Optical network information security processing system and method, electronic device and storage medium

Abstract

The application provides an optical network information security processing system, method, electronic equipment and storage medium. The optical network information security processing system comprises: an interface protocol processing module, which is used for sequentially loading programs of optical network protocols, detecting whether the optical network protocols of a current optical link are successfully synchronized after the loading is completed, restarting a protocol identification process if the synchronization fails, dynamically searching for a new available optical network protocol, determining a target optical network protocol if the synchronization succeeds, and sending a protocol processing instruction of the optical network protocol to a security protocol processing module; and the security protocol processing module, which is used for performing security processing on to-be-processed data transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction. Various optical network security protocols are flexibly loaded and switched, so that high-speed switching of optical network information security protection is realized, and the problems of single function and poor interconnection of traditional optical network security devices are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, in particular to an optical network information security processing system and method, an electronic device and a storage medium. BACKGROUND

[0002] At present, there are various networking systems such as SDH network, OTN network and GE network in terms of technology system and architecture. In the future, in order to protect the information transmitted on various optical networks, optical network information security devices need to be installed and deployed to perform encryption and decryption protection on the transmitted information. Due to the differences between various optical networks, direct interconnection between different networks cannot be achieved. In addition, each network system has multiple corresponding devices with different rates, resulting in a large number of security device models, poor network interconnection, and poor compatibility and scalability of network architecture. Therefore, the existing technology has the following problems: (1) a large number of device types: separate security devices are needed for each network system and rate. (2) complex networking: different networks cannot be directly interconnected, and additional conversion devices are needed. (3) poor scalability: the process of adding new devices or adjusting the configuration is complicated and time-consuming. Therefore, how to process the security of optical network information has become a technical problem that cannot be ignored. SUMMARY

[0003] Therefore, the purpose of the present application is to provide an optical network information security processing system and method, an electronic device and a storage medium, which can flexibly load and switch various optical network security protocols, thereby realizing high-speed switching of optical network information security protection, effectively solving the problems of single function and poor interconnection of traditional optical network security devices, and realizing the security processing of optical network information.

[0004] The optical network information security processing system provided by the present application comprises an interface protocol processing module and a security protocol processing module, and the interface protocol processing module and the security protocol processing module are in communication connection; wherein,

[0005] The interface protocol processing module is configured to load the programs of optical network protocols in sequence, detect whether the optical network protocols of the current optical link are successfully synchronized after loading, restart the protocol identification process if the synchronization fails, dynamically find a new available optical network protocol, determine the target optical network protocol if the synchronization succeeds, and send a protocol processing instruction of the optical network protocol to the security protocol processing module.

[0006] The security protocol processing module is configured to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on the processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction.

[0007] In a possible implementation, the interface protocol processing module comprises an interface configuration unit and an interface processing unit; wherein,

[0008] The interface configuration unit is configured to sequentially configure the procedures of the synchronous digital hierarchy, the optical transport network and the ten-gigabit Ethernet in the optical network protocol in sequence, and send the protocol processing instruction of the target optical network protocol to the security protocol processing module.

[0009] The interface processing unit is configured to sequentially load the procedures of the optical network protocol in the interface configuration unit, and after the loading of any procedure of the optical network protocol is completed, detect whether the optical network protocol of the current optical link is successfully synchronized, if yes, send the protocol processing instruction of the target optical network protocol to the interface configuration unit, and if no, restart the protocol identification process and dynamically find a new available optical network protocol.

[0010] In a possible implementation, the interface processing unit determines whether to restart the protocol identification process and dynamically find a new available optical network protocol by the following steps:

[0011] Detect whether the procedure of the current failed optical network protocol is the last procedure of the optical network protocol in the sequential loading;

[0012] If yes, send the instruction of reconfiguring the procedure of the optical network protocol to the interface configuration unit;

[0013] If no, continue to load the next procedure of the optical network protocol, and detect whether the next optical network protocol is successfully synchronized.

[0014] In a possible implementation, the interface processing unit detects whether the optical network protocol of the current optical link is successfully synchronized by the following steps:

[0015] Collect the optical interface state information of the previous optical link; wherein, the state information comprises the link state, the coding mode, the data rate and the frame structure characteristics;

[0016] Send the state information to the interface configuration unit, so as to match the optical network protocol corresponding to the current optical link in the preset procedure library of the optical network protocol based on the state information, and send the configuration parameters of the matched optical network protocol to the interface processing unit;

[0017] The interface processing unit determines the bit error rate according to the configuration parameters in the protocol synchronization process, and if the bit error rate is within the preset threshold, the synchronization is successful, and if the bit error rate is not within the preset threshold, the synchronization fails.

[0018] In a possible implementation, the security protocol processing module comprises an information management unit and an information processing unit; wherein

[0019] The information management unit is configured to load an optical network information security service file of the target optical network protocol to the information security protocol processing unit after receiving the protocol processing instruction.

[0020] The information processing unit is configured to configure a processing program and resources of the target optical network protocol based on the optical network information security service file, so that the to-be-processed data transmitted by the target optical network protocol is processed based on a key and a processing algorithm in the processing program.

[0021] In a possible implementation, the to-be-processed data is synchronous digital hierarchy service data, and the information management unit is further configured to:

[0022] receive a continuous bit stream transmitted by the target optical network protocol, search for a preset frame header identifier in the bit stream based on a sliding bit window;

[0023] determine a starting position of a current frame in response to detecting the frame header identifier, and extract AU pointer information based on a preset position after the starting position;

[0024] determine a position and a length of payload data according to the AU pointer information, strip the payload data, and send the payload data to the information processing unit for security processing.

[0025] In a possible implementation, the to-be-processed data is an OTU2 signal, and the information management unit is further configured to:

[0026] receive an OTU2 signal transmitted by the target optical network protocol;

[0027] perform high-speed serial-parallel conversion processing on the OTU2 signal, and determine a converted OTU2 signal;

[0028] perform frame analysis processing on the converted OTU2 signal based on frame header identification and CRC check, and determine an OTU2 analysis frame;

[0029] extract ODU2 payload data from the OTU2 analysis frame, and send the ODU2 payload data to the information security processing unit for processing.

[0030] The application further provides an optical network information security processing method, which comprises:

[0031] Load the programs of the optical network protocol in sequence, and after loading, detect whether the optical network protocol of the current optical link is successfully synchronized;

[0032] If the synchronization fails, restart the protocol identification process, dynamically find a new available optical network protocol, and if the synchronization succeeds, determine the target optical network protocol and send a protocol processing instruction of the optical network protocol to the security protocol processing module;

[0033] Control the security protocol processing module to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol.

[0034] The embodiment of the application also provides an electronic device, which comprises a processor, a memory and a bus, the memory stores machine readable instructions executable by the processor, the processor and the memory communicate through the bus when the electronic device is running, and the machine readable instructions are executed by the processor to perform the steps of the optical network information security processing method.

[0035] The embodiment of the application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by the processor to perform the steps of the optical network information security processing method.

[0036] The optical network information security processing system, method, electronic device and storage medium provided by the embodiment of the application, the optical network information security processing system comprises an interface protocol processing module and a security protocol processing module, the interface protocol processing module is in communication connection with the security protocol processing module, and the interface protocol processing module is configured to load the programs of the optical network protocol in sequence, detect whether the optical network protocol of the current optical link is successfully synchronized after loading, restart the protocol identification process if the synchronization fails, dynamically find a new available optical network protocol, determine the target optical network protocol if the synchronization succeeds, and send a protocol processing instruction of the optical network protocol to the security protocol processing module; and the security protocol processing module is configured to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction. The flexible loading mode switches various optical network security protocols, thereby realizing high-speed switching of optical network information security protection, effectively solving the problems of single function and poor interconnection of traditional optical network security devices, and realizing security processing of optical network information.

[0037] In order to make the above objectives, features and advantages of the application more apparent, the following preferred embodiments are specifically described with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0039] Figure 1 Structure diagram of an optical network information security processing system provided by an embodiment of the present application;

[0040] Figure 2 Structure diagram of an optical network information security processing system provided by an embodiment of the present application;

[0041] Figure 3 Flow chart of an optical network information security processing method provided by an embodiment of the present application;

[0042] Figure 4 Structure diagram of an electronic device provided by an embodiment of the present application.

[0043] Icon: 100-optical network information security processing system; 110-interface protocol processing module; 111-interface configuration unit; 112-interface processing unit; 120-security protocol processing module; 121-information management unit; 122-information processing unit; 400-electronic device; 410-processor; 420-memory; 430-bus. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions of the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, every other embodiment obtained by those skilled in the art without creative labor belongs to the scope of the present application.

[0045] First, the application scenarios applicable to the present application are introduced. The present application can be applied to the field of communication technology.

[0046] It is found through research that, at present, high-speed optical networks exist in multiple networking systems such as SDH networks, OTN networks, GE networks, etc. in terms of technical system and architecture. In the future, in order to protect the information transmitted on various optical networks, optical network information security devices need to be installed and deployed to perform encryption and decryption protection on the transmitted information. Due to the differences between various optical networks, different networks cannot directly interconnect with each other, and each network system has multiple corresponding equipment of different rates, so that not only there are many types of security devices, but also the network interconnection is not smooth, and the compatibility and expansibility of the network architecture are not good. Therefore, the existing technology has the following problems: (1) a large number of device types: each network system and rate requires a separate security device. (2) complex networking: different networks cannot directly interconnect, and additional conversion equipment is required. (3) poor expansibility: the process of adding new equipment or adjusting the configuration is complicated and time-consuming. Therefore, how to safely process optical network information has become a technical problem that cannot be underestimated.

[0047] Based on this, the embodiment of the present application provides an optical network information security processing system, which flexibly loads various optical network security protocols to realize high-speed switching of optical network information security protection, effectively solves the problems of single function and poor interconnection of traditional optical network security devices, and realizes the safe processing of optical network information.

[0048] Please refer to Figure 1 , Figure 1 The structure of an optical network information security processing system 100 provided by the embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the optical network information security processing system 100 includes an interface protocol processing module 110 and a security protocol processing module 120, and the interface protocol processing module 110 is in communication connection with the security protocol processing module 120. Figure 1

[0049] Specifically, the interface protocol processing module 110 is configured to load optical network protocols in sequence, detect whether the optical network protocol of the current optical link is successfully synchronized after loading is completed, restart the protocol identification process if the synchronization fails, dynamically find a new available optical network protocol, determine the target optical network protocol if the synchronization succeeds, and send a protocol processing instruction of the optical network protocol to the security protocol processing module 120; the security protocol processing module 120 is configured to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction.

[0050] ​It should be noted that the optical network protocol programs include synchronous digital hierarchy (SDH), optical transport network (OTN) and gigabit Ethernet (GE) programs, which can work in 10G / 2.5G / 622M / 155M-SDH mode, 10G-OTN mode and 10G / 1000M-GE mode, and provide optical channel network data security transmission services in 7 modes of 3 optical channel communication systems.

[0051] Here, the loading of the optical network protocol programs in sequence refers to the loading in the sequence of the pre-configured synchronous digital hierarchy (SDH), optical transport network (OTN) and gigabit Ethernet (GE) programs.

[0052] Among them, the restart protocol identification process refers to continuing to load the next optical network protocol program and the optical network protocol synchronization detection process.

[0053] It should be noted that the optical network protocol programs refer to interface mode programs.

[0054] In specific embodiments, the interface protocol processing module 110 loads the optical network protocol programs in sequence, detects whether the current optical link is successfully synchronized after loading, if not, continues to load the next optical network protocol program and synchronously detects the next optical network protocol, if the next optical network protocol is the last optical network protocol program and the synchronization detection fails, the multiple optical network protocol programs need to be reconfigured, if successful, the target optical network protocol is determined, and the security protocol processing module 120 processes the target optical network protocol according to the processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction.

[0055] Further, please refer to Figure 2 , Figure 2 is a structure diagram of an optical network information security processing system 100 provided by an embodiment of the present application. As shown in Figure 2 , the interface protocol processing module 110 includes an interface configuration unit 111 and an interface processing unit 112.

[0056] In a possible implementation, the interface configuration unit 111 is configured to sequentially configure the procedures of the synchronous digital hierarchy, the optical transport network and the gigabit Ethernet in the optical network protocol in sequence, and send the protocol processing instruction of the target optical network protocol to the security protocol processing module 120; and the interface processing unit 112 is configured to sequentially load the procedures of the optical network protocol in the interface configuration unit 111, and after the loading of any procedure of the optical network protocol is completed, detect whether the optical network protocol of the current optical link is successfully synchronized, if yes, send the protocol processing instruction of the target optical network protocol to the interface configuration unit 111, and if not, restart the protocol identification process and dynamically find a new available optical network protocol.

[0057] It should be noted that the interface configuration unit 111 configures the interface mode procedures of the SDH, the OTN and the GE in sequence, and loads the procedures to the interface processing unit 112.

[0058] Here, the interface processing unit 112 is an FPGA processor, and the interface configuration unit 111 is a CPU processor.

[0059] In this embodiment, the interface processing unit 112 can monitor the service state of the optical network protocol in real time, and if the optical link is abnormal, the interface configuration unit 111 is configured to sequentially configure the procedures of the optical network protocol again, so that the interface processing unit 112 detects the synchronization state of the optical information until the optical network protocol of the optical link is synchronized and the device startup configuration is completed.

[0060] Here, the protocol processing instruction refers to the security processing of the to-be-processed data transmitted by the target optical network protocol.

[0061] In this embodiment, the security processing is a key processing or other security processing mode.

[0062] In a specific embodiment, the interface configuration unit 111 configures the interface mode procedures of the SDH, the OTN and the GE to the interface processing unit 112 in sequence, and the interface processing unit 112 synchronizes and detects according to the corresponding protocol, if the synchronization is normal, the optical network protocol of the current optical link is identified, and the interface configuration unit 111 is controlled to notify the security protocol processing module 120 to perform the protocol processing on the to-be-processed data transmitted by the optical network protocol.

[0063] In a possible implementation, the interface processing unit 112 determines whether to restart the protocol identification process and dynamically find a new available optical network protocol by the following steps:

[0064] detecting whether the program of the current failed optical network protocol is the last program of the optical network protocol in the sequential loading; if yes, sending an instruction of reconfiguring the program of the optical network protocol to the interface configuration unit 111; if no, continuing to load the next program of the optical network protocol and detecting whether the next optical network protocol is successfully synchronized.

[0065] In one possible implementation, the interface processing unit 112 detects whether the optical network protocol of the current optical link is successfully synchronized by the following steps:

[0066] A: collecting the optical interface state information of the previous optical link; wherein the state information includes the link state, the coding mode, the data rate and the frame structure characteristics.

[0067] Here, the interface processing unit 112 collects the optical interface state information of the previous optical link in real time by using FPGA.

[0068] B: sending the state information to the interface configuration unit 111, so as to match the optical network protocol corresponding to the current optical link in the preset program library of the optical network protocol based on the state information, and issuing the configuration parameters of the optical network protocol matched successfully to the interface processing unit 112.

[0069] Here, the interface configuration unit 111 matches the optical network protocol corresponding to the current optical link in the preset program library of the optical network protocol according to the information such as the link rate, the coding mode and the frame structure characteristics.

[0070] If there are multiple optical network protocols that can be matched, the optimal protocol is selected according to the preset priority strategy (such as according to the application scenario and the device type).

[0071] C: the interface processing unit 112 determines the bit error rate according to the configuration parameters, and if the bit error rate is within the preset threshold, the synchronization is successful, and if the bit error rate is not within the preset threshold, the synchronization fails.

[0072] Here, once the protocol used by the current link is determined, the interface configuration unit 111 writes the corresponding configuration parameters into the control register of the interface processing unit 112 to send / receive a specific training sequence or control character (such as CPRI SYNC block or Ethernet preamble), and attempts to establish synchronization with the opposite device, and performs a short-time error test; if the bit error rate is within the acceptable range, it is confirmed that the synchronization is successful, otherwise the synchronization fails.

[0073] In addition to setting whether the protocol synchronization is determined by the bit error rate, whether the synchronization is successful can also be determined according to the frame format of the synchronized protocol, which is not specifically limited.

[0074] Further, please refer to Figure 2The security protocol processing module 120 comprises an information management unit 121 and an information processing unit 122.

[0075] In one possible implementation, the information management unit 121 is configured to load an optical network information security service file of the target optical network protocol to the information processing unit 122 after receiving the protocol processing instruction; and the information processing unit 122 is configured to perform processing program configuration and resource configuration on the target optical network protocol based on the optical network information security service file, so as to perform security processing on to-be-processed data transmitted by the target optical network protocol based on a key and a processing algorithm in the processing program configuration.

[0076] It should be noted that the information management unit 121 can be a CPU processor, and the information processing unit 122 can be an FPGA processor.

[0077] The optical network information security service file refers to an FPGA configuration file (i.e., a bit file) that is designed and compiled in advance for different application scenarios, communication protocols, and data processing modes, and is used to implement specific functional logic. These bit files can be dynamically loaded into the FPGA at runtime, thereby changing the hardware behavior.

[0078] In specific embodiments, the information management unit 121 configures an optical network information security service bit file corresponding to the target optical network protocol to the information processing unit 122, so as to start the security processing capability of different channels of the device. After being started, the information management unit 121 performs optical channel key negotiation through the information processing unit 122, and after the key negotiation is completed, the information management unit 121 configures the information processing unit 122 to process data according to a corresponding algorithm and a configuration key.

[0079] In one possible implementation, the to-be-processed data is synchronous digital hierarchy service data, and the information management unit 121 is further configured to:

[0080] (1) receive a continuous bit stream transmitted by the target optical network protocol, and search for a preset frame header identifier in the bit stream based on a sliding bit window.

[0081] Here, for SDH service, service processing of 10G / 2.5G / 622M / 155M rates is supported, a continuous bit stream transmitted by the target optical network protocol is received, and the frame start position cannot be directly determined when the continuous bit stream is received. A sliding bit window method is adopted, that is, one bit is moved each time, a known frame header identifier is searched for in the received data stream, the frame header identifier is usually a specific binary sequence, for example, `01111110` (HDLC frame header) or a specific code type.

[0082] In this embodiment, the target optical network protocol is synchronous digital hierarchy.

[0083] (2) In response to detecting the frame header identifier, determining the start position of the current frame, and extracting the AU pointer information based on a preset position after the start position.

[0084] Here, in response to detecting the frame header identifier, determining the start position of the current frame, and extracting the AU pointer information based on a preset position after the start position.

[0085] (3) According to the AU pointer information, determining the position and length of the payload data, stripping the payload data and sending it to the information processing unit 122 for security processing.

[0086] Here, according to the AU pointer, the start address and length of the payload are calculated, and this part of data is extracted from the entire frame and sent to the subsequent information security protocol processing module 120 for encryption and decryption, integrity check, access control and other processing.

[0087] In this application, the frame header is automatically searched using a sliding bit window, not based on byte boundaries, and the AU pointer analysis is accelerated using hardware logic circuits or FPGA, and the payload is directly transmitted to the information security processing unit after extraction to realize seamless connection, supporting automatic identification and analysis of multiple frame formats, and being adaptable to communication links of different rates, encoding modes or modulation types.

[0088] In one possible implementation, the target data is an OTU2 signal, and the information management unit 121 is further configured to:

[0089] receive the OTU2 signal transmitted by the target optical network protocol; perform high-speed serial-parallel conversion processing on the OTU2 signal to determine a converted OTU2 signal; perform frame analysis processing on the converted OTU2 signal based on frame header identification and CRC check to determine an OTU2 analysis frame; extract ODU2 payload data from the OTU2 analysis frame and send the ODU2 payload data to the information security processing unit for processing.

[0090] It should be noted that OTU2 (Optical Channel Transport Unit level 2) is one of the OTN levels defined in ITU-T G.709 standard.

[0091] Here, the OTU2 signal received by the target optical network protocol transmission is subjected to high-speed serial-parallel conversion processing by the serializer, and the converted OTU2 signal is determined. The frame structure of the converted OTU2 signal is positioned and verified by means of frame header identification, synchronization, CRC check, etc. to determine the OTU2 analysis frame. The ODU2 payload data is extracted from the OTU2 analysis frame, and the DU2 payload data is sent to the information security processing unit for processing.

[0092] It should be noted that the Ethernet is also subjected to message encryption security processing by the information processing unit 122, and the key negotiation and configuration are performed by the information management unit 121. The IP service message (such as UDP, TCP protocol) is changed to ESP protocol message after encryption. In specific embodiments, the interface configuration unit 111 configures the interface mode program of SDH into the interface processing unit 112, and the interface mode program of SDH is run in the interface processing unit 112 to perform control synchronization and data analysis according to the SDH protocol data. If the synchronization is legal, the interface configuration unit 111 is notified to start the synchronization, the function code and resources of SDH are configured in the interface processing unit 112, and the information management unit 121 is notified to configure the optical network information security service file into the information processing unit 122. If the synchronization fails, the interface configuration unit configures the interface mode program of OTN into the interface processing unit 112, and so on to the interface mode program of GE. If the synchronization still fails, return to the initial state, and reconfigure the interface mode program of SDH, the interface mode program of OTN, and the interface mode program of GE in sequence to judge the interface state until the optical network protocol is synchronized, and the device enters the working state. When the optical network protocol enters the working state, the link state is continuously detected, and if the out-of-step or connection state is abnormal, the dynamic protocol scanning is restarted until the optical link is synchronized again, the identification of the optical network protocol is completed, and the corresponding security processing process is entered.

[0093] In the present application, the interface configuration unit 111 loads various processing bit files into the interface processing unit 112 according to the optical link state, and supports the OTN link, SDH link and Ethernet link protocol analysis function. The optical network information security device loads various security processing bit files into the information processing unit 122 according to the synchronization state, and supports the OTN link, SDH link and Ethernet link protocol encryption and decryption function. This dynamic change of loading various processing bit files into the information processing unit 122 makes the optical network information security device have flexibility and adaptability.

[0094] The optical network information security processing system provided by the embodiment of the present application comprises an interface protocol processing module and a security protocol processing module, the interface protocol processing module is in communication connection with the security protocol processing module; wherein the interface protocol processing module is configured to sequentially load programs of optical network protocols, detect whether the optical network protocol of the current optical link is successfully synchronized after the loading is completed, restart the protocol identification process if the detection result is negative, dynamically find a new available optical network protocol if the detection result is positive, determine the target optical network protocol if the detection result is positive, and send a protocol processing instruction of the optical network protocol to the security protocol processing module; the security protocol processing module is configured to, after receiving the protocol processing instruction, perform security processing on the to-be-processed data transmitted by the target optical network protocol based on the processing algorithm corresponding to the target optical network protocol. The flexible loading manner switches various optical network security protocols, thereby realizing high-speed switching of optical network information security protection, and effectively solving the problems of single function and poor interconnection of traditional optical network security devices.

[0095] Please refer to Figure 3 , Figure 3 The flowchart of the optical network information security processing method provided by the embodiment of the present application is shown in FIG. 1. Figure 3 The optical network information security processing method provided by the embodiment of the present application comprises the following steps.

[0096] S301: sequentially load programs of optical network protocols, and detect whether the optical network protocol of the current optical link is successfully synchronized after the loading is completed.

[0097] S302: if the detection result is negative, restart the protocol identification process, dynamically find a new available optical network protocol if the detection result is positive, determine the target optical network protocol if the detection result is positive, and send a protocol processing instruction of the optical network protocol to the security protocol processing module.

[0098] S303: control the security protocol processing module to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on the processing algorithm corresponding to the target optical network protocol.

[0099] The description of S301 to S303 can refer to the description of the interface protocol processing module and the security protocol processing module, and the same technical effects can be achieved, and thus no further description is given.

[0100] In a possible implementation manner, the optical network information security processing method further comprises the following steps.

[0101] controlling an interface configuration unit to sequentially configure programs of a synchronous digital hierarchy, an optical transport network and a gigabit Ethernet in the optical network protocols, and sending a protocol processing instruction of the target optical network protocol to the security protocol processing module;

[0102] The control interface processing unit loads the optical network protocol programs in the interface configuration unit in sequence, after loading of any of the optical network protocol programs is completed, detects whether the optical network protocol of the current optical link is successfully synchronized, if yes, sends a protocol processing instruction of a target optical network protocol to the interface configuration unit, if no, restarts a protocol identification process, and dynamically finds a new available optical network protocol.

[0103] In a possible implementation, the following steps are used to determine whether the protocol identification process is restarted and a new available optical network protocol is dynamically found if no:

[0104] Detect whether the program of the current failed optical network protocol is the last optical network protocol program in the loading sequence;

[0105] If yes, send an instruction of reconfiguring the program of the optical network protocol to the interface configuration unit;

[0106] If no, continue to load the next optical network protocol program, and detect whether the next optical network protocol is successfully synchronized.

[0107] In a possible implementation, the following steps are used to detect whether the optical network protocol of the current optical link is successfully synchronized:

[0108] Collect optical interface state information of the previous optical link; wherein the state information includes link state, coding mode, data rate, and frame structure characteristics;

[0109] Send the state information to the interface configuration unit, so as to match the optical network protocol corresponding to the current optical link in a preset program library of optical network protocols based on the state information, and send configuration parameters of the matched optical network protocol to the interface processing unit;

[0110] The interface processing unit performs protocol synchronization processing according to the configuration parameters to determine a bit error rate, if the bit error rate is within a preset threshold, the synchronization is successful, if the bit error rate is not within the preset threshold, the synchronization fails.

[0111] In a possible implementation, the optical network information security processing method further includes:

[0112] The control information management unit loads an optical network information security service file of the target optical network protocol to the information processing unit after receiving the protocol processing instruction;

[0113] The control information processing unit configures a processing procedure and resources for the target optical network protocol based on the optical network information security service file, so that the data to be processed transmitted by the target optical network protocol is securely processed based on the key and processing algorithm in the processing procedure configuration.

[0114] In one possible implementation, the optical network information security processing method further includes:

[0115] receiving a continuous bit stream transmitted by the target optical network protocol, searching for a preset frame header identifier in the bit stream based on a sliding bit window;

[0116] determining a starting position of a current frame in response to detecting the frame header identifier, and extracting AU pointer information based on a preset position after the starting position;

[0117] determining the position and length of the payload data according to the AU pointer information, stripping the payload data, and sending the payload data to the information processing unit for secure processing.

[0118] In one possible implementation, the optical network information security processing method further includes:

[0119] receiving an OTU2 signal transmitted by the target optical network protocol;

[0120] performing high-speed serial-parallel conversion processing on the OTU2 signal to determine a converted OTU2 signal;

[0121] performing frame analysis processing on the converted OTU2 signal based on frame header identification and CRC check to determine an OTU2 analysis frame;

[0122] extracting ODU2 payload data from the OTU2 analysis frame, and sending the ODU2 payload data to the information security processing unit for processing.

[0123] The optical network information security processing method provided in the embodiments of the present application includes: sequentially loading programs of optical network protocols, detecting whether the optical network protocols of a current optical link are successfully synchronized after the loading is completed, restarting a protocol identification process if the synchronization fails, dynamically finding a new available optical network protocol if the synchronization succeeds, determining a target optical network protocol, and sending a protocol processing instruction of the optical network protocol to a secure protocol processing module; and controlling the secure protocol processing module to securely process data to be processed transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol. The flexible loading manner switches various optical network security protocols, thereby realizing high-speed switching of optical network information security protection, and effectively solving the problems of single function and poor interconnection of traditional optical network security devices.

[0124] Please refer to Figure 4 , Figure 4 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 4. As shown in FIG. 4, the electronic device 400 includes a processor 410, a memory 420 and a bus 430. Figure 4 The memory 420 stores machine readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 through the bus 430. The machine readable instructions, when executed by the processor 410, can perform the steps of the optical network information security processing method in the method embodiment shown in 3 above. For details, refer to the method embodiment, which will not be described here again.

[0125] The memory 420 stores machine readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 through the bus 430. The machine readable instructions, when executed by the processor 410, can perform the steps of the optical network information security processing method in the method embodiment shown in 3 above. For details, refer to the method embodiment, which will not be described here again.

[0126] The present application also provides a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, the steps of the optical network information security processing method in the method embodiment shown in 3 above can be performed. For details, refer to the method embodiment, which will not be described here again. Figure 3

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be described here again.

[0128] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented by other ways. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation, and for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, and can be electrical, mechanical or other forms.

[0129] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e. can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0130] ​In addition, each function unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0131] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a nonvolatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions of the present application can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0132] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the same. The protection scope of the present application is not limited thereto, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily think of changes to the technical solutions recorded in the foregoing embodiments within the technical range disclosed by the present application, or replace some technical features with equivalent replacements; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An optical network information security processing system, characterized in that: The optical network information security processing system includes an interface protocol processing module and a security protocol processing module, wherein the interface protocol processing module is in communication connection with the security protocol processing module; The interface protocol processing module is used to load the optical network protocol program in sequence, and after loading is completed, detect whether the optical network protocol of the current optical link is synchronized successfully. If it fails, restart the protocol identification process to dynamically search for a new available optical network protocol. If successful, determine the target optical network protocol and send the protocol processing instruction of the optical network protocol to the security protocol processing module; The security protocol processing module is configured to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on the processing algorithm corresponding to the target optical network protocol after receiving the protocol processing instruction; The interface protocol processing module includes an interface configuration unit and an interface processing unit; wherein, The interface configuration unit is used to sequentially configure the programs of the Synchronous Digital Hierarchy, Optical Transport Network and 10 Gigabit Ethernet in the optical network protocol, and send the protocol processing instructions of the target optical network protocol to the security protocol processing module; The interface processing unit is configured to sequentially load the optical network protocol programs in the interface configuration unit, and after any optical network protocol program is loaded, detect whether the optical network protocol of the current optical link is synchronized successfully; if successful, send a protocol processing instruction of the target optical network protocol to the interface configuration unit; if failed, restart the protocol identification process to dynamically search for a new available optical network protocol; The interface processing unit detects whether the optical network protocol of the current optical link is synchronized successfully by the following steps: Collecting optical interface status information of the current optical link; wherein the status information includes link status, encoding mode, data rate and frame structure characteristics; Sending the state information to the interface configuration unit so that the optical network protocol corresponding to the current optical link is matched in a preset optical network protocol library based on the state information, and sending the configuration parameters of the successfully matched optical network protocol to the interface processing unit; The interface processing unit performs protocol synchronization processing according to the configuration parameters to determine a bit error rate. If the bit error rate is within a preset threshold, synchronization is successful; if the bit error rate is not within the preset threshold, synchronization fails.

2. The optical network information security processing system according to claim 1, characterized in that: The interface processing unit determines that if a failure occurs, it restarts the protocol identification process to dynamically search for a new available optical network protocol through the following steps: Detecting whether the currently failed optical network protocol program is the last optical network protocol program in the sequential loading; If so, sending an instruction to the interface configuration unit to reconfigure the program of the optical network protocol; If not, continue to load the program of the next optical network protocol and detect whether the next optical network protocol is synchronized successfully.

3. The optical network information security processing system according to claim 1, characterized in that: The security protocol processing module includes an information management unit and an information processing unit; wherein, The information management unit is configured to load the optical network information security service file of the target optical network protocol into the information processing unit after receiving the protocol processing instruction; The information processing unit is used to configure the processing program and resources of the target optical network protocol based on the optical network information security service file, so that the data to be processed transmitted by the target optical network protocol can be securely processed based on the key and processing algorithm in the processing program configuration.

4. The optical network information security processing system according to claim 3, characterized in that: When the data to be processed is synchronous digital system service data, the information management unit is further configured to: receiving a continuous bit stream transmitted by the target optical network protocol, and searching for a preset frame header identifier in the bit stream based on a sliding bit window; determining a starting position of a current frame in response to detecting the frame header identifier, and extracting AU pointer information based on a preset position after the starting position; The position and length of the payload data are determined according to the AU pointer information, the payload data is stripped and sent to the information processing unit for security processing.

5. The optical network information security processing system according to claim 3, characterized in that: When the data to be processed is an OTU2 signal, the information management unit is further configured to: Receiving an OTU2 signal transmitted by the target optical network protocol; Performing high-speed serial-to-parallel conversion on the OTU2 signal to determine a converted OTU2 signal; Perform frame parsing on the transformed OTU2 signal based on frame header identification and CRC check to determine the OTU2 parsing frame; Extract ODU2 payload data from the OTU2 parsed frame, and send the ODU2 payload data to an information security processing unit for processing.

6. A method for securely processing optical network information, characterized in that: The optical network information security processing method is applied to the optical network information security processing system according to any one of claims 1 to 5, and the optical network information security processing method includes: Load the optical network protocol program in sequence, and after loading is complete, detect whether the optical network protocol of the current optical link is synchronized successfully; If it fails, restart the protocol identification process to dynamically find a new available optical network protocol. If it succeeds, determine the target optical network protocol and send the protocol processing instruction of the optical network protocol to the security protocol processing module; The security protocol processing module is controlled to perform security processing on the to-be-processed data transmitted by the target optical network protocol based on a processing algorithm corresponding to the target optical network protocol.

7. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the optical network information security processing method as described in claim 6.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the optical network information security processing method according to claim 6 are executed.

Images