Method and apparatus for optical service unit encryption transmission

Abstract

This application provides a method and apparatus for encrypted transmission of optical service units (OSUs). The method includes: acquiring N channels of service data; mapping the N channels of service data to N channels of OSU frames, and mapping the N channels of OSU frames to Optical Transport Network (OTN) frames, wherein the N channels of service data correspond one-to-one with the N channels of OSU frames, the N channels of service data include a first channel of service data, the N channels of OSU frames include a first OSU frame, the payload area of ​​the first OSU frame includes the first channel of service data encrypted according to first encryption information, the overhead area of ​​the first OSU frame includes the first encryption information, and N is an integer greater than 1; and transmitting the OTN frames. This method is used to encrypt OSU frames, achieving end-to-end secure transmission of OSUs.

Description

Technical Field

[0001] This application relates to the field of optical communications, and more specifically, to a method and apparatus for encrypted transmission of optical service units. Background Technology

[0002] Optical networks are gradually evolving towards ultra-high-speed transmission technologies, with 100G and 400G optical transport network (OTN) technologies becoming the main choices for transmission networks. Among them, OTN technology, which is mainly designed for ultra-high bandwidth transmission and has a transmission speed exceeding 1T bit / s (B1T), has become a research hotspot.

[0003] An optical service unit (OSU) is a service unit in an OTN network used to support speeds of Mbit / s and above. The layer network composed of these service units is located above the optical distribution unit (ODU) layer.

[0004] For scenarios where OSUs are used to encapsulate business processes, existing encryption technologies cannot provide end-to-end channel encryption for OSUs. Summary of the Invention

[0005] This application provides a method and apparatus for encrypted transmission of optical service units (OSUs), which encrypts the payload area of ​​the OSU to achieve end-to-end secure transmission of the OSU.

[0006] Firstly, a method for encrypted transmission of optical service units is provided. This method can be executed by a transmitting device. Unless otherwise specified, "transmitting device" in this application can refer to the transmitting device itself (e.g., an OTN device), a component in the transmitting device (e.g., a communication module, processor, circuit, chip, or chip system), or a logic module or software that can implement all or part of the functions of the transmitting device. This application does not limit the scope of the terminology.

[0007] The method includes: acquiring N channels of service data; mapping the N channels of service data to N channels of Optical Service Unit (OSU) frames, and mapping the N channels of OSU frames to Optical Transport Network (OTN) frames, wherein the N channels of service data correspond one-to-one with the N channels of OSU frames, the N channels of service data include a first channel of service data, the N channels of OSU frames include a first OSU frame, the payload area of ​​the first OSU frame includes the first channel of service data encrypted according to first encryption information, the overhead area of ​​the first OSU frame includes the first encryption information, and N is an integer greater than 1; and transmitting the OTN frames.

[0008] Based on the above scheme, the payload area of ​​the OSU frame is encrypted before being mapped to a higher-order OTN frame, and the encryption overhead is carried in the OSU frame to achieve end-to-end secure transmission of the OSU. Furthermore, this method allows for selective encryption of a portion of the service data from N service data streams, i.e., it can encrypt a portion of the OSU frames within the OTN frame, increasing the flexibility of encrypted service data transmission.

[0009] The OTN frame is a higher-order frame than the OSU frame, for example, the OTN frame is ODUk, OTUk, etc.

[0010] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a first multiframe, the overhead area of ​​each OSU frame in the first multiframe includes a first field, the overhead area of ​​the first multiframe includes M first fields, and the M first fields include the first encryption information, where M≤N.

[0011] Based on the above scheme, in multiframe mode, with M OSU frames as one period, and each OSU frame including a first field, there are a total of M available first fields in each period that can be used to carry encryption overhead.

[0012] In some implementations, the first multiframe is a first 64-frame, which includes 64 first fields, and the 64 first fields include the first encrypted information.

[0013] Based on the above scheme, in multiframe mode, with 64 OSU frames as one cycle, and each OSU frame including a first field, there are a total of 64 available first fields in each cycle that can be used to carry encryption overhead.

[0014] In some implementations, the first encrypted information includes at least one of the following: security management channel data; an N1 multiframe counter for indicating the sequence number of the 64 multiframes in the N2 multiframe; a 1024 multiframe inter-frame counter for indicating the sequence number of the 1024 multiframes; a key; a first indication that the local key management channel (KCC) has been established; and a second indication requesting the peer to establish a KCC.

[0015] In some implementations, the 64 first fields include the first encrypted information, including: the 17th to 20th first fields of the 64 first fields include the security management channel data; and / or, the 21st to 24th first fields of the 64 first fields include the 64 multiframe counter; and / or, the 25th to 56th first fields of the 64 first fields include the 1024 multiframe inter-counter counter; and / or, the 57th to 58th first fields of the 64 first fields include the key; and / or, the 63rd first field of the 64 first fields includes the first indication information; and / or, the 64th first field of the 64 first fields includes the second indication information.

[0016] In some implementations, the 64 first fields include the first encrypted information, including: the 17th to 20th first fields of the 64 first fields include the security management channel data; and / or, the 21st to 24th first fields of the 64 first fields include the 64 multiframe counter; and / or, the 25th to 56th first fields of the 64 first fields include the 1024 multiframe inter-counter counter; and / or, the 57th to 58th first fields of the 64 first fields include the key.

[0017] In some implementations, the first field is the POH1 field.

[0018] In some implementations, the length of the first field is 1 bit.

[0019] In some implementations, the overhead area of ​​each OSU frame in the first multiframe further includes a second field; wherein, in the first multiframe, the value of the second field in the first OSU frame is 1, and the value of the second field in other OSU frames besides the first OSU frame is 0; the second field is used for synchronization of the first encryption information and the first multiframe.

[0020] In some implementations, the second field is the 64-frame indicator M64_P field.

[0021] Based on the above scheme, in multiframe mode, encryption overhead is carried in a cycle of 64 OSU frames, and the encryption overhead is synchronized in a fixed frame through the M64_P field.

[0022] In some implementations, the first OSU frame further includes a first 256 multiframe, the overhead area of ​​each OSU frame in the first 256 multiframe includes a third field, the first 256 multiframe includes 256 third fields, the 256 third fields include first authentication information, the first authentication information is obtained by authenticating the first 256 multiframe.

[0023] Based on the above scheme, in multiframe mode, with 256 OSU frames as one cycle, and each OSU frame including a third field, there are a total of 256 available third fields in each cycle that can be used to carry authentication overhead.

[0024] In some implementations, the 256 third fields include first authentication information, including: the 33rd to the 161st fields of the 256 third fields constitute a first authentication overhead field, and the first authentication overhead field includes the first authentication information.

[0025] In some implementations, the third field is the POH2 field.

[0026] In some implementations, the length of the third field is 1 bit.

[0027] In some implementations, each OSU frame in the first 256 multiframes further includes a fourth field; wherein, in the first 256 multiframes, the value of the fourth field in the first OSU frame is 1, and the value of the fourth field in the other OSU frames is 0, and the fourth field is used for the synchronization of the first authentication information and the first 256 multiframes.

[0028] In some implementations, the fourth field is the 256 multiframe indicator M256_P field.

[0029] Based on the above scheme, in multiframe mode, encryption overhead is carried in a cycle of 256 OSU frames, and authentication overhead is synchronized in fixed frames through the M256_P field.

[0030] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a second 256 multiframe, the overhead area of ​​each OSU frame in the second 256 multiframe includes a fifth field, the second 256 multiframe includes 256 fifth fields, and the 256 fifth fields include the first encryption information; wherein, the second 256 multiframe includes four second 64 multiframes, and the second 64 multiframe includes 64 fifth fields.

[0031] In some implementations, the first encrypted information includes at least one of the following: security management channel data; a 64-frame inter-frame counter for indicating the sequence number of the second 256-frame, wherein each of the four second 64-frames includes one of the 64-frame inter-frame counters; a key; a first indication that the local KCC channel has been established; and a second indication requesting the peer to establish a KCC channel.

[0032] Based on the above scheme, in single-frame mode, encryption overhead and authentication overhead are carried in a cycle of 256 OSU frames, and an inter-frame counter is carried in a cycle of 64 multiframes, which shortens the encryption latency.

[0033] In some implementations, the 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

[0034] In some implementations, the 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: the first 32 fifth fields of the first, second, third, and fourth second 64 multiframes of the four second 64 multiframes constitute a second encryption overhead field, the second encryption overhead field including the first encryption information; the last 32 fifth fields of the first, second, third, and fourth second 64 multiframes of the four second 64 multiframes constitute a second authentication overhead field, the second authentication overhead field including the first authentication information.

[0035] Based on the above scheme, in single-frame mode, with 256 OSU frames as one cycle, and each OSU frame including a fifth field, there are a total of 256 available fifth fields in each cycle that can be used to carry encryption overhead and authentication overhead.

[0036] In some implementations, the second encryption overhead field includes the first encryption information, including: the 29th to 32nd fifth fields of the first, second, third, and fourth second 64-frame multiframes, the 29th to 32nd fifth fields of the first, second, third, and fourth second 64-frame multiframes, which include the security management channel data; and / or, the 3rd to 28th fifth fields of the first, second, and third second 64-frame multiframes, the 3rd to 28th fifth fields of the second, third, and fourth second 64-frame multiframes, which include the security management channel data; and / or, the 3rd to 28th fifth fields of the first, second, and third second 64-frame multiframe multiframes, the 3rd to 28th fifth fields of the third, and the 3rd to 28th fifth fields of the fourth second 64-frame multi ... The fifth field and the third to 28th fifth fields of the fourth second 64-frame multiframe include the 64-frame inter-frame counter; and / or, the first fifth field of the first second 64-frame multiframe, the first fifth field of the second second 64-frame multiframe, the first fifth field of the third second 64-frame multiframe, and the first fifth field of the fourth second 64-frame multiframe include the key; and / or, the second fifth field of the second second 64-frame multiframe and the second fifth field of the fourth second 64-frame multiframe include the first indication information; and / or, the second fifth field of the first second 64-frame multiframe and the second fifth field of the third second 64-frame multi ...

[0037] In some implementations, each OSU frame in the second 256 multiframes further includes a sixth field, which is used to identify the 32-frame cycle and 256-frame cycle of the first OSU frame, and the sixth field is used for synchronization of the first encryption information and the second 256 multiframes.

[0038] Based on the above scheme, in single-frame mode, encryption overhead and authentication overhead are carried in a cycle of 256 OSU frames, and the authentication overhead is synchronized in a fixed frame through the sixth field.

[0039] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a third 256-frame complex, and the overhead area of ​​each OSU frame in the third 256-frame complex includes a fifth field; the third 256-frame complex includes 256 fifth fields, and the 256 fifth fields include the first encryption information.

[0040] In some implementations, the first encryption information includes at least one of the following: security management channel data; key; encryption type indicator (CST); and a 256-frame inter-frame counter for indicating the sequence number of the 256-frame inter-frame.

[0041] In some implementations, the 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

[0042] In some implementations, the 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: the 162nd to the 216th fifth fields of the 256 fifth fields form a third encryption overhead field, the third encryption overhead field including the first encryption information; the 33rd to the 161st fifth fields of the 256 fifth fields form a third authentication overhead field, the third authentication overhead field including the first authentication information.

[0043] In some implementations, the third encryption overhead field includes the first encryption information, including: the 162nd to 169th fifth fields out of the 256 fifth fields include the first 8 bits of the security management channel data; and / or, the 170th to 177th fifth fields out of the 256 fifth fields include the last 8 bits of the security management channel data; and / or, the 178th to 179th fifth fields out of the 256 fifth fields include the key; and / or, the 180th to 185th fifth fields out of the 256 fifth fields include the CST; and / or, the 186th to 217th fifth fields out of the 256 fifth fields include the 256 multiframe inter-counter.

[0044] In some implementations, the fifth field is a RES field reserved for the future.

[0045] In some implementations, the length of the fifth field is 1 bit.

[0046] Secondly, a method for encrypted transmission of optical service units is provided. This method can be executed by a receiving device. Unless otherwise specified, the term "receiving device" in this application can refer to the transmitting device itself (e.g., an OTN device), a component in the receiving device (e.g., a communication module, processor, circuit, chip, or chip system), or a logic module or software that can implement all or part of the functions of the receiving device. This application does not limit the scope of the term.

[0047] The method includes: receiving an Optical Transport Network (OTN) frame, wherein the OTN frame is obtained by mapping N Optical Service Unit (OSU) frames, and the N OSU frames are obtained by mapping N service data, wherein the N service data correspond one-to-one with the N OSU frames, the N service data includes a first service data, the N OSU frames include a first OSU frame, the payload area of ​​the first OSU frame includes the first service data encrypted according to first encryption information, the overhead area of ​​the first OSU frame includes the first encryption information, and N is an integer greater than 1; decrypting the first OSU frame according to the first encryption information to obtain the first service data.

[0048] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a first multiframe, the overhead area of ​​each OSU frame in the first multiframe includes a first field, the overhead area of ​​the first multiframe includes M first fields, and the M first fields include the first encryption information, where M≤N.

[0049] In some implementations, the first multiframe is a first 64-frame, which includes 64 first fields, and the 64 first fields include the first encrypted information.

[0050] In some implementations, the first encrypted information includes at least one of the following: security management channel data; an N1 multiframe counter for indicating the sequence number of the 64 multiframes in the N2 multiframe; a 1024 multiframe inter-frame counter for indicating the sequence number of the 1024 multiframes; a key; a first indication that the local key management channel (KCC) has been established; and a second indication requesting the peer to establish a KCC.

[0051] In some implementations, the 64 first fields include the first encrypted information, including: the 17th to 20th first fields of the 64 first fields include the security management channel data; and / or, the 21st to 24th first fields of the 64 first fields include the 64 multiframe counter; and / or, the 25th to 56th first fields of the 64 first fields include the 1024 multiframe inter-counter counter; and / or, the 57th to 58th first fields of the 64 first fields include the key; and / or, the 63rd first field of the 64 first fields includes the first indication information; and / or, the 64th first field of the 64 first fields includes the second indication information.

[0052] In some implementations, the 64 first fields include the first encrypted information, including: the 17th to 20th first fields of the 64 first fields include the security management channel data; and / or, the 21st to 24th first fields of the 64 first fields include the 64 multiframe counter; and / or, the 25th to 56th first fields of the 64 first fields include the 1024 multiframe inter-counter counter; and / or, the 57th to 58th first fields of the 64 first fields include the key.

[0053] In some implementations, the first field is the POH1 field.

[0054] In some implementations, the length of the first field is 1 bit.

[0055] In some implementations, the overhead area of ​​each OSU frame in the first multiframe further includes a second field; wherein, in the first multiframe, the value of the second field in the first OSU frame is 1, and the value of the second field in other OSU frames besides the first OSU frame is 0; the second field is used for synchronization of the first encryption information and the first multiframe.

[0056] In some implementations, the second field is the 64-frame indicator M64_P field.

[0057] In some implementations, the first OSU frame further includes a first 256 multiframe, the overhead area of ​​each OSU frame in the first 256 multiframe includes a third field, the first 256 multiframe includes 256 third fields, the 256 third fields include first authentication information, the first authentication information is obtained by authenticating the first 256 multiframe.

[0058] In some implementations, the 256 third fields include first authentication information, including: the 33rd to the 161st fields of the 256 third fields constitute a first authentication overhead field, and the first authentication overhead field includes the first authentication information.

[0059] In some implementations, the third field is the POH2 field.

[0060] In some implementations, the length of the third field is 1 bit.

[0061] In some implementations, each OSU frame in the first 256 multiframes further includes a fourth field; wherein, in the first 256 multiframes, the value of the fourth field in the first OSU frame is 1, and the value of the fourth field in the other OSU frames is 0, and the fourth field is used for the synchronization of the first authentication information and the first 256 multiframes.

[0062] In some implementations, the fourth field is the 256 multiframe indicator M256_P field.

[0063] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a second 256 multiframe, the overhead area of ​​each OSU frame in the second 256 multiframe includes a fifth field, the second 256 multiframe includes 256 fifth fields, and the 256 fifth fields include the first encryption information; wherein, the second 256 multiframe includes four second 64 multiframes, and the second 64 multiframe includes 64 fifth fields.

[0064] In some implementations, the first encrypted information includes at least one of the following: security management channel data; a 64-frame inter-frame counter for indicating the sequence number of the second 256-frame, wherein each of the four second 64-frames includes one of the 64-frame inter-frame counters; a key; a first indication that the local KCC channel has been established; and a second indication requesting the peer to establish a KCC channel.

[0065] In some implementations, the 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

[0066] In some implementations, the 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: the first 32 fifth fields of the first, second, third, and fourth second 64 multiframes of the four second 64 multiframes constitute a second encryption overhead field, the second encryption overhead field including the first encryption information; the last 32 fifth fields of the first, second, third, and fourth second 64 multiframes of the four second 64 multiframes constitute a second authentication overhead field, the second authentication overhead field including the first authentication information.

[0067] In some implementations, the second encryption overhead field includes the first encryption information, including: the 29th to 32nd fifth fields of the first, second, third, and fourth second 64-frame multiframes, the 29th to 32nd fifth fields of the first, second, third, and fourth second 64-frame multiframes, which include the security management channel data; and / or, the 3rd to 28th fifth fields of the first, second, and third second 64-frame multiframes, the 3rd to 28th fifth fields of the second, third, and fourth second 64-frame multiframes, which include the security management channel data; and / or, the 3rd to 28th fifth fields of the first, second, and third second 64-frame multiframe multiframes, the 3rd to 28th fifth fields of the third, and the 3rd to 28th fifth fields of the fourth second 64-frame multi ... The fifth field and the third to 28th fifth fields of the fourth second 64-frame multiframe include the 64-frame inter-frame counter; and / or, the first fifth field of the first second 64-frame multiframe, the first fifth field of the second second 64-frame multiframe, the first fifth field of the third second 64-frame multiframe, and the first fifth field of the fourth second 64-frame multiframe include the key; and / or, the second fifth field of the second second 64-frame multiframe and the second fifth field of the fourth second 64-frame multiframe include the first indication information; and / or, the second fifth field of the first second 64-frame multiframe and the second fifth field of the third second 64-frame multi ...

[0068] In some implementations, each OSU frame in the second 256 multiframes further includes a sixth field, which is used to identify the 32-frame cycle and 256-frame cycle of the first OSU frame, and the sixth field is used for synchronization of the first encryption information and the second 256 multiframes.

[0069] In some implementations, the overhead area of ​​the first OSU frame includes the first encryption information, including: the first OSU frame includes a third 256-frame complex, and the overhead area of ​​each OSU frame in the third 256-frame complex includes a fifth field; the third 256-frame complex includes 256 fifth fields, and the 256 fifth fields include the first encryption information.

[0070] In some implementations, the first encryption information includes at least one of the following: security management channel data; key; encryption type indicator (CST); and a 256-frame inter-frame counter for indicating the sequence number of the 256-frame inter-frame.

[0071] In some implementations, the 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

[0072] In some implementations, the 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: the 162nd to the 216th fifth fields of the 256 fifth fields form a third encryption overhead field, the third encryption overhead field including the first encryption information; the 33rd to the 161st fifth fields of the 256 fifth fields form a third authentication overhead field, the third authentication overhead field including the first authentication information.

[0073] In some implementations, the third encryption overhead field includes the first encryption information, including: the 162nd to 169th fifth fields out of the 256 fifth fields include the first 8 bits of the security management channel data; and / or, the 170th to 177th fifth fields out of the 256 fifth fields include the last 8 bits of the security management channel data; and / or, the 178th to 179th fifth fields out of the 256 fifth fields include the key; and / or, the 180th to 185th fifth fields out of the 256 fifth fields include the CST; and / or, the 186th to 217th fifth fields out of the 256 fifth fields include the 256 multiframe inter-counter.

[0074] In some implementations, the fifth field is a RES field reserved for the future.

[0075] In some implementations, the length of the fifth field is 1 bit.

[0076] Thirdly, embodiments of this application provide an optical communication device. This device is used to execute the method provided in the first aspect, or to execute the method provided in the second aspect. Specifically, the device may include units and / or modules for executing the method provided in the first aspect or any of the above-described implementations of the first aspect; alternatively, the device may include units and / or modules for executing the method provided in the second aspect or any of the above-described implementations of the second aspect, such as a processing module and a transceiver module.

[0077] In one implementation, the optical communication device may include units and / or modules for performing the method provided in the first aspect or any of the above implementations of the first aspect, serving as a transmitting end device. The transceiver module may be a transceiver, or an input / output interface. The processing module may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0078] Alternatively, the optical communication device may be a chip, chip system, or circuit in the transmitting end equipment. The transceiver module may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip, chip system, or circuit. The processing module may be at least one processor, processing circuit, or logic circuit.

[0079] In another implementation, the optical communication device may include units and / or modules for performing the methods provided in the second aspect or any of the above implementations of the second aspect, serving as a receiving device. The transceiver module may be a transceiver, or an input / output interface. The processing module may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0080] Alternatively, the optical communication device may be a chip, chip system, or circuit in the receiving end equipment. The transceiver module may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip, chip system, or circuit. The processing module may be at least one processor, processing circuit, or logic circuit.

[0081] Fourthly, a processor is provided for executing the methods provided in the above aspects.

[0082] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0083] Fifthly, an optical module is provided, comprising a signal processor and an optical transmitting component. The signal processor is used to execute the method provided in the first aspect or any of the above-described implementations of the first aspect. The optical transmitting component is used to convert OTN frames into optical signals and transmit the optical signals.

[0084] In a sixth aspect, an optical module is provided, comprising a signal processor and an optical receiving component. The optical receiving component is used to receive optical signals and convert the optical signals into OTN frames; the signal processor is used to execute the method provided in the second aspect or any of the above-described implementations of the second aspect.

[0085] In a seventh aspect, embodiments of this application provide a network device, the network device comprising: a processor and an input / output interface, for executing the method provided in any implementation of the first or second aspect described above, wherein the input / output interface is used for sending and receiving OTN frames, and the processor is used for processing the OTN frames.

[0086] Eighthly, a computer-readable storage medium is provided. This computer-readable storage medium stores program code for execution by a device, the program code including methods for performing any implementation of the first or second aspect described above.

[0087] A ninth aspect provides a computer program product containing instructions. When the computer program product is run on a computer or processor, it causes the computer or processor to perform the method provided by any implementation of the first or second aspect described above.

[0088] In a tenth aspect, a chip is provided. The chip includes a processor and a communication interface, wherein the processor reads instructions stored in a memory through the communication interface and executes the method provided in any implementation of the first or second aspect described above.

[0089] Optionally, as one implementation, the chip also includes a memory storing computer programs or instructions, and a processor for executing the computer programs or instructions stored in the memory. When the computer programs or instructions are executed, the processor is used to perform the method provided by any of the implementations of the first or second aspect described above.

[0090] The beneficial effects of the third to tenth aspects mentioned above can be found in the descriptions of the beneficial effects in the first or second aspects, and will not be repeated here. Attached Figure Description

[0091] Figure 1 This is a schematic diagram of an OTN optical network system applicable to the embodiments of this application.

[0092] Figure 2 This is a schematic diagram of the hardware structure of an OTN device applicable to the embodiments of this application.

[0093] Figure 3 This is a schematic diagram of the hardware structure of an optical module applicable to an embodiment of this application.

[0094] Figure 4 This is a schematic diagram of an OSU frame structure.

[0095] Figure 5 This is a schematic diagram of an OSU frame structure.

[0096] Figure 6 This is a schematic diagram illustrating an application scenario applicable to an embodiment of this application.

[0097] Figure 7 This is a schematic flowchart illustrating an OSU encrypted transmission method provided in an embodiment of this application.

[0098] Figure 8This is a schematic block diagram of an optical communication device provided in an embodiment of this application.

[0099] Figure 9 This is a schematic diagram of the structure of an optical communication device provided in an embodiment of this application.

[0100] Figure 10 This is a schematic diagram of a chip system provided in an embodiment of this application. Detailed Implementation

[0101] The following description is provided to facilitate understanding of the embodiments of this application.

[0102] (1) In this application, unless otherwise specified or logically conflicting, the terms and / or descriptions of different embodiments are consistent and can be referenced by each other. The technical features of different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0103] (2) In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates that the related objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can mean: a, or, b, or, c, or, a and b, or, a and c, or, b and c, or, a, b, and c. Where a, b, and c can be single or multiple.

[0104] (3) In this application, the terms "first," "second," and various numerical designations are used for convenience of description and are not intended to limit the scope of the embodiments of this application. For example, they are used to distinguish different messages, rather than to describe a specific order or sequence. It should be understood that such descriptions can be interchanged where appropriate to describe solutions other than those in the embodiments of this application.

[0105] (4) In this application, “instruction” or “for instruction” can include both direct instruction and indirect instruction. When describing an instruction as being used to instruct A, it can include whether the instruction directly instructs A or indirectly instructs A, but does not necessarily mean that the instruction carries A.

[0106] The indication methods involved in the embodiments of this application should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. Moreover, the sending period and / or sending time of these sub-information can be the same or different. This application does not limit the sending method, for example.

[0107] (5) In this application, the words “exemplary,” “for example,” “such as,” etc., are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as an “example” in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word “example” is intended to present the concept in a specific manner. In the embodiments of this application, “of,” “corresponding, relevant,” “corresponding,” and “associate” may sometimes be used interchangeably, and it should be noted that their intended meanings are consistent when their distinctions are not emphasized.

[0108] (6) In this application, "send" and "receive" indicate the direction of signal transmission. For example, "receiving information from YY" can be understood as the source of the information being YY, which may include receiving directly from YY through a communication interface (or input / output interface), or receiving indirectly from YY through a communication interface from other units or modules. "Send" can also be understood as the "output" of the chip interface, and "receive" can also be understood as the "input" of the chip interface. In other words, sending and receiving can be performed between devices, such as between OTN device #1 and OTN device #2, or they can be performed within a device, for example, by sending or receiving between components, modules, chips, software modules, or hardware modules within the device via a bus, trace, or interface.

[0109] (7) In this application, "data frame" may also be referred to as "frame" or "signal". For example, an OTN frame may be referred to as an OTN signal, an OTN frame, or an OTN data frame. It should be noted that both "frame" and "signal" in this application are used to carry service data. When used to describe the data structure carrying service data, it is generally understood as "frame" such as an OSU frame; when used to describe the carrier carrying service data, or to describe the transmission of service data, it is generally understood as "signal". In the following description, this application does not make a special distinction between "frame" and "signal".

[0110] Specifically, the OTN signal can be any one of the following: optical payload unit (OPU) signal, ODU signal (such as ODUk, ODUflex, etc.), optical transport unit (OTU) signal (such as OTUk, OTUCn, where k represents different rate levels and Cn represents variable rate), or FlexO signal. The FlexO signal can be any one of the following: FlexO instance, FlexO interface signal (e.g., FlexO-n, FlexO-n(e), FlexO-x, FlexO-x(e), FlexO-x-FEC, FlexO-x-FEC-m), or other FlexO interface signals exceeding 100 Gbit / s defined by future OTN signal developments. It should be understood that this application also applies to other data frames, such as metro transport network (MTN) frames, or to new types of OTN and MTN frames that may be defined as OTN and MTN technologies develop.

[0111] (8) In this application, examples are given using a transmitting device and a receiving device as the implementing entities. A device may be referred to as a node or node device, and a transmitting device may be referred to as a transmitting node, a transmitting end, or a source node. Similarly, in this application, a receiving device may be referred to as a receiving device, a receiving end, or a destination node. Exemplarily, a transmitting device may be referred to as a transmitting end device, a transmitting end node, or a transmitting node, etc., and similarly, in this application, a receiving device may be referred to as a receiving end device, a receiving end node, or a receiving node, etc. For example, the transmitting device may be one of the following OTN devices (such as...). Figure 1 The OTN device A shown in the figure, from the customer device (such as Figure 1 The client equipment shown in the diagram receives service data. Alternatively, the transmitting device can be any other device capable of implementing an OTN device. The specific form of the transmitting or receiving device is not limited in this application embodiment, as long as it can achieve the corresponding communication function.

[0112] The technical solution of this application will be described in detail below with reference to the accompanying drawings.

[0113] The embodiments of this application are applicable to optical networks, such as OTN. An OTN is typically composed of multiple devices connected by optical fibers, and can be configured into different topologies such as linear, ring, and mesh, depending on specific needs.

[0114] Figure 1 This is a schematic diagram of an OTN optical network system to which this application's embodiments apply. Figure 1As shown, OTN 100 includes eight interconnected OTN devices 101, also known as devices AH. 102 indicates an optical fiber used to connect two devices; 103 indicates a customer service interface used to receive or transmit customer service data. Figure 1 As shown, OTN 100 is used to transmit service data for customer devices 1-3. Customer devices 1-3 can be Ethernet devices, and the service data can be Ethernet service data. The customer devices are connected to the OTN device through customer service interfaces. For example, Figure 1 In the middle, customer equipment 1-3 are connected to OTN equipment A, H and F respectively.

[0115] Depending on the specific needs, an OTN device may possess different functions. Generally speaking, OTN devices are categorized into optical layer devices, electrical layer devices, and hybrid optoelectronic devices. Optical layer devices refer to those capable of processing optical layer signals, such as optical amplifiers and optical add-drop multiplexers. Optical amplifiers amplify optical signals to support longer transmission distances while maintaining specific optical signal performance. Optical add-drop multiplexers perform spatial transformations on optical signals, allowing them to be output from different output ports (sometimes referred to as directions). Electrical layer devices refer to those capable of processing electrical layer signals, such as devices capable of processing OTN signals. Hybrid optoelectronic devices refer to devices capable of processing both optical and electrical layer signals. It should be noted that, depending on specific integration requirements, an OTN device can integrate multiple different functions. The technical solutions provided in this application are applicable to OTN devices with different forms and integration levels that include electrical layer functions.

[0116] Figure 2 This is a schematic diagram of the hardware structure of an OTN device applicable to an embodiment of this application. Specifically, the OTN device may include one or more of a tributary board, a line board, and a cross-connect board, and may also include one or more of a system control board, a power supply, a fan, and auxiliary boards.

[0117] The circuit board can also be an optical layer processing board. Depending on specific needs, the type and number of boards included in each device may differ. For example, an OTN device acting as a core node may not have tributary boards. An OTN device acting as an edge node may have multiple tributary boards. Power supply boards are used to power the OTN device and may include primary and backup power supplies. Fan boards are used for heat dissipation. Auxiliary boards provide auxiliary functions such as external alarms or access to external clocks. Tributary boards, cross-connect boards, and circuit boards are primarily used to process OTN electrical layer signals (also known as OTN frames). Tributary boards are used to receive and transmit various client signals (also known as client services). Client signals can include constant bit rate (CBR) signals (e.g., synchronous digital hierarchy (SDH) signals) and packet signals (e.g., Ethernet signals). Furthermore, tributary boards can include client-side optical modules and signal processors. The client-side optical modules are used to receive and / or transmit client signals. The signal processors are used to perform mapping and demapping processing of client signals to OTN frames. The signal processor can be located inside or outside the customer-side optical module. If the signal processor is a combination of multiple chips, one (or some) of the chips can be inside the customer-side optical module, while the others are outside. The cross-connect board is used to implement the switching of OTN frames, for example, to perform the switching of one or more types of OTN frames. The line board mainly implements the processing of line-side OTN frames. Specifically, the line board can include a line-side optical module and a signal processor. The line-side optical module, which can be called an optical transceiver, is used to receive and / or transmit optical signals carrying OTN frames. The signal processor is used to implement multiplexing and demultiplexing, or mapping and demapping processing of line-side OTN frames. The signal processor can be located inside or outside the line-side optical module. If the signal processor is a combination of multiple chips, one (or some) of the chips can be inside the line-side optical module, while the others are outside. The customer-side optical module or the line-side optical module can also be collectively referred to as an optical module or an optical transceiver. The signal processors in either the customer-side or line-side optical modules can be optical digital signal processors (oDSPs) or framers, or a combination of framers and oDSPs. System control boards are used for system control. Specifically, system control boards can collect information from different boards or send control commands to the corresponding boards.

[0118] It should be noted that, unless otherwise specified, a specific component (such as a tributary board) may be one or more, and this application does not impose any restrictions. This application also does not impose any restrictions on the type of boards included in the device, or on the functional design and number of the boards. It should also be noted that, in a specific implementation, the two boards mentioned above may also be designed as a single board. Furthermore, network devices may also include backup power supplies, fans for device cooling, auxiliary boards for providing external alarms or accessing external clocks, etc.

[0119] Figure 3 This is a schematic diagram of the hardware structure of an optical module applicable to an embodiment of this application. Figure 3 As shown, an optical module may include a signal processor, an optical transmitting component, and an optical receiving component. As mentioned above, the signal processor may include a framer or an oDSP, or a combination of a framer and an oDSP. An optical module can be a unidirectional optical module, meaning it includes either an optical transmitting component or an optical receiving component. An optical module can also be a bidirectional optical module, meaning it includes both an optical transmitting component and an optical receiving component.

[0120] Framer, also known as a service chip or physical layer (PHY) chip, is primarily used to perform OTN electrical layer encapsulation / decapsulation (or mapping / demapping). Framers encapsulate client signals into OTN frames or decapsulate OTN frames to obtain client signals. For example, a framer can encapsulate client signals into ODUs, encapsulate low-rate ODUs into high-rate ODUs, encapsulate ODUs into flexible OTN (FlexO) frames, or directly encapsulate client signals into FlexO frames. Decapsulation is the reverse process of encapsulation.

[0121] The oDSP is used to perform digital signal processing on OTN frames generated by the Framer, or on electrical signals obtained from the optical receiving component. The oDSP is used to perform one or more of the following processing operations: forward error correction (FEC), clock recovery, equalization, sequence detection, and signal decision.

[0122] FEC is an error control method that refers to pre-encoding the signal according to a certain algorithm before it is sent into the transmission channel, adding redundant data with the characteristics of the signal itself, and then decoding the received signal at the receiving end according to the corresponding algorithm to find and correct the error codes generated during transmission.

[0123] Optical transmitting module (TOSA): Also known as a transmitter optical subassembly, it converts electrical signals into optical signals. A TOSA may include a light source, a driver chip, and a modulator. The light source can be a semiconductor laser (also known as a laser diode (LD) or a light emitting diode (LED). The driver chip processes the electrical signals generated by the oDSP and drives the light source to emit modulated optical signals. The modulated optical signals are transmitted to the fiber optic line via an optical fiber interface.

[0124] Optical receiver assembly (ROSA), also known as a receiver optical subassembly, is used to convert optical signals into electrical signals. ROSA may include photodetectors, amplifiers, etc. The photodetector can be an avalanche photodiode (APD) or a PIN photodiode. The amplifier may include a preamplifier and a post-amplifier. After the optical signal enters from the fiber optic interface, it is converted into an electrical signal by the photodetector, and then amplified by the amplifier to output an amplified electrical signal.

[0125] It should be noted that the client signal involved in the embodiments of this application can refer to the service carried by the optical transport network or the metropolitan area transport network, such as Ethernet service, packet service, or wireless backhaul service. The client signal can also be referred to as client-side signal, client signal, service signal, service data, client data, or client service data, etc.

[0126] The above Figures 1 to 3 The examples provided are for illustrative purposes only and do not preclude other structural schemes.

[0127] To facilitate understanding of the technical solutions of the embodiments of this application, some terms or concepts that may be involved in the embodiments of this application will be briefly described first.

[0128] 1. OTN Frame: The data frame structure used by OTN devices is the OTN frame. OTN frames can also be called OTN transmission frames. OTN frames are used to carry various service data and provide rich management and monitoring functions. OTN frames can be Flexible Optical Service Unit (OSUflex) frames, which can also be simply called OSU frames. Alternatively, OTN frames can also be ODUk, ODUCN, ODUflex, OTUk, OTUCn, or Flexible OTN (FlexO) frames, etc.

[0129] It should be noted that this application is based on a scheme proposed for encrypting OSU frames.

[0130] 2. OSU Frame Structure

[0131] OSU is a service unit in the OTN network used to support service rates of Mbit / s and above. The layer network composed of these service units is located above the ODU layer.

[0132] The frame structure of OSU is as follows: Figure 4 As shown, the OSU frame length is 192 bytes, and the frame structure includes an overhead area and a payload area. Bytes 1 to 7 are the overhead area, and bytes 8 to 192 are the payload area. OSU overhead includes OSU general overhead and OSU mapping overhead.

[0133] 3. Structure of the OSU frame overhead area

[0134] a) Single-frame mode

[0135] like Figure 4 As shown, the first three bits of bytes 1 to 5 in the OSU frame are general overhead, and the last five bits of byte 5 to byte 6 are mapping overhead.

[0136] In the general overhead of the OSU frame, the second bit of the third byte is the reserved for future standardization (RES) field, which is all zeros by default.

[0137] The general overhead of the OSU frame also includes the path monitoring (PM) field, and the tandem connection monitoring (TCM)1 and TCM2 fields. The specific functions of PM, TCM1 and TCM2 need to be used in conjunction with the M32 / 256 multiframe.

[0138] 32 / 256 multiframe (M32 / 256) format: The length is 1 bit. By setting specific values ​​for M32 / 256 in 256 consecutive frames, it is used to simultaneously identify the 32 multiframe cycle and 256 frame cycle of the OSU. Each 256 multiframe includes 8 32 frames. Its format definition is shown in Table 1.

[0139] In each 256-frame multiframe, the M32 / 256 value is set to 1 in the first frame of the first 32-frame multiframe, and to 0 in frames 2 through 32. In the second 32-frame multiframe, M32 / 256 is set to 1 in the first and second frames, and to 0 in frames 3 through 32. This continues until the eighth 32-frame multiframe multiframe, where M32 / 256 is set to 1 in frames 1 through 8, and to 0 in frames 9 through 32. The receiving end identifies the 32-frame boundaries by searching for transitions in the M32 / 256 value from 0 to 1 within the OSU frames. It also determines the 256-frame multiframe boundaries by counting the number of consecutive OSU frames in each 32-frame multiframe where M32 / 256 is 1.

[0140] Table 1

[0141]

[0142]

[0143] b) Multiframe mode

[0144] In multiframe mode, OSU frames include data frames and data extension frames. Data frames carry customer services and include PKT data frames (FT=000), CBR data frames (FT=010), and VC-n data frames (FT=011), identified by their frame type (FT). The structure of a PKT data frame is as follows: Figure 5 As shown. Data extended frames include PKT extended frames (FT=001), CBR extended frames (FT=011), and VC-n extended frames (FT=011). The structure of the PKT extended frame is as follows: Figure 5 As shown. For Ethernet services, PKT data frames and PKT extended frames are generated alternately in a 1:1 ratio. CBR data frames and CBR extended frames are generated alternately in a 1:3 ratio. VC-n data frames and VC-n extended frames are generated alternately in a 1:3 ratio.

[0145] In this application, unless otherwise specified, "data frame" refers to PKT data frame and "data extended frame" refers to PKT extended frame.

[0146] like Figure 5 As shown, the last two bits of the 5th byte and the first three bits of the 6th byte in the data frame are the RES field, and the last two bits of the 5th byte in the data extension frame are the RES field.

[0147] With increasing emphasis on the security of business transmission, it is necessary to encrypt transmitted services. For scenarios where OSUs are used to encapsulate services, existing ODU encryption technologies cannot provide end-to-end channel encryption for OSUs.

[0148] In view of this, embodiments of this application provide a method and apparatus for OSU encrypted transmission, applied to, for example... Figure 6 In the scenario shown, by physically encrypting the payload area of ​​the OSU before encapsulating it into an OTN frame (e.g., ODU), the security of service data transmission over the operator's network is ensured. Physical layer encryption of the OSU can carry any type of service and offers advantages such as minimal network latency (intermediate nodes can pass through, encryption latency is in the nanosecond (ns) range), high bandwidth utilization (100%), no impact on upper layers, and no bandwidth loss.

[0149] The following will describe in detail, with reference to the accompanying drawings, the method for OSU encrypted transmission provided in the embodiments of this application, which can be applied to the above. Figure 1 The communication system shown. It should be understood that the embodiments of this application can be applied to scenarios where the transmitting device and the receiving device communicate.

[0150] It should also be understood that the embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided in the embodiments of this application, as long as it is possible to communicate according to the method provided in the embodiments of this application by running the code or program that records the method provided in the embodiments of this application. For example, the method provided in the embodiments of this application can be executed by a transmitting device and a receiving device. Unless otherwise specified, the device in this application, such as the transmitting device and the receiving device, can refer to the device itself (e.g., an OTN device), or a component in the device (e.g., a communication module, processor, circuit, chip, or chip system, etc.), or it can be a logic module or software that can implement all or part of the device functions.

[0151] Figure 7 This is a schematic flowchart illustrating a method 700 for encrypted transmission of an OSU, provided as an embodiment of this application. Figure 7 As shown, the transmitting device can be an OTN device, or it can be performed by a component of an OTN device (such as a chip or chip system). The receiving device can be an OTN device, or it can be performed by a component of an OTN device (such as a chip or chip system). Specifically, the method includes the following steps.

[0152] S701, the transmitting device acquires N channels of service data.

[0153] For example, service data refers to services that can be carried by an optical transport network or metropolitan area transport network, including but not limited to Ethernet services, packet services, or wireless backhaul services. Service data can also be called service signals, customer data, customer-side signals, client signals, or customer service data. The application scenarios corresponding to service data can be data center networks (including intra-data center interconnections and inter-data center interconnections), enterprise networks, carrier networks, etc. Furthermore, the service type corresponding to service data can also be Ethernet services, constant bit rate (CBR) services, etc. Simultaneously, the services corresponding to the service can include various types of services, such as internet access, video and voice calls, etc. This application does not limit the type and name of service data.

[0154] S702, the transmitting device maps N service data into N OSU frames, and maps N OSU frames into OTN frames.

[0155] Among them, N service data channels correspond one-to-one with N OSU frames. The N service data channels include the first service data channel, and the N OSU frames include the first OSU frame. The payload area of ​​the first OSU frame includes the first service data channel encrypted according to the first encryption information, and the overhead area of ​​the first OSU frame includes the first encryption information.

[0156] It should be understood that after mapping N service data to N OSU frames, the N OSU frames are further mapped to higher-order OTN frames, such as ODUk, OTUk, etc.

[0157] Optionally, the sending and receiving devices can pre-agree on the encryption information to be used. Specifically, the sending device encrypts the business data according to the agreed-upon first encryption information.

[0158] The first encryption information, also known as encryption overhead, is used to encrypt and decrypt business data.

[0159] The following section will explain the frame structure of the encrypted OSU frame and how the OSU frame carries the encryption overhead by describing the frame structure in single-frame mode and multi-frame mode based on OSU frames.

[0160] 1) Single-frame mode

[0161] Each OSU frame in the first OSU frame includes a fifth field, and the first OSU frame includes multiple fifth fields, the multiple fifth fields including the first encryption information. The N fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame. It should be noted that the first authentication information includes, but is not limited to, an authentication tag (AT).

[0162] Optionally, the fifth field is the RES field. Optionally, the length of the fifth field is 1 bit.

[0163] For example, such as Figure 4 As shown, in the general overhead of the OSU frame, the second bit of the third byte is the RES field. In the embodiments of this application, the encryption overhead, that is, the first encryption information, is carried through this RES field. The length of this RES field is 1 bit.

[0164] It should be understood that this application uses 256 OSU frames as a cycle, and each OSU frame includes a RES field, that is, each OSU frame includes 1 bit of available field. Therefore, each cycle has a total of 256 bits of available field that can be used to carry encryption overhead. This application carries encryption overhead through this 256-bit overhead field.

[0165] This application provides two methods for defining encryption overhead in single-frame mode, namely Method 1 and Method 2, which will be described in detail below.

[0166] Method 1

[0167] The first OSU frame includes a third 256-frame complex.

[0168] Optionally, the aforementioned service data may be carried in the payload area of ​​the third 256-frame, or the service data may be carried in other 256-frames of the first OSU frame (such as the previous or next 256-frame of the third 256-frame, which is not limited in this application).

[0169] The third 256 multiframes include 256 fifth fields; wherein, the 162nd to 216th fifth fields of the 256 fifth fields constitute a third encryption overhead field, and the third encryption overhead field includes the first encryption information; the 33rd to 161st fifth fields of the 256 fifth fields constitute a third authentication overhead field, and the third authentication overhead field includes the first authentication information.

[0170] In this application, encryption overhead can also be called path overhead (POH), that is, the RES field mentioned above can also carry POH information. Specifically, in the third 256 multiframes mentioned above, the RES field in the first OSU frame is used to carry the field POH

[255] , and the RES field in the last OSU frame is used to carry the field POH[0]; that is, POH

[255] is sent first, and POH[0] is sent last.

[0171] It should be noted that in this application, the field POH[X] refers to the (X+1)th bit from the end of the POH information according to the sending order, and the field POH[X:Y] refers to the (X+1)th bit to the (Y+1)th bit from the end of the POH information according to the sending order.

[0172] It should be noted that, in this application, unless specifically stated as "counting from back to front in the order of transmission", "the Xth bit" refers to the Xth bit counted from front to back in the order of transmission.

[0173] Optionally, the first encrypted information includes at least one of the following:

[0174] 1) The first 8 bits of the security management channel data, which can also be called the key control channel (KCC), are used for key (also known as secret key) negotiation and interaction;

[0175] 2) The last 8 bits of the security management channel data;

[0176] 3) Key, including the encryption key identifier (KI);

[0177] 4) Encryption type indication, also known as crypto suite type (CST), is used to indicate parameters such as encryption algorithm, key length, and encryption mode used by both communicating parties;

[0178] 5) 256 multiframe inter-frame counter, used to indicate the sequence number of 256 multiframes.

[0179] For example, as shown in Table 2, is a way to define the 256 fifth fields in a third 256-frame complex.

[0180] Table 2

[0181] Expenditure Location Expenses Overhead length (bit) controller POH[255:224] Frame header 32 internal logic of the chip POH[223:96] AT certification mark 128 internal logic of the chip POH[95:88] The first 8 bits of the key transmission data 8 External control logic of the chip POH[87:80] The last 8 bits of the key transmission data 8 External control logic of the chip POH[79:78] Encryption key number KI 2 internal logic of the chip POH[77:72] Encryption Type Indicator (CST) 6 internal logic of the chip POH[71:40] 256 multiframe inter-frame counter 32 internal logic of the chip POH[39:0] RES 40 internal logic of the chip

[0182] Among them, the 33rd to 161st fifth fields (i.e., POH[223:96]) of the 256 fifth fields constitute the third authentication overhead field, which includes the first authentication information.

[0183] The third encryption overhead field includes the first encryption information, including: the 162nd to 169th fifth fields (i.e., POH[95:88]) of the 256 fifth fields include the first 8 bits of the security management channel data; the 170th to 177th fifth fields (i.e., POH[87:80]) of the 256 fifth fields include the last 8 bits of the security management channel data; the 178th to 179th fifth fields (i.e., POH[79:78]) of the 256 fifth fields include the key; the 180th to 185th fifth fields (i.e., POH[77:72]) of the 256 fifth fields include the CST; and the 186th to 217th fifth fields (i.e., POH[71:40]) of the 256 multiframe inter-counters.

[0184] Among them, the 1st to 32nd fifth fields (i.e., POH[255:224]) of the 256 fifth fields are used for framing. The 32-bit frame header is the FAS overhead, which can also be called the frame header or frame header indicator. It is used for the synchronization of the first encryption information and the third 256 multiframe, and also for the synchronization of the first authentication information and the third 256 multiframe.

[0185] Based on the above method 1, with 256 multiframes as a cycle, the encryption overhead and authentication overhead are carried by the 256 bits included in the 256 RES fields within the cycle, and the first 32 bits of the 256 bits are used for framing (i.e., to complete the synchronization of encryption overhead and OSU frames), thus completing the encryption of OSU frames in single-frame mode.

[0186] Method 2

[0187] The first OSU frame includes a second 256-frame complex.

[0188] Optionally, the aforementioned service data may be carried in the payload area of ​​the second 256 multiframe, or the service data may be carried in other 256 multiframes in the first OSU frame (such as the previous or next 256 multiframe of the second 256 multiframe, which is not limited in this application).

[0189] The first OSU frame includes a second 256 multiframe, the second 256 multiframe includes four second 64 multiframes, and the second 64 multiframe includes 64 fifth fields.

[0190] The second 64-frame multiframe includes 64 fifth fields, comprising the first 32 fifth fields and the last 32 fifth fields. The first 32 fifth fields of the first, second, third, and fourth 64-frame multiframes constitute a second encryption overhead field, which includes the first encryption information. The last 32 fifth fields of the first, second, third, and fourth 64-frame multiframes constitute a second authentication overhead field, which includes the first authentication information.

[0191] Alternatively, the first, third, fifth, and seventh 32-frames of the eight 32-frame complexes collectively include 128 of the fifth fields. These 128 fifth fields constitute a second encryption overhead field, which includes the first encryption information. Furthermore, the second, fourth, sixth, and eighth 32-frames of the eight 32-frame complexes collectively include 128 of the fifth fields. These 128 fifth fields constitute a second authentication overhead field, which includes the first authentication information.

[0192] Optionally, the first encrypted information includes at least one of the following:

[0193] 1) Security management channel data;

[0194] 2) A 64-frame inter-frame counter, used to indicate the sequence number of the second 256-frame, wherein each of the four second 64-frames includes one of the 64-frame inter-frame counters;

[0195] 3) Key, including KI;

[0196] 4) First indication message indicating the completion of the local KCC channel establishment;

[0197] 5) Request the other end to establish a second instruction message for the KCC channel.

[0198] For example, as shown in Table 3, is a way to define 256 fifth fields in a second 256-frame multiframe.

[0199] Table 3

[0200]

[0201]

[0202] It should be noted that in Table 3, the most significant bit (MSB) or least significant bit (LSB) of X refers to the (X+1)th bit counted from the end of the transmission order. For example, an MSB of 32 refers to the 33rd bit counted from the end of the transmission order in a 64-bit multiframe. The field POH[X:Y] refers to the (X+1)th to (Y+1)th bits counted from the end of the transmission order in a 64-bit multiframe; or, the field POH[X:Y] refers to the least significant bit being the (X+1)th bit counted from the end of the transmission order and the most significant bit being the (Y+1)th bit counted from the end of the transmission order.

[0203] Wherein, the 29th to 32nd fifth fields of the first second 64-frame (i.e., MF64#0), the 29th to 32nd fifth fields of the second second 64-frame (i.e., MF64#1), the 29th to 32nd fifth fields of the third second 64-frame (i.e., MF64#2), and the 29th to 32nd fifth fields of the fourth second 64-frame (i.e., MF64#3) among the four second 64-frames include the security management channel data; and / or, the 3rd to 28th fifth fields of the first second 64-frame, the 3rd to 28th fifth fields of the second second 64-frame, and the 3rd to 32nd fifth fields of the third second 64-frame among the four second 64-frames include the security management channel data; and / or, the 3rd to 28th fifth fields of the first second 64-frame, the 3rd to 32nd fifth fields of the second second 64-frame, and the 3rd to 32nd fifth fields of the third second 64-frame ...9th to 32nd fifth fields of the third second 64-frame include the security management channel data; and / or, the 3rd to 28th fifth fields of the first second 64-frame, the 3rd to 32nd fifth fields of the second second 64-frame, and The 28 fifth fields and the 3rd to 28th fifth fields of the 4th second 64-frame multiframe include the 64-frame inter-frame counter; and / or, the 1st fifth field of the 1st second 64-frame multiframe, the 1st fifth field of the 2nd second 64-frame multiframe, the 1st fifth field of the 3rd second 64-frame multiframe, and the 1st fifth field of the 4th second 64-frame multiframe include the key; and / or, the 2nd fifth field of the 2nd second 64-frame multiframe and the 2nd fifth field of the 4th second 64-frame multiframe include the first indication information; and / or, the 2nd fifth field of the 1st second 64-frame multiframe and the 2nd fifth field of the 3rd second 64-frame multiframe multiframe multiframe include the second indication information.

[0204] Alternatively, the 29th to 32nd fifth fields (POH[32:35]) in the first (MF32#0), third (MF32#2), fifth (MF32#4), and seventh (MF32#6) of the eight 32-frame multiframes (MF32#0 to MF32#7) include the security management channel data; the 3rd to 28th fifth fields (POH[32:35]) in the first, third, fifth, and seventh 32-frame multiframes of the eight 32-frame multiframe multiframes include the security management channel data; [36:61]) includes the 64-frame inter-frame counter; the first fifth field (i.e., POH[63:63]) of the first, third, fifth, and seventh 32-frames of the eight 32-frames includes the key; the second fifth field (i.e., POH[62:62]) of the third and seventh 32-frames of the eight 32-frames includes the first indication information; the second fifth field (i.e., POH[62:62]) of the first and fifth 32-frames of the eight 32-frames includes the second indication information.

[0205] Optionally, each frame in the second 256 multiframes further includes a sixth field, which is used to identify the 32-frame cycle and 256-frame cycle of the OSU frame, and the sixth field is used for the synchronization of the first encryption information and the second 256 multiframes.

[0206] For example, the sixth field is the M32 / M256 field. The transmitting device can be configured to use the locally generated M32 / M256 indication (used for source node encryption scenarios, i.e., encryption at the origin of PM overhead) or receive the M32 / M256 indication transmitted in the OSU frame overhead (encryption at intermediate pass-through nodes; note that intermediate pass-through nodes cannot modify the M32 / M256 indication of PM overhead, otherwise decryption will fail), according to the channel configuration; the decryption end always uses the M32 / M256 indication transmitted in the OSU frame overhead to synchronize the encryption overhead.

[0207] It should be understood that the names of the various expenses in Table 3 are merely examples, and this application does not impose any restrictions on them, as long as the corresponding functions can be achieved.

[0208] Based on Method 2, with 256 multiframes as a cycle, the encryption overhead and authentication overhead are carried by the 256 bits of the 256 RES fields within this cycle, completing the encryption of the OSU frame in single-frame mode. Compared to Method 1, Method 2 carries the encryption key number and a 64-frame inter-frame counter in a 64-frame cycle, significantly reducing the encryption latency.

[0209] 2) Multiframe mode

[0210] In multiframe mode, this application carries the complete encryption overhead in 64 multiframes.

[0211] Specifically, each OSU frame in the first OSU frame includes a first field, the first OSU frame includes a first multiframe, the first multiframe includes M first fields, and the M first fields include the first encryption information.

[0212] For example, the first multiframe is a first 64-frame, which includes 64 first fields, each of which includes first encrypted information.

[0213] Optionally, the aforementioned service data is carried in the payload area of ​​the first 64-frame multiframe, or the service data is carried in other 64-frame multiframes in the first OSU frame (such as the previous 64-frame or the next 64-frame of the first 64-frame multiframe, which is not limited in this application).

[0214] like Figure 5 or Figure 6 As shown, the 7th bit of the 5th byte in the OSU data frame or data extension frame is the RES field. The RES field is 1 bit long, and this application uses the RES field to carry the encryption overhead, that is, to carry the first encryption information.

[0215] It should be understood that this application uses 64 OSU frames as a cycle, and each OSU frame includes a RES field, that is, each OSU frame includes 1 bit of available field. Thus, each cycle has a total of 64 bits of available field that can be used to carry encryption overhead. This application carries encryption overhead through this 64-bit overhead field.

[0216] In this application, encryption overhead can also be called path overhead (POH), that is, the RES field mentioned above can also carry POH information. Specifically, the RES field in the 64 multiframes can be used to carry POH1 information. Among them, in the first 64 multiframes mentioned above, the RES field in the first OSU frame is used to carry field POH1

[64] , and the RES field in the last OSU frame is used to carry field POH1[0]; that is, POH1

[64] is sent first, and POH1[0] is sent last.

[0217] This application provides two methods for defining encryption overhead in multiframe mode, namely method 3 and method 4, which will be described in detail below.

[0218] Method 3

[0219] The first encrypted information includes at least one of the following:

[0220] 1) Secure management channel data, also known as key control channel (KCC), is used for key (also known as secret key) negotiation and interaction;

[0221] 2) 64-frame counter, used to indicate the sequence number of the 64th frame in the 1024-frame counter. The value of the first 64th frame in the 1024-frame counter is 0. The value of the counter is incremented by 1 for each 64th frame. The value of the last 64th frame in the 1024-frame counter is 15.

[0222] 3) 1024 multiframe inter-frame counter, used to indicate the sequence number of 1024 multiframes, incrementing by 1 every 1024 multiframes;

[0223] 4) Key, including KI;

[0224] 5) First indication message indicating the completion of the local key management channel (KCC) establishment;

[0225] 6) Request the other end to establish a second instruction message for KCC.

[0226] For example, as shown in Table 4, is a way of defining 64 first fields in a first 64-frame multiframe.

[0227] Table 4

[0228]

[0229] It should be noted that in Table 4, MSB or LSB of X refers to the (X+1)th bit counted from the end of the transmission order. For example, MSB of 32 refers to the 33rd bit counted from the end of the transmission order in the 64-bit multiframe. The field POH1[X:Y] refers to the (X+1)th to (Y+1)th bits counted from the end of the transmission order in the 64-bit multiframe; or, the field POH1[X:Y] refers to the least significant bit of the field being the (X+1)th bit counted from the end of the transmission order, and the most significant bit being the (Y+1)th bit counted from the end of the transmission order.

[0230] Specifically, the 17th to 20th first fields (POH1[44:47]) of the 64 first fields include the security management channel data; the 21st to 24th first fields (POH1[40:43]) of the 64 first fields include the 64 multiframe counters; the 25th to 56th first fields (POH1[8:39]) of the 64 first fields include the 1024 multiframe inter-counter counters; the 57th to 58th first fields (POH1[6:7]) of the 64 first fields include the key; the 63rd first field (POH1[1:1]) of the 64 first fields includes the first indication information; and the 64th first field (POH1[0:0]) of the 64 first fields includes the second indication information.

[0231] It should be understood that the names of the various expenses in Table 4 are merely examples, and this application does not impose any restrictions on them, as long as the corresponding functions can be achieved.

[0232] Method 4

[0233] The first encrypted information includes at least one of the following:

[0234] 1) Secure management channel data, also known as key control channel (KCC), is used for key (also known as secret key) negotiation and interaction;

[0235] 2) 64-frame counter, used to indicate the sequence number of the 64th frame in the 1024-frame counter. The value of the first 64th frame in the 1024-frame counter is 0. The value of the counter is incremented by 1 for each 64th frame. The value of the last 64th frame in the 1024-frame counter is 15.

[0236] 3) 1024 multiframe inter-frame counter, used to indicate the sequence number of 1024 multiframes, incrementing by 1 every 1024 multiframes;

[0237] 4) Key, including KI.

[0238] For example, as shown in Table 5, is a way to define 64 first fields in a first 64-frame multiframe.

[0239] Table 5

[0240]

[0241] It should be noted that in Table 5, MSB or LSB of X refers to the (X+1)th bit counted from the end of the transmission order. For example, MSB of 32 refers to the 33rd bit counted from the end of the transmission order in the 64-bit multiframe. The field POH1[X:Y] refers to the (X+1)th to (Y+1)th bits counted from the end of the transmission order in the 64-bit multiframe; or, the field POH1[X:Y] refers to the least significant bit of the field being the (X+1)th bit counted from the end of the transmission order, and the most significant bit being the (Y+1)th bit counted from the end of the transmission order.

[0242] Specifically, the 17th to 20th first fields (POH1[44:47]) of the 64 first fields include the security management channel data; the 21st to 24th first fields (POH1[40:43]) of the 64 first fields include the 64 multiframe counters; the 25th to 56th first fields (POH1[8:39]) of the 64 first fields include the 1024 multiframe inter-frame counters; and the 57th to 58th first fields (POH1[6:7]) of the 64 first fields include the key.

[0243] It should be understood that the names of the various expenses in Table 5 are merely examples, and this application does not impose any restrictions on them, as long as the corresponding functions can be achieved.

[0244] Optionally, corresponding to methods 3 and 4 above, each OSU frame in the first 64 multiframes further includes a second field; wherein, in the first 64 multiframes, the value of the second field in the first OSU frame is 1, and the value of the second field in other OSU frames is 0; the second field is used for synchronization of the first encrypted information and the first 64 multiframes. Optionally, the second field is a 64 multiframe indicator M64_P field, located at the 8th bit of the 5th byte in the OSU frame.

[0245] The following section introduces the method for transmitting authentication information in multiframe mode.

[0246] In single-frame mode, authentication and encryption information are transmitted through the same field in a 256-frame multiframe. In contrast, in multiframe mode, authentication and encryption information are transmitted through different fields.

[0247] The first OSU frame further includes a first 256 multiframes. Each OSU frame in the first 256 multiframes includes a third field. The first 256 multiframes include 256 third fields. The 256 third fields include first authentication information, which is obtained by authenticating the first 256 multiframes.

[0248] Optionally, the third field is the RES field.

[0249] Specifically, such as Figure 5 As shown, in the general overhead of the OSU data frame, the second bit of the 6th byte is the RES field. In the embodiments of this application, the authentication overhead, that is, the first authentication information, is carried through the RES field.

[0250] It should be understood that this application uses 256 OSU frames as a cycle, and each OSU frame includes a RES field, that is, each OSU frame includes 1 bit of available field. Therefore, each cycle has a total of 256 bits of available field that can be used to carry authentication overhead. This application carries encryption overhead through this 256-bit overhead field.

[0251] In this application, encryption overhead can also be called path overhead (POH), that is, the RES field mentioned above can also carry POH information. Specifically, the RES field in the 256 multiframe can be used to carry POH2 information. Among them, in the first 256 multiframe mentioned above, the RES field in the first OSU frame is used to carry field POH2

[255] , and the RES field in the last OSU frame is used to carry field POH2[0]; that is, POH2

[255] is sent first, and POH2[0] is sent last.

[0252] Among them, the 33rd to 161st fields (i.e., POH2[223:96]) of the 256 third fields constitute the first authentication overhead field, which includes the first authentication information and has a length of 128 bits.

[0253] Optionally, each OSU frame in the first 256 multiframes further includes a fourth field; wherein, in the first 256 multiframes, the value of the fourth field in the first OSU frame is 1, and the value of the fourth field in the other OSU frames is 0, and the fourth field is used for synchronization of the first authentication information and the first 256 multiframes. Optionally, the fourth field is a 256 multiframe indicator M256_P field, located in the 3rd bit of the 6th byte in the OSU frame.

[0254] S703, the transmitting device sends an OTN frame to the receiving device; correspondingly, the receiving device receives the OTN frame.

[0255] S704, the receiving device obtains N channels of service data based on the OTN frame.

[0256] The receiving device obtains N service data based on the OTN frame, including: the receiving device decrypts the first OSU frame based on the first encryption information to obtain the first service data.

[0257] Before the receiving device decrypts the first OSU frame based on the first encryption information, the receiving device matches the first authentication information and determines whether the match is successful. If so, the receiving device decrypts the first OSU frame based on the first encryption information.

[0258] Specifically, the receiving device can parse the first encrypted information and the first authentication information from the first OSU frame. Furthermore, the receiving device will perform authentication processing on the received first encrypted information and the first OSU frame to obtain authentication information. Then, the receiving device matches the locally generated authentication information with the received first authentication information; if the match is successful, authentication is considered successful.

[0259] The above, combined with Figures 1 to 7 This application describes a data frame transmission method provided in its embodiments. In the various embodiments of this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0260] The following, combined with Figures 8 to 10 This application provides a detailed description of the apparatus, device, and chip system provided in the embodiments. It should be understood that the descriptions of the apparatus embodiments correspond to the descriptions of the method embodiments. Therefore, for details not described in detail, please refer to the above method embodiments; for brevity, some details are omitted.

[0261] Figure 8 This is a schematic block diagram of an optical communication device 1000 provided for an embodiment of this application. Figure 8 As shown, the device 1000 can be set in Figure 1 In the OTN device 101 shown, or the device 1000 may also be provided in Figure 2 The OTN device shown includes a transceiver module 1001, which can be used to implement corresponding transceiver functions. The transceiver module 1001 can also be referred to as a transceiver unit.

[0262] The device 1000 also includes a processing module 1002 (or processing unit), which can be used to implement corresponding processing functions.

[0263] Optionally, the device 1000 further includes a storage unit, which can be used to store instructions and / or data. The processing module 1002 can read the instructions and / or data in the storage unit so that the device can perform the operation of the relevant devices in the foregoing method embodiments.

[0264] The device 1000 can be used to perform the actions performed by the transmitting or receiving device in the above method embodiments. In this case, the device 1000 can be a component of the transmitting or receiving device. The transceiver module 1001 is used to perform the transmission and reception related operations of the transmitting or receiving device in the above method embodiments, and the processing module 1002 is used to perform the processing related operations of the transmitting or receiving device in the above method embodiments.

[0265] It should be understood that the specific process of each module performing the above-mentioned steps has been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity.

[0266] Figure 9 This is a schematic diagram of the structure of an optical communication device provided in an embodiment of this application. Figure 9 As shown, the device 2000 includes a processor 2001 and an optical transceiver 2002. This device can be used in both transmitting and receiving devices. Figure 9 The apparatus shown may include Figure 1 Any of the OTN devices 101 shown, or Figure 9 The apparatus shown may also include Figure 2 The OTN device shown.

[0267] When applied to a transmitting device, processor 2001 is used to implement... Figure 5 In method 500 shown, S502, the optical transceiver 2002 is used to implement... Figure 5 S503 in method 500 is shown. When applied to a receiving device, processor 2001 is used to implement... Figure 5 In method 500 shown, S504, the optical transceiver 2002 is used to implement... Figure 5 S503 in method 500 is shown. In the implementation process, each step of the processing flow can be completed by the transmitting or receiving device through the integrated logic circuitry of the hardware in the processor 2001 or by instructions in the form of software.

[0268] In this application embodiment, the processor 2001 can be a general-purpose processor, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in this application embodiment. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software units within the processor.

[0269] Furthermore, the device 2000 may include one or more processors 2001.

[0270] Optionally, the device 2000 may further include a memory 2003, wherein the program code executed by the processor 2001 to implement the above methods can be stored in the memory 2003. The device 2000 may include one or more memories 2003.

[0271] Specifically, the memory 2003 can be coupled to the processor 2001. The coupling in this embodiment is an indirect coupling or communication connection between devices, units, or modules, and can be electrical, mechanical, or other forms, used for information exchange between devices, units, or modules. Alternatively, the processor 2001 can operate in conjunction with the memory 2003. The memory 2003 can be non-volatile memory, such as a hard disk drive (HDD), or it can be volatile memory, such as random-access memory (RAM). The memory 2003 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited to these. It should be noted that... Figure 9 The device described above can also be used to perform the method steps involved in the variations of the embodiments shown in the foregoing figures, which will not be repeated here.

[0272] Figure 10 This is a schematic diagram of a chip system provided in an embodiment of this application. For example... Figure 10 As shown, the chip system 3000 (or processing system) includes logic circuitry 3010 and input / output interface 3020.

[0273] The logic circuit 3010 can be a processing circuit in the chip system 3000. The logic circuit 3010 can be coupled to a memory unit, calling instructions from the memory unit, enabling the chip system 3000 to implement the methods and functions of the embodiments of this application. The input / output interface 3020 can be an input / output circuit in the chip system 3000, outputting processed information from the chip system 3000, or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0274] Optionally, the logic circuit 3010 may be implemented by one or more processors, including the one or more processors or the processing portion of the one or more processors.

[0275] Optionally, the input / output interface 3020 may include transceiver circuitry, a transceiver, input / output circuitry, or a communication interface.

[0276] As one approach, the chip system 3000 is used to implement the operations performed by the transmitting or receiving device in the various method embodiments described above.

[0277] Specifically, the logic circuit 3010 is used to implement the processing-related operations performed by the transmitting device or the receiving device in the above method embodiments; the input / output interface 3020 is used to implement the sending and / or receiving-related operations performed by the transmitting device or the receiving device in the above method embodiments.

[0278] Based on the above embodiments, this application also provides an optical module, which includes a signal processor and an optical transmitting component. The signal processor is used to: map N channels of service data to N channels of OSU frames and map the N channels of OSU frames to OTN frames in method 500; the optical transmitting component is used to: transmit OTN frames. Alternatively, the optical module includes a signal processor and an optical receiving component. The optical receiving component is used to receive OTN frames; the signal processor is used to: decrypt the first OSU frame in method 500; the optical receiving component is used to: receive OTN frames.

[0279] Based on the above embodiments, this application also provides a computer-readable storage medium. This storage medium stores a software program, which, when read and executed by one or more processors, can implement the methods provided in any one or more of the above embodiments. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory, random access memory, magnetic disk, or optical disk.

[0280] Based on the above embodiments, this application provides a computer program product containing instructions. When this computer program product is run on a computer or processor, it can implement the methods provided in any one or more of the above embodiments.

[0281] Based on the above embodiments, this application also provides a chip. The chip includes a processor for implementing the functions involved in any one or more of the above embodiments, such as acquiring or processing OTN frames involved in the above methods. Optionally, the chip further includes a memory for storing necessary program instructions and data executed by the processor. The chip may be composed of a single chip or may include chips and other discrete devices.

[0282] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

[0283] It should be understood that the processor mentioned in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0284] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM can include a variety of forms, such as: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0285] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0286] Those skilled in the art will recognize that the units and steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application; such implementations should not be considered beyond the scope of protection of this application.

[0287] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of apparatus or units may be electrical, mechanical, or other forms.

[0288] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs). For example, the aforementioned available media can include, but are not limited to, various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0289] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for encrypted transmission of optical service units, characterized in that, include: Obtain N channels of business data; The N service data paths are mapped to N optical service unit (OSU) frames, and the N OSU frames are mapped to optical transport network (OTN) frames. The N service data paths correspond one-to-one with the N OSU frames. The N service data paths include a first service data path. The N OSU frames include a first OSU frame. The payload area of ​​the first OSU frame includes the first service data path encrypted according to the first encryption information. The overhead area of ​​the first OSU frame includes the first encryption information. N is an integer greater than 1. Send the OTN frame.

2. A method for encrypted transmission of optical service units, characterized in that, include: Receive an OTN frame from an optical transport network. The OTN frame is obtained by mapping N optical service unit (OSU) frames. The N OSU frames are obtained by mapping N service data. The N service data correspond one-to-one with the N OSU frames. The N service data includes a first service data. The N OSU frames include a first OSU frame. The payload area of ​​the first OSU frame includes the first service data encrypted according to the first encryption information. The overhead area of ​​the first OSU frame includes the first encryption information. N is an integer greater than 1. The first OSU frame is decrypted based on the first encryption information to obtain the first channel service data.

3. The method according to claim 1 or 2, characterized in that, The overhead region of the first OSU frame includes the first encryption information, including: The first OSU frame includes a first multiframe. The overhead area of ​​each OSU frame in the first multiframe includes a first field. The overhead area of ​​the first multiframe includes M first fields, and the M first fields include the first encryption information, where M≤N.

4. The method according to claim 3, characterized in that, The first multiframe is a first 64-frame multiframe, and the overhead area of ​​the first 64-frame multiframe includes 64 first fields, the 64 first fields including the first encryption information.

5. The method according to claim 4, characterized in that, The first encrypted information includes at least one of the following: Security management channel data; A 64-frame counter is used to indicate the sequence number of the 64th frame out of 1024 frames; A 1024-frame inter-frame counter, used to indicate the sequence number of a 1024-frame multiframe; Key; The first indication message indicating the completion of the local key management channel (KCC) establishment; Request the other end to establish a second instruction message for KCC.

6. The method according to claim 5, characterized in that, The 64 first fields include the first encrypted information, including: The 17th to 20th of the 64 first fields include the security management channel data; and / or, The 21st to 24th first fields of the 64 first fields include the 64 multiframe counters; and / or, The 25th to 56th of the 64 first fields include the 1024 multiframe inter-counter; and / or, The 57th to 58th first fields of the 64 first fields include the key; and / or, The 63rd of the 64 first fields includes the first indication information; and / or, The 64th first field of the 64 first fields includes the second indication information.

7. The method according to claim 5, characterized in that, The 64 first fields include the first encrypted information, including: The 17th to 20th of the 64 first fields include the security management channel data; and / or, The 21st to 24th first fields of the 64 first fields include the 64 multiframe counters; and / or, The 25th to 56th of the 64 first fields include the 1024 multiframe inter-counter; and / or, The 57th to 58th of the 64 first fields include the key.

8. The method according to any one of claims 4 to 7, characterized in that, The first field is the POH1 field.

9. The method according to any one of claims 4 to 8, characterized in that, The length of the first field is 1 bit.

10. The method according to any one of claims 3 to 9, characterized in that, The overhead area of ​​each OSU frame in the first multiframe also includes a second field; wherein, in the first multiframe, the value of the second field in the first OSU frame is 1, and the value of the second field in other OSU frames is 0; the second field is used for the synchronization of the first encryption information and the first multiframe.

11. The method according to claim 10, characterized in that, The second field is the 64-frame indicator M64_P field.

12. The method according to any one of claims 1 to 11, characterized in that, The first OSU frame further includes a first 256 multiframe. The overhead area of ​​each OSU frame in the first 256 multiframe includes a third field. The first 256 multiframe includes 256 third fields. The 256 third fields include first authentication information, which is obtained by authenticating the first 256 multiframe.

13. The method according to claim 12, characterized in that, The 256 third fields include first authentication information, including: The 33rd to 161st fields of the 256 third fields constitute the first authentication overhead field, which includes the first authentication information.

14. The method according to claim 12 or 13, characterized in that, The third field is the POH2 field.

15. The method according to any one of claims 12 to 14, characterized in that, The length of the third field is 1 bit.

16. The method according to any one of claims 12 to 15, characterized in that, Each OSU frame in the first 256 multiframes further includes a fourth field; wherein, in the first 256 multiframes, the value of the fourth field in the first OSU frame is 1, and the value of the fourth field in the other OSU frames is 0, and the fourth field is used for the synchronization of the first authentication information and the first 256 multiframes.

17. The method according to claim 16, characterized in that, The fourth field is the 256 multiframe indicator M256_P field.

18. The method according to claim 1 or 2, characterized in that, The overhead region of the first OSU frame includes the first encryption information, including: The first OSU frame includes a second 256 multiframe, and the overhead area of ​​each OSU frame in the second 256 multiframe includes a fifth field. The second 256 multiframe includes 256 fifth fields, and the 256 fifth fields include the first encryption information. The second 256 multiframe includes four second 64 multiframes, and each second 64 multiframe includes 64 fifth fields.

19. The method according to claim 18, characterized in that, The first encrypted information includes at least one of the following: Security management channel data; A 64-frame inter-frame counter is used to indicate the sequence number of the second 256-frame, and each of the four second 64-frames includes one of the 64-frame inter-frame counters. Key; The first indication message indicating that the local KCC channel has been established; The second instruction message requests the other end to establish a KCC channel.

20. The method according to claim 18 or 19, characterized in that, The 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

21. The method according to claim 20, characterized in that, The 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: The first 32 fifth fields of the first, second, third, and fourth second 64-frame complexes constitute the second encryption overhead field, which includes the first encryption information. The last 32 fifth fields included in the first, second, third, and fourth second 64-frame multiframes constitute the second authentication overhead field, which includes the first authentication information.

22. The method according to claim 21, characterized in that, The second encryption overhead field includes the first encryption information, including: The 29th to 32nd fifth fields of the first, second, third, and fourth second 64-frame complexes of the four second 64-frame complexes include the security management channel data; and / or, The third to 28th fifth fields of the first, second, third, and fourth second 64-frame multiframes include the 64-frame inter-frame counter; and / or, The first fifth field of the first, second, third, and fourth second 64-frame complexes of the four second 64-frame complexes includes the key; and / or, The second fifth field of the second second 64-frame and the second fifth field of the fourth second 64-frame include the first indication information; and / or, The second fifth field of the first second 64-frame and the second fifth field of the third second 64-frame among the four second 64-frames include the second indication information.

23. The method according to any one of claims 18 to 22, characterized in that, Each OSU frame in the second 256 multiframes also includes a sixth field, which is used to identify the 32-frame cycle and 256-frame cycle of the OSU frame, and is used for the synchronization of the first encryption information and the second 256 multiframes.

24. The method according to claim 1 or 2, characterized in that, The overhead region of the first OSU frame includes the first encryption information, including: The first OSU frame includes a third 256-frame complex, and the overhead area of ​​each OSU frame in the third 256-frame complex includes a fifth field; the third 256-frame complex includes 256 fifth fields, and the 256 fifth fields include the first encryption information.

25. The method according to claim 24, characterized in that, The first encrypted information includes at least one of the following: Security management channel data; Key; Encryption type indicator CST; The 256-frame inter-frame counter is used to indicate the sequence number of the 256-frame multiframe.

26. The method according to claim 23 or 24, characterized in that, The 256 fifth fields also include first authentication information, which is obtained by authenticating the first OSU frame.

27. The method according to claim 26, characterized in that, The 256 fifth fields include the first encryption information, and the 256 fifth fields also include first authentication information, including: The 162nd to 216th fifth fields out of the 256 fifth fields constitute the third encryption overhead field, which includes the first encryption information; the 33rd to 161st fifth fields out of the 256 fifth fields constitute the third authentication overhead field, which includes the first authentication information.

28. The method according to claim 27, characterized in that, The third encryption overhead field includes the first encryption information, including: The 162nd to 177th fifth fields out of the 256 fifth fields include the security management channel data; and / or, The 178th to 179th fifth fields out of the 256 fifth fields include the key; and / or, The 180th to 185th fifth fields out of the 256 fifth fields include the CST; and / or, The 186th to 217th fifth fields of the 256 fifth fields include the 256 multiframe inter-counters.

29. The method according to any one of claims 18 to 28, characterized in that, The fifth field is a reserved RES field for the future.

30. The method according to any one of claims 18 to 29, characterized in that, The length of the fifth field is 1 bit.

31. An optical communication device, characterized in that, include: A processor and an input / output interface for performing the method as described in any one of claims 1, 3 to 30, or for performing the method as described in any one of claims 2 to 30, wherein... The input / output interface is used to receive and transmit OTN frames. The processor is used to process the OTN frame.

32. An optical module, characterized in that, The optical module includes a signal processor and an optical emitting component, wherein... The signal processor is configured to perform the method as described in any one of claims 1, 3 to 30; The optical transmitting component is used to convert optical transport network (OTN) frames into optical signals and transmit the optical signals.

33. An optical module, characterized in that, The optical module includes a signal processor and an optical receiver component, wherein... The optical receiving component is used to receive optical signals and convert the optical signals into Optical Transport Network (OTN) frames; The signal processor is configured to perform the method as described in any one of claims 2 to 30.

34. An optical chip, characterized in that, The chip includes a processor and a communication interface for performing the method as described in any one of claims 1, 3 to 30, or for performing the method as described in any one of claims 2 to 30, wherein... The communication interface is used to receive and transmit OTN frames. The processor is used to process the OTN frame.

Images