, the first device sends at least one third multiframe to the second device, the at least one third multiframe carrying the second authentication information. Optionally, the at least one third multiframe carries the second authentication information together, and each third multiframe carries part of the second authentication information.

[0106] For example, assuming that the device identification of the first device includes 38 bytes, the second encrypted information includes 108 bytes, and the structure of the third multiframe is Figure 7 The structure of the first multiframe shown is the same, and each third multiframe includes 164 idle reserved bits. Therefore, the first device uses 9 third multiframes to carry the second authentication information.

[0107] Step 57: The second device receives the second authentication information, and authenticates the first device based on the second authentication information.

[0108] In some embodiments, the first device uses the first shared key to encrypt the second random number and the device identification of the first device to obtain fourth encrypted information. When the second encrypted information and the fourth encrypted information are the same, the first device is authenticated as a legitimate device, that is, the first device is authenticated.

[0109] In some embodiments, the first device uses the first shared key to decrypt the second encrypted information to obtain the module identification of the second optical module; based on the module identification of the second optical module, determine whether the second optical module is legal. When determining that the second optical module is legal, encrypt the second random number, the device identification of the first device, and the module identification of the second optical module to obtain fourth encrypted information. When the first encrypted information and the fourth encrypted information are the same, the first device is authenticated as a legal device, that is, the first device is authenticated.

[0110] Since the second encryption information is obtained by encrypting the module identifier of the second optical module, when the second optical module is replaced with an illegal optical module, the second device will determine the illegal optical module and fail to authenticate the first device. In this way, the second device may not communicate with the first device, thereby avoiding configuring a key for the second optical module and avoiding the second optical module using a key to decrypt encrypted data sent by the second device, thereby improving data security.

[0111] Step 502: After the first device passes the two-way authentication with the second device, the first device monitors the status of the link between the first device and the second device.

[0112] In some embodiments, after the first device and the second device pass the two-way authentication, the first device may send data to the second device, and / or the second device may send data to the first device.

[0113] In some embodiments, after the first device and the second device pass the two-way authentication, the first device and the second device negotiate a key. For details on the negotiation process, see the following Figure 8 The illustrated embodiment will not be described in detail here.

[0114] A link is established between the first device and the second device, and the state of the link is an online state. The link is used to transmit data between the first device and the second device. When the second device is abnormally offline or the first optical module connected to the second device is replaced with an illegal optical module, the state of the link automatically changes from an online state to an offline state, and the first device can immediately detect that the state of the link changes from an online state to an offline state.

[0115] Since the first device monitors the status of the link, it can determine whether the second device is offline through the status of the link, so there is no need to periodically send handshake keep-alive messages to the second device, thereby saving bandwidth resources.

[0116] Step 503: The first device re-performs bidirectional authentication with the second device based on the first time, where the first time is the time when the state of the link is monitored to change from an online state to an offline state.

[0117] In step 503, the following two modes may be used to re-perform two-way authentication with the second device, the two modes being a high security mode and a high usability mode.

[0118] For the high security mode, the first device re-performs bidirectional authentication with the second device at the first moment, that is, when the first device detects that the link status changes from the online state to the offline state, it re-performs bidirectional authentication with the second device. The process of bidirectional authentication refers to the process of step 501, which will not be described in detail here.

[0119] For the high usability mode, the first device monitors the state of the link at the second moment. If the state of the link has changed to the online state, the first device performs two-way authentication with the second device again, and the second moment is after the first moment and the time difference between the first moment and the second moment is a specified difference. If the state of the link is still offline, when the state of the link changes to the online state after the second moment, the first device performs two-way authentication with the second device again. The process of two-way authentication refers to the process of step 501, which will not be described in detail here.

[0120] The second device may go online or offline frequently due to unstable line connection, causing the link status to frequently switch between the online state and the offline state. The high usability mode can be applied to the situation where the second device frequently goes online or offline, causing the link status to frequently switch between the online state and the offline state, and can avoid frequent re-authentication with the second device in this situation, so as to save computing resources and bandwidth resources.

[0121] Next, an example of implementing a high usability mode is listed, in which: the first device starts the timer at the first moment, and the service transmitted between the first device and the second device is not blocked. When the time length reaches the specified difference, this is the second moment, and the status of the link is monitored. If the status of the link has changed to an online state, the service transmitted between the first device and the second device is blocked, and two-way authentication is performed again with the second device. If the status of the link is still an offline state, the timer is restarted to start timing, and the status of the link is continuously monitored. When it is detected that the status of the link has changed to an online state, two-way authentication is performed again with the second device, and the service transmitted between the first device and the second device is still not blocked.

[0122] Among them, when the second device is abnormally offline and the illegal device communicates with the first port of the first device, or when the first optical module connected to the second device is replaced with an illegal optical module, the state of the link automatically changes from the online state to the offline state, and the first device immediately detects that the state of the link changes from the online state to the offline state. In this way, the first device can detect these abnormal situations in time, so that it can re-perform two-way authentication in time without waiting for a period of time. After re-two-way authentication, the first device will fail to authenticate the opposite device and will stop communicating through the first port.

[0123] In an embodiment of the present application, the first device and the second device perform a two-way authentication. After the first device and the second device have mutually authenticated that they are fully legal devices, the first device monitors the state of the link between the first device and the second device. The first device can promptly detect whether the second device is abnormally offline or the first optical module connected to the second device is replaced with an illegal optical module through the state of the link, so that it does not need to wait for tens of seconds to re-perform a two-way authentication with the second device. In this way, it can be authenticated that the opposite device communicating with the first device is an illegal device or the optical module is an illegal optical module, and the first device stops sending and receiving data through the first port, thereby improving security.

[0124] See also Figure 8 The present application embodiment provides a security processing method 800, which is applied to Figure 2 In the network architecture 200 shown, the security processing method 800 includes the following key negotiation process.

[0125] Step 801: A first device negotiates a key with a second device to obtain a first key, where the first key is an encryption and decryption key for data transmitted between the first device and the second device.

[0126] In step 801, the first device and the second device elect a key generating device. Assuming that the key generating device is the first device, the first device generates a first key and sends the first key to the second device.

[0127] See also Fig. 9 , the first device and the second device perform key negotiation through the following steps 81-86.

[0128] Step 81: The first device sends a first priority to the second device, where the first priority is the priority of the first device.

[0129] In some embodiments, the first priority may be assigned to the first device by a management device, or the first priority may be device information of the first device, for example, the first priority may be a media access control (MAC) address, an Internet protocol (IP) address or a serial number of the first device.

[0130] In step 81, the first device sends at least one fourth multiframe to the second device, where the at least one fourth multiframe carries the first priority.

[0131] For each fourth multiframe in the at least one fourth multiframe, each fourth multiframe includes n AM cycles, where n is an integer greater than 1, and each AM cycle includes an AM and a data portion, so each fourth multiframe includes n AMs. The idle reserved bits included in the 2nd to nth AMs of each fourth multiframe carry the first priority.

[0132] Step 82: The second device receives the first priority, and sends a second priority to the first device, where the second priority is the priority of the second device.

[0133] In some embodiments, the second priority may be assigned to the second device by the management device, or the second priority may be device information of the second device, for example, the second priority may be the MAC address, IP address or serial number of the second device.

[0134] In step 82, the second device sends at least one fifth multiframe to the first device, where the at least one fifth multiframe carries the second priority.

[0135] Assume that, in this embodiment of the present application, the first priority is greater than the second priority.

[0136] Step 83: The first device receives the first priority, and sends a key parameter to the second device when the first priority is greater than the second priority.

[0137] When the first device determines that the first priority is greater than the second priority, the first device is selected as the key generation device to generate a key, and then configures key parameters and sends the key parameters to the second device.

[0138] In some embodiments, the key parameters include one or more of: an encryption algorithm or a key length.

[0139] In step 83, the first device sends at least one sixth multiframe to the second device, where the at least one sixth multiframe carries the key parameter.

[0140] Step 84: The second device receives the key parameters, and when the first priority is greater than the second priority, sends consent information to the first device, where the consent information is used to indicate consent for the first device to generate the key and the key parameters sent by the first device.

[0141] When the second device determines that the first priority is greater than the second priority, it also selects the first device as the key generating device, agrees that the first device will generate the key and agrees to the key parameters sent by the first device, and thus sends the consent information to the first device.

[0142] In step 84, the first device sends at least one seventh multiframe to the second device, where the at least one seventh multiframe carries the consent information.

[0143] Step 85: The first device receives the consent information, generates a first key, and sends the first key to the second device.

[0144] In step 85, the first device generates a secure random number, generates a first key based on the second shared key and the secure random number, encrypts the first key using the local secondary working key to obtain a ciphertext, and sends the ciphertext to the second device.

[0145] In some embodiments, the first device encrypts the secure random number using the second shared key to obtain the first key.

[0146] In step 85, the first device sends at least one eighth multiframe to the second device, where the at least one eighth multiframe carries the first key.

[0147] Step 86: The second device receives the first key.

[0148] In step 86, the second device receives the ciphertext and uses the local secondary working key to decrypt the ciphertext to obtain the first key.

[0149] The first multiframe, the second multiframe, the third multiframe, the fourth multiframe, the fifth multiframe, the sixth multiframe, the seventh multiframe and the eighth multiframe may all be multiframes with the same structure. Figure 7 The multiframe structure shown in the figure, in which the eight multiframes are Figure 7 The multiframe structure shown, Figure 7 The 164 idle reserved bits in the multiframe shown may constitute a safety information frame.

[0150] See also Fig.10 The security information frame includes a type (Type), a length (Length), a message number (Message Number, MN), a segment number (Segment Number, SN) and a data part (Data). See the meaning of multiple fields in the security information frame shown in Table 2 below.

[0151] Table 2

[0152]

[0153] Step 802: After completing the key negotiation, the first device monitors the status of the link between the first device and the second device.

[0154] A link is established between the first device and the second device, and the state of the link is an online state. The link is used to transmit data between the first device and the second device. When the second device is abnormally offline or the first optical module connected to the second device is replaced with an illegal optical module, the state of the link automatically changes from an online state to an offline state, and the first device can immediately detect that the state of the link changes from an online state to an offline state.

[0155] Since the first device monitors the status of the link, it can determine whether the second device is abnormally offline or the first optical module connected to the second device is replaced by an illegal optical module through the status of the link. Therefore, there is no need to periodically send Hello keep-alive messages to the second device, thereby saving bandwidth resources.

[0156] In some embodiments, after completing the key negotiation, when the first device needs to send the first data to the second device, it uses the first key to encrypt the first data, obtains the first encrypted data, and sends the first encrypted data to the second device. The second device receives the first encrypted data and decrypts the first encrypted information using the first key to obtain the first data. Alternatively, when the second device needs to send the second data to the first device, it uses the first key to encrypt the second data to obtain the second encrypted data, and sends the second encrypted data to the first device. The first device receives the second encrypted data and decrypts the second encrypted information using the first key to obtain the second data.

[0157] In some embodiments, after completing the key negotiation, when the first optical module and the second optical module are optical modules with encryption and decryption functions, the first device configures the first key to the second optical module, and the second device configures the first key to the first optical module. When the first device needs to send the first data to the second device, it sends the first data to the second optical module, the second optical module encrypts the first data using the first key to obtain the first encrypted data, converts the first encrypted data into a first optical signal, and sends the first optical signal to the first optical module. The first optical module converts the first optical signal into the first encrypted data, decrypts the first encrypted data using the first key, obtains the first data, and sends the first data to the second device. Similarly, when the second device needs to send the second data to the first device, it sends the second data to the first optical module, the first optical module encrypts the second data using the first key to obtain the second encrypted data, converts the second encrypted data into a second optical signal, and sends the second optical signal to the second optical module; the second optical module converts the second optical signal into the second encrypted data, decrypts the second encrypted data using the first key, obtains the second data, and sends the second data to the first device.

[0158] Step 803: The first device renegotiates a key with the second device based on the first moment to obtain a second key. The first moment is the moment when the link status is monitored to change from an online state to an offline state, and the encryption and decryption key of the data transmitted between the first device and the second device is changed from the first key to the second key.

[0159] In step 803, the following two modes may be used to re-negotiate the key with the second device. The two modes are a high security mode and a high usability mode.

[0160] For the high security mode, the first device re-negotiates the key with the second device at the first moment, that is, when the first device detects that the link status changes from the online state to the offline state, it re-negotiates the key with the second device. The key negotiation process refers to the process of step 801, which will not be described in detail here.

[0161] For the high usability mode, the first device monitors the state of the link at the second moment. If the state of the link has changed to the online state, the first device re-negotiates the key with the second device, and the second moment is after the first moment and the time difference between the first moment and the second moment is a specified difference. If the state of the link is still offline, the first device re-negotiates the key with the second device when it is detected that the state of the link has changed to the online state after the second moment. The key negotiation process refers to the process of step 801, which will not be described in detail here.

[0162] Next, an example of implementing a high usability mode is listed, in which: the first device starts the timer at the first moment, and the service transmitted between the first device and the second device is not blocked at this moment. When the time length reaches the specified difference, this is the second moment, and the state of the link is monitored. If the state of the link has changed to an online state, the service transmitted between the first device and the second device is blocked, and the key negotiation is performed again with the second device. If the state of the link is still an offline state, the timer is restarted to start timing, and the state of the link is continuously monitored. When it is detected that the state of the link has changed to an online state, the key negotiation is performed again with the second device, and the service transmitted between the first device and the second device is still not blocked.

[0163] Among them, when the second device is abnormally offline and the illegal device communicates with the first port of the first device, or when the first optical module connected to the second device is replaced by an illegal optical module, the state of the link automatically changes from the online state to the offline state, and the first device immediately detects that the state of the link changes from the online state to the offline state. In this way, the first device can detect these abnormal situations in time, and in this abnormal situation, the first key may have been leaked, and continuing to use the first key for communication will cause great security problems. Since the first device can detect these abnormal situations in time, it does not need to wait for a period of time and can promptly renegotiate the key to improve security.

[0164] In some embodiments, see Fig.11, the first device can first perform two-way authentication with the second device. After the first device and the second device pass the two-way authentication, the first device and the second device negotiate a key to obtain a first key. Then the first device monitors the link between the first device and the second device, and uses the first key as the encryption and decryption key for the data transmitted between the first device and the second device. After monitoring that the state of the link changes from an online state to an offline state at the first moment, the first device re-performs two-way authentication with the second device based on the first moment. After the first device re-performs two-way authentication with the second device and passes the two-way authentication, the first device re-negotiates a key with the second device to obtain a second key, and the encryption and decryption key for the data transmitted between the first device and the second device is changed from the first key to the second key.

[0165] In the embodiment of the present application, the first device performs key negotiation with the second device. After the first device and the second device complete the key negotiation, the first device monitors the state of the link between the first device and the second device. The first device can timely find out whether the second device is abnormally offline or the first optical module connected to the second device is replaced with an illegal optical module through the state of the link, so that the key negotiation can be re-performed without waiting for several seconds. This can avoid using the leaked first key for communication, thereby improving security.

[0166] See also Fig.12 The present application embodiment provides a security processing device 1200, which is deployed in Figure 2 The first device in the network architecture 200 is deployed Figure 5 The method 500 is shown as a first device, or deployed on Figure 8 The method 800 is shown on a first device, including:

[0167] The processing unit 1201 is configured to perform a security processing operation with the second device, wherein the security processing operation includes one or more of the following operations: two-way authentication or key negotiation;

[0168] A monitoring unit 1202, configured to monitor the state of a link between the apparatus 1200 and a second device after the security processing operation is successfully performed;

[0169] The processing unit 1201 is further configured to re-perform the security processing operation with the second device based on the first moment, where the first moment is the moment when the state of the link is monitored to change from an online state to an offline state.

[0170] Optionally, the detailed implementation process of the processing unit 1201 performing the security processing operation is shown in Figure 5 Step 501 of the method 500 or Figure 8 The relevant contents in step 801 of the method 800 are not described in detail here.

[0171] Optionally, the detailed implementation process of the monitoring unit 1202 link status can be found in Figure 5 Step 502 of method 500 or Figure 8 The relevant contents in step 802 of the method 800 are not described in detail here.

[0172] Optionally, the detailed implementation process of the processing unit 1201 re-performing the security processing operation with the second device based on the first moment is shown in Figure 5 Step 503 of method 500 or Figure 8 The relevant contents in step 803 of the method 800 are not described in detail here.

[0173] Optionally, the security processing operation includes two-way authentication, and the processing unit 1201 is configured to:

[0174] re-perform two-way authentication with the second device at the first moment; or,

[0175] At the second moment, the link state has changed to the online state, and then re-performs the two-way authentication with the second device, the second moment is after the first moment, and the time difference between the first moment and the second moment is a specified difference; or,

[0176] If the link is still in an offline state at the second moment, then when it is detected that the link is online after the second moment, two-way authentication is performed again with the second device.

[0177] Optionally, the apparatus 1200 includes a first sending unit 1203 and a first receiving unit 1204;

[0178] A first sending unit 1203, configured to send a first random number to a second device;

[0179] The first receiving unit 1204 is used to receive first authentication information sent by the second device, where the first authentication information includes one or more of the following: a second random number of the second device, a device identifier of the second device, or first encrypted information, where the first encrypted information is obtained by encrypting the first random number, the second random number, and the device identifier of the second device;

[0180] The first sending unit 1203 is used to send second authentication information to the second device after the processing unit 1201 successfully authenticates the second device based on the first authentication information. The second authentication information includes one or more of the following: a device identification of the device 1200 or second encryption information. The second encryption information is obtained by encrypting a second random number and the device identification of the device 1200. The second device is used to authenticate the device 1200 based on the second authentication information.

[0181] Optionally, the detailed implementation process of the first sending unit 1203 sending the first random number is shown in Figure 6 The relevant contents in step 51 of the method shown will not be described in detail here.

[0182] Optionally, the detailed implementation process of the first receiving unit 1204 receiving the first authentication information is as follows: Figure 6 The relevant contents in step 54 of the method shown will not be described in detail here.

[0183] Optionally, the detailed implementation process of the first sending unit 1203 sending the second authentication information is shown in Figure 6 The relevant contents in step 56 of the method shown will not be described in detail here.

[0184] Optionally, the first encrypted information is obtained by encrypting a module identifier of the first optical module, a first random number, a second random number, and a device identifier of the second device, the first optical module is an optical module located on the link and connected to the second device, and the processing unit 1201 is used to:

[0185] Decrypting the first encrypted information to obtain a module identifier of the first optical module;

[0186] When the first optical module is determined to be legitimate based on the module identifier of the first optical module, the first random number, the second random number, the device identifier of the second device, and the module identifier of the first optical module are encrypted to obtain third encrypted information;

[0187] When the first encryption information and the third encryption information are the same, the second device is authenticated successfully.

[0188] Optionally, the detailed implementation process of the processing unit 1201 decrypting the first encrypted information can be found in Figure 6 The relevant contents in step 54 of the method shown will not be described in detail here.

[0189] Optionally, the detailed implementation process of the processing unit 1201 obtaining the third encrypted information is shown in Figure 6 The relevant contents in step 54 of the method shown will not be described in detail here.

[0190] Optionally, when the first encryption information and the third encryption information are the same, the processing unit 1201 authenticates the second device. Figure 6 The relevant contents in step 54 of the method shown will not be described in detail here.

[0191] Optionally, the second encrypted information is obtained by encrypting a module identifier of a second optical module, a second random number and a device identifier of the apparatus 1200 , and the second optical module is an optical module located on the link and connected to the apparatus 1200 .

[0192] Optionally, the first receiving unit 1204 is used to receive at least one multiframe sent by the second device, where the at least one multiframe carries the first authentication information.

[0193] Optionally, the detailed implementation process of the first receiving unit 1204 receiving at least one multiframe is shown in Figure 6 The relevant contents in step 54 of the method shown will not be described in detail here.

[0194] Optionally, each multiframe in the at least one multiframe includes m alignment markers AM, where m is an integer greater than 1, and the bits carrying the first authentication information are idle reserved bits included in the 2nd to mth AMs of each multiframe.

[0195] Optionally, the security processing operation includes key negotiation, and a result obtained by the processing unit 1201 performing key negotiation with the second device includes a first key, where the first key is an encryption and decryption key for data transmitted between the apparatus 1200 and the second device;

[0196] The result obtained by the processing unit 1201 re-negotiating the key with the second device includes the second key, and the encryption and decryption key of the data transmitted between the apparatus 1200 and the second device is changed from the first key to the second key.

[0197] Optionally, the processing unit 1201 is configured to:

[0198] re-negotiate the key with the second device at the first moment; or,

[0199] When it is detected at a second time that the link status has become online, the key negotiation is performed again with the second device, the second time is after the first time and the time difference between the first time and the second time is a specified difference; or,

[0200] If it is detected at the second moment that the link is still in an offline state, then after the second moment, when it is detected that the link is changed to an online state, key negotiation is performed again with the second device.

[0201] Optionally, the apparatus 1200 further includes a second sending unit 1205 and a second receiving unit 1206;

[0202] A second sending unit 1205 is used to send a first priority to a second device, where the first priority is the priority of the apparatus 1200;

[0203] A second receiving unit 1206, configured to receive a second priority sent by a second device, where the second priority is a priority of the second device;

[0204] The processing unit 1201 is used to generate a first key when the first priority is higher than the second priority;

[0205] The second sending unit 1205 is further configured to send the first key to the second device.

[0206] Optionally, the detailed implementation process of the second sending unit 1205 sending the first priority is shown in Fig. 9 The relevant contents in step 81 of the method shown will not be described in detail here.

[0207] Optionally, the detailed implementation process of the second receiving unit 1206 receiving the second priority sent by the second device can be found in Fig. 9 The relevant contents in step 83 of the method shown will not be described in detail here.

[0208] Optionally, the detailed implementation process of the processing unit 1201 generating the first key is shown in Fig. 9 The relevant contents in step 85 of the method shown will not be described in detail here.

[0209] Optionally, the detailed implementation process of the second sending unit 1205 sending the first key can be found in Fig. 9 The relevant contents in step 85 of the method shown will not be described in detail here.

[0210] Optionally, the second sending unit 1205 is used to send at least one multiframe to the second device, where the at least one multiframe carries the first priority.

[0211] Optionally, the detailed implementation process of the second sending unit 1205 sending at least one multiframe is shown in Fig. 9 The relevant contents in step 81 of the method shown will not be described in detail here.

[0212] Optionally, each second multiframe in the at least one second multiframe includes n AMs, where n is an integer greater than 1, and the bits carrying the first priority are idle reserved bits included in the 2nd to nth AMs of each second multiframe.

[0213] In an embodiment of the present application, the processing unit performs two-way authentication or key negotiation with the second device. The monitoring unit monitors the state of the link between the device and the second device. The processing unit re-performs two-way authentication or key negotiation with the second device based on the first moment. When the second device is replaced with an illegal device or the optical module connected to the second device is replaced with an illegal optical module, the state of the link between the device and the second device changes from an online state to an offline state, and the monitoring unit can timely monitor the change in the state of the link at the first moment, so that the processing unit can timely re-perform two-way authentication with the second device, so that the illegal device or illegal optical module has no time to communicate with the device, or after the processing unit negotiates a second key with the second device, the second key is used to communicate, thereby improving the security of communication.

[0214] See also Fig.13 , the present application embodiment provides a schematic diagram of a device 1300. The device 1300 may be Figure 2 The first device of the network architecture 200 shown in FIG. 1 , or the device 1300 may be Figure 5 The first device in the method 500 shown, or the device 1300 may be Figure 8 The first device in the method 800 is shown. The device 1300 includes at least one processor 1301 , an internal connection 1302 , a memory 1303 and at least one transceiver 1304 .

[0215] The device 1300 is a hardware structure device that can be used to implement Fig.12 The functional modules in the device 1100 are as follows. For example, those skilled in the art may think of Fig.12 The processing unit 1201 and the monitoring unit 1202 in the device 1200 shown in the figure can be implemented by the at least one processor 1301 calling the code in the memory 1303. Fig.12 The first sending unit 1203 , the first receiving unit 1204 , the second sending unit 1205 , and the second receiving unit 1206 in the illustrated device 1200 may be implemented by the at least one transceiver 1304 .

[0216] The device 1300 may also be used to implement the function of the first device in any of the above embodiments.

[0217] The processor 1301 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0218] The internal connection 1302 may include a path to transmit information between the components. The internal connection 1302 may be a single board or a bus.

[0219] The at least one transceiver 1304 is used to communicate with other devices or communication networks.

[0220] The memory 1303 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0221] The memory 1303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 1301. The processor 1301 is used to execute the application code stored in the memory 1303, and cooperate with at least one transceiver 1304, so that the device 1300 implements the functions of the method of the present patent.

[0222] In a specific implementation, as an embodiment, the processor 1301 may include one or more CPUs, such as Fig.13 CPU0 and CPU1 in.

[0223] In a specific implementation, as an embodiment, the device 1300 may include multiple processors, such as Fig.13 1301 and processor 1307 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0224] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0225] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A safe processing method, characterized in that: The method comprises: The first device performs a security processing operation with the second device, wherein the security processing operation includes one or more of the following operations: two-way authentication or key negotiation; After successfully performing the security processing operation, the first device monitors a state of a link between the first device and the second device; The first device re-performs the security processing operation with the second device based on a first moment, where the first moment is a moment when the state of the link is monitored to change from an online state to an offline state.

2. The method according to claim 1, characterized in that The security processing operation includes two-way authentication, and the first device re-performs the security processing operation with the second device based on the first moment, including: The first device re-performs two-way authentication with the second device at the first moment; or, If the state of the link of the first device has become online at the second moment, the first device re-performs two-way authentication with the second device, the second moment is after the first moment and the time difference between the first moment and the second moment is a specified difference; or If the state of the link of the first device is still offline at the second moment, then when the state of the link is detected to be online after the second moment, the first device performs two-way authentication with the second device again.

3. The method according to claim 2, characterized in that The first device and the second device perform a security processing operation, including: The first device sends a first random number to the second device; The first device receives first authentication information sent by the second device, where the first authentication information includes one or more of the following: a second random number of the second device, a device identifier of the second device, or first encrypted information, where the first encrypted information is obtained by encrypting the first random number, the second random number, and the device identifier of the second device; After the first device successfully authenticates the second device based on the first authentication information, the first device sends second authentication information to the second device, where the second authentication information includes one or more of the following: a device identification of the first device or second encrypted information, where the second encrypted information is obtained by encrypting the second random number and the device identification of the first device, and the second device is used to authenticate the first device based on the second authentication information.

4. The method according to claim 3, characterized in that The first encrypted information is obtained by encrypting a module identifier of a first optical module, the first random number, the second random number, and a device identifier of the second device, the first optical module is an optical module located on the link and connected to the second device, and the method further includes: The first device decrypts the first encrypted information to obtain a module identifier of the first optical module; When the first device determines that the first optical module is legal based on the module identifier of the first optical module, the first device encrypts the first random number, the second random number, the device identifier of the second device, and the module identifier of the first optical module to obtain third encrypted information; When the first encryption information and the third encryption information are the same, the first device successfully authenticates the second device.

5. The method according to claim 4, characterized in that The second encrypted information is obtained by encrypting the module identifier of the second optical module, the second random number and the device identifier of the first device, and the second optical module is an optical module located on the link and connected to the first device.

6. The method according to any one of claims 3 to 5, characterized in that: The first device receives first authentication information sent by the second device, including: The first device receives at least one first multiframe sent by the second device, where the at least one first multiframe carries the first authentication information.

7. The method according to claim 6, characterized in that Each first multiframe in the at least one first multiframe includes m alignment markers AM, where m is an integer greater than 1, and the bits carrying the first authentication information are idle reserved bits included in the 2nd to mth AMs of each first multiframe.

8. The method according to any one of claims 1 to 7, characterized in that The security processing operation includes key negotiation, and a result obtained by the first device and the second device performing key negotiation includes a first key, where the first key is an encryption and decryption key for data transmitted between the first device and the second device; A result obtained by the first device re-negotiating the key with the second device includes a second key, and an encryption and decryption key for data transmitted between the first device and the second device is changed from the first key to the second key.

9. The method according to claim 8, characterized in that The first device re-performs the security processing operation with the second device based on the first moment, including: The first device renegotiates a key with the second device at the first moment; or, The first device detects that the link state has become online at a second moment, and then re-negotiates a key with the second device, the second moment is after the first moment, and the time difference between the first moment and the second moment is a specified difference; or, If the first device detects that the link state is still offline at the second moment, then when the first device detects that the link state changes to the online state after the second moment, the first device performs key negotiation with the second device again.

10. The method according to claim 8 or 9, characterized in that The first device and the second device perform a security processing operation, including: The first device sends a first priority to the second device, where the first priority is the priority of the first device; The first device receives a second priority sent by the second device, where the second priority is the priority of the second device; The first device generates the first key when the first priority is higher than the second priority; The first device sends the first key to the second device.

11. The method according to claim 10, characterized in that The first device sending a first priority to the second device includes: The first device sends at least one second multiframe to the second device, where the at least one second multiframe carries the first priority.

12. The method according to claim 11, characterized in that Each second multiframe in the at least one second multiframe includes n AMs, where n is an integer greater than 1, and the bits carrying the first priority are idle reserved bits included in the 2nd to nth AMs of each second multiframe.

13. A secure processing device, characterized in that: The device comprises: A processing unit, configured to perform a security processing operation with a second device, wherein the security processing operation includes one or more of the following operations: two-way authentication or key negotiation; a monitoring unit, configured to monitor the state of a link between the apparatus and the second device after the security processing operation is successfully performed; The processing unit is further used to re-perform the security processing operation with the second device based on a first moment, where the first moment is a moment when the state of the link is monitored to change from an online state to an offline state.

14. The device according to claim 13, characterized in that The security processing operation includes two-way authentication, and the processing unit is used to: Re-perform two-way authentication with the second device at the first moment; or, At a second moment, the state of the link has become an online state, then re-perform bidirectional authentication with the second device, the second moment is located after the first moment and the time difference between the first moment and the second moment is a specified difference; or, If the link state is still offline at the second moment, then when it is detected that the link state changes to online state after the second moment, two-way authentication is performed again with the second device.

15. The device according to claim 13 or 14, characterized in that The device comprises a first sending unit and a first receiving unit; The first sending unit is used to send a first random number to the second device; The first receiving unit is used to receive first authentication information sent by the second device, where the first authentication information includes one or more of the following: a second random number of the second device, a device identifier of the second device, or first encrypted information, where the first encrypted information is obtained by encrypting the first random number, the second random number, and the device identifier of the second device; The first sending unit is used to send second authentication information to the second device after the processing unit successfully authenticates the second device based on the first authentication information, the second authentication information includes one or more of the following: a device identification of the device or second encryption information, the second encryption information is obtained by encrypting the second random number and the device identification of the device, and the second device is used to authenticate the device based on the second authentication information.

16. The device according to claim 15, characterized in that The first encrypted information is obtained by encrypting a module identifier of a first optical module, the first random number, the second random number, and a device identifier of the second device, the first optical module is an optical module located on the link and connected to the second device, and the processing unit is used to: decrypting the first encrypted information to obtain a module identifier of the first optical module; When it is determined that the first optical module is legitimate based on the module identifier of the first optical module, encrypting the first random number, the second random number, the device identifier of the second device, and the module identifier of the first optical module to obtain third encrypted information; When the first encryption information and the third encryption information are the same, the second device is authenticated successfully.

17. The device according to claim 16, characterized in that The second encrypted information is obtained by encrypting the module identification of the second optical module, the second random number and the device identification of the device, and the second optical module is an optical module located on the link and connected to the device.

18. The device according to any one of claims 15 to 17, characterized in that: The first receiving unit is used to receive at least one first multiframe sent by the second device, where the at least one first multiframe carries the first authentication information.

19. The device according to claim 18, characterized in that Each multiframe in the at least one first multiframe includes m AMs, where m is an integer greater than 1, and the bits carrying the first authentication information are idle reserved bits included in the 2nd to mth AMs of each first multiframe.

20. The device according to any one of claims 13 to 19, characterized in that The security processing operation includes key negotiation, and a result obtained by the processing unit performing key negotiation with the second device includes a first key, where the first key is an encryption and decryption key for data transmitted between the apparatus and the second device; The result obtained by the processing unit re-negotiating the key with the second device includes a second key, and the encryption and decryption key of the data transmitted between the apparatus and the second device is changed from the first key to the second key.

21. The device according to claim 20, characterized in that The processing unit is used for: Re-negotiate the key with the second device at the first time; or, When it is detected at a second moment that the state of the link has become an online state, re-negotiating a key with the second device, the second moment is after the first moment and the time difference between the first moment and the second moment is a specified difference; or, If it is detected at the second moment that the state of the link is still in the offline state, then when it is detected after the second moment that the state of the link changes to the online state, key negotiation is performed again with the second device.

22. The device according to claim 20 or 21, characterized in that The device also includes a second sending unit and a second receiving unit; The second sending unit is used to send a first priority to the second device, where the first priority is the priority of the apparatus; The second receiving unit is configured to receive a second priority sent by the second device, where the second priority is the priority of the second device; The processing unit is configured to generate the first key when the first priority is higher than the second priority; The second sending unit is further configured to send the first key to the second device.

23. The device according to claim 22, characterized in that The second sending unit is used to send at least one second multiframe to the second device, where the at least one second multiframe carries the first priority.

24. The device according to claim 23, characterized in that Each second multiframe in the at least one second multiframe includes n alignment markers AM, where n is an integer greater than 1, and the bits carrying the first priority are idle reserved bits included in the 2nd to nth AMs of each second multiframe.

25. A secure processing device, characterized in that: The system comprises at least one processor, wherein the at least one processor is used to be coupled with a memory, read and execute instructions in the memory, so as to implement the method according to any one of claims 1 to 12.

26. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a computer, the method according to any one of claims 1 to 12 is implemented.

27. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images