Method and apparatus for fgotn encrypted transmission

Abstract

This application provides a method and apparatus for encrypted transmission of fgOTN. The method includes: acquiring N channels of service data; mapping the N channels of service data to N channels of fgOTN frames, and mapping the N channels of fgOTN frames to OTN frames, wherein the N channels of service data correspond one-to-one with the N channels of fgOTN frames, the N channels of service data include a first channel of service data, the N channels of fgOTN frames include a first fgOTN frame, the payload area of ​​the first fgOTN frame includes the first channel of service data encrypted according to first encryption information, the overhead area of ​​the first fgOTN frame includes the first encryption information, and N is an integer greater than 1; and transmitting the OTN frames. This method is used to encrypt fgOTN frames to achieve end-to-end secure transmission of fgOTN.

Description

[0001] This application claims priority to Chinese Patent Application No. 202510047757.4, filed on January 10, 2025, entitled "Method and Apparatus for Encrypted Transmission of fgOTN", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of optical communications, and more specifically, to a method and apparatus for fgOTN encrypted transmission. Background Technology

[0003] Optical networks are gradually evolving towards ultra-high-speed transmission technologies, with 100G and 400G optical transport network (OTN) technologies becoming the main choices for transmission networks. Among them, OTN technology, which is mainly designed for ultra-high bandwidth transmission and has a transmission speed exceeding 1T bit / s (B1T), has become a research hotspot.

[0004] To efficiently support high-quality dedicated line services for government and enterprises and home broadband video services, enhance the bandwidth capability of OTN to support full-rate services (10Mb / s and above), and improve the flexibility of OTN in adapting to services, fine-grained OTN (fgOTN) is adopted to carry small-grained services.

[0005] For scenarios that use fgOTN frames to encapsulate services, existing encryption technologies cannot achieve end-to-end channel encryption of fgOTN frames. Summary of the Invention

[0006] This application provides a method and apparatus for encrypted transmission of fgOTN, used to encrypt the payload area of ​​fgOTN frames to achieve end-to-end secure transmission of fgOTN.

[0007] Firstly, a method for encrypted transmission using fgOTN is provided. This method can be executed by a transmitting device. Unless otherwise specified, "transmitting device" in this application can refer to the transmitting device itself (e.g., an OTN device), a component within the transmitting device (e.g., a communication module, processor, circuit, chip, or chip system), or a logic module or software capable of implementing all or part of the functions of the transmitting device. This application does not limit the scope of the terminology.

[0008] The method includes: acquiring N channels of service data; mapping the N channels of service data to N channels of fine-grained optical transport network (fgOTN) frames, and mapping the N channels of fgOTN frames to optical transport network (OTN) frames, wherein the N channels of service data correspond one-to-one with the N channels of fgOTN frames, the N channels of service data include a first channel of service data, the N channels of fgOTN frames include a first fgOTN frame, the payload area of ​​the first fgOTN frame includes the first channel of service data encrypted according to the first encryption information, the overhead area of ​​the first fgOTN frame includes the first encryption information, and N is an integer greater than 1; and transmitting the OTN frames.

[0009] Based on the above scheme, the payload area of ​​the fgOTN frame is encrypted before being mapped to a higher-order OTN frame, and encryption overhead is carried in the fgOTN frame to achieve end-to-end secure transmission of fgOTN. Furthermore, this method allows for selective encryption of a portion of the N service data streams, meaning it can encrypt a portion of the fgOTN frames within the OTN frame, increasing the flexibility of encrypted service data transmission.

[0010] The OTN frame is a higher-order frame than the OSU frame, for example, the OTN frame is ODUk, OTUk, etc.

[0011] In some implementations, the first encrypted information includes at least one of the following: encrypted frame counter FN; key data; and security management channel data.

[0012] In some implementations, the overhead area of ​​the first fgOTN frame includes the first encryption information, including: the first fgOTN frame includes a first multiframe, and the overhead area of ​​each fgOTN frame in the first multiframe includes a first field, a second field, and a third field; the first multiframe includes M first fields, M second fields, and M third fields; wherein the first field is used to carry the FN, the second field is used to carry the KEY data, and the third field is used to carry the security management channel data.

[0013] In some implementations, the first field is used to carry the FN, including: each of the M first fields is used to carry one FN, and the M first fields are used to carry M FNs.

[0014] In some implementations, the second field is used to carry the KEY data, including: the first multiframe includes L 32 multiframes, and the 32 second fields corresponding to each of the L 32 multiframes are used to carry a set of KEY data.

[0015] In some implementations, the third field is used to carry the security management channel data, including: the first multiframe includes P odd and even frames, and the two third fields corresponding to each of the P odd and even frames are used to carry a set of security management channel data.

[0016] In some implementations, the first multiframe is a 32-frame, which includes 32 first fields, 32 second fields, and 32 third fields.

[0017] Based on the above scheme, the encryption overhead is carried through 32 fgOTN frames as a cycle.

[0018] In some implementations, the first field is located in the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is located in the first row of the 1918th byte column of the fgOTN frame, and the third field is located in the 14th byte column of the fgOTN frame. Alternatively, the second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the 14th byte column of the fgOTN frame is used to carry the security management channel data.

[0019] In some implementations, the first field is located in the first row of columns 9 to 11 of the fgOTN frame, the second field is located in the first row of column 8 of the fgOTN frame, and the third field is located in the second row of columns 8 to 11 of the fgOTN frame. Alternatively, the first row of columns 9 to 11 of the fgOTN frame carries the FN, the first row of column 8 of the fgOTN frame carries the KEY data, and the second row of columns 8 to 11 of the fgOTN frame carries the security management channel data.

[0020] In some implementations, the first field is located in the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is located in the first row of the 1918th byte column of the fgOTN frame, and the third field is located in the second row of the 8th to 11th byte columns of the fgOTN frame. Alternatively, the second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry the security management channel data.

[0021] In some implementations, the first field, the second field, and the third field are reserved as RES fields for future use.

[0022] In some implementations, the first field is located in the second to fourth rows of the 1910th byte column of the fgOTN frame, the second field is located in the first row of the 1910th byte column of the fgOTN frame, and the third field is located in the 1909th byte column of the fgOTN frame. Alternatively, the second to fourth rows of the 1910th byte column of the fgOTN frame are used to carry the FN, the first row of the 1910th byte column of the fgOTN frame is used to carry the KEY data, and the 1909th byte column of the fgOTN frame is used to carry the security management channel data.

[0023] In some implementations, the first field, the second field, and the third field are path tracking indicator (TTI) fields for path monitoring (PM).

[0024] Secondly, a method for encrypted transmission of fgOTN is provided. This method can be executed by a receiving device. Unless otherwise specified, the term "receiving device" in this application can refer to the transmitting device itself (e.g., an OTN device), a component in the receiving device (e.g., a communication module, processor, circuit, chip, or chip system), or a logic module or software that can implement all or part of the functions of the receiving device. This application does not limit the term in this respect.

[0025] The method includes: receiving an optical transport network (OTN) frame, wherein the OTN frame is obtained by mapping N fgOTN frames, and the N fgOTN frames are obtained by mapping N service data, wherein the N service data correspond one-to-one with the N fgOTN frames, the N service data include a first service data, the N fgOTN frames include a first fgOTN frame, the payload area of ​​the first fgOTN frame includes the first service data encrypted according to first encryption information, the overhead area of ​​the first fgOTN frame includes the first encryption information, and N is an integer greater than 1; decrypting the first fgOTN frame according to the first encryption information to obtain the first service data.

[0026] In some implementations, the first encrypted information includes at least one of the following: encrypted frame counter FN; key data; and security management channel data.

[0027] In some implementations, the overhead area of ​​the first fgOTN frame includes the first encryption information, including: the first fgOTN frame includes a first multiframe, and the overhead area of ​​each fgOTN frame in the first multiframe includes a first field, a second field, and a third field; the first multiframe includes M first fields, M second fields, and M third fields; wherein the first field is used to carry the FN, the second field is used to carry the KEY data, and the third field is used to carry the security management channel data.

[0028] In some implementations, the first field is used to carry the FN, including: each of the M first fields is used to carry one FN, and the M first fields are used to carry M FNs.

[0029] In some implementations, the second field is used to carry the KEY data, including: the first multiframe includes L 32 multiframes, and the 32 second fields corresponding to each of the L 32 multiframes are used to carry a set of KEY data.

[0030] In some implementations, the third field is used to carry the security management channel data, including: the first multiframe includes P odd and even frames, and the two third fields corresponding to each of the P odd and even frames are used to carry a set of security management channel data.

[0031] In some implementations, the first multiframe is a 32-frame, which includes 32 first fields, 32 second fields, and 32 third fields.

[0032] In some implementations, the first field is located in the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is located in the first row of the 1918th byte column of the fgOTN frame, and the third field is located in the 14th byte column of the fgOTN frame.

[0033] In some implementations, the first field is located in the first row of the 9th to 11th byte columns of the fgOTN frame, the second field is located in the first row of the 8th byte column of the fgOTN frame, and the third field is located in the second row of the 8th to 11th byte columns of the fgOTN frame.

[0034] In some implementations, the first field is located in the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is located in the first row of the 1918th byte column of the fgOTN frame, and the third field is located in the second row of the 8th to 11th byte columns of the fgOTN frame.

[0035] In some implementations, the first field, the second field, and the third field are reserved as RES fields for future use.

[0036] In some implementations, the first field is located in the second to fourth rows of the 1910th byte column of the fgOTN frame, the second field is located in the first row of the 1910th byte column of the fgOTN frame, and the third field is located in the 1909th byte column of the fgOTN frame.

[0037] In some implementations, the first field, the second field, and the third field are path tracking indicator (TTI) fields for path monitoring (PM).

[0038] Thirdly, embodiments of this application provide an optical communication device. This device is used to execute the method provided in the first aspect, or to execute the method provided in the second aspect. Specifically, the device may include units and / or modules for executing the method provided in the first aspect or any of the above-described implementations of the first aspect; alternatively, the device may include units and / or modules for executing the method provided in the second aspect or any of the above-described implementations of the second aspect, such as a processing module and a transceiver module.

[0039] In one implementation, the optical communication device may include units and / or modules for performing the method provided in the first aspect or any of the above implementations of the first aspect, serving as a transmitting end device. The transceiver module may be a transceiver, or an input / output interface. The processing module may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0040] Alternatively, the optical communication device may be a chip, chip system, or circuit in the transmitting end equipment. The transceiver module may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip, chip system, or circuit. The processing module may be at least one processor, processing circuit, or logic circuit.

[0041] In another implementation, the optical communication device may include units and / or modules for performing the methods provided in the second aspect or any of the above implementations of the second aspect, serving as a receiving device. The transceiver module may be a transceiver, or an input / output interface. The processing module may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0042] Alternatively, the optical communication device may be a chip, chip system, or circuit in the receiving end equipment. The transceiver module may be an input / output interface, interface circuit, output circuit, input circuit, pin, or related circuit on the chip, chip system, or circuit. The processing module may be at least one processor, processing circuit, or logic circuit.

[0043] Fourthly, a processor is provided for executing the methods provided in the above aspects.

[0044] Unless otherwise specified, or if it does not contradict its actual function or internal logic in the relevant description, the transmission and acquisition / reception operations involved in the processor can be understood as processor output and reception, input and other operations, or as transmission and reception operations performed by radio frequency circuits and antennas. This application does not limit them in this regard.

[0045] Fifthly, an optical module is provided, comprising a signal processor and an optical transmitting component. The signal processor is used to execute the method provided in the first aspect or any of the above implementations of the first aspect. The optical transmitting component is used to convert a first fgOTN frame into an optical signal and transmit the optical signal.

[0046] In a sixth aspect, an optical module is provided, comprising a signal processor and an optical receiving component. The optical receiving component is used to receive optical signals and convert the optical signals into a first fgOTN frame; the signal processor is used to execute the method provided in the second aspect or any of the above implementations of the second aspect.

[0047] In a seventh aspect, embodiments of this application provide a network device, the network device comprising: a processor and an input / output interface, for executing the method provided in any implementation of the first or second aspect described above, wherein the input / output interface is used to send and receive a first fgOTN frame, and the processor is used to process the first fgOTN frame.

[0048] Eighthly, a computer-readable storage medium is provided. This computer-readable storage medium stores program code for execution by a device, the program code including methods for performing any implementation of the first or second aspect described above.

[0049] A ninth aspect provides a computer program product containing instructions. When the computer program product is run on a computer or processor, it causes the computer or processor to perform the method provided by any implementation of the first or second aspect described above.

[0050] In a tenth aspect, a chip is provided. The chip includes a processor and a communication interface, wherein the processor reads instructions stored in a memory through the communication interface and executes the method provided in any implementation of the first or second aspect described above.

[0051] Optionally, as one implementation, the chip also includes a memory storing computer programs or instructions, and a processor for executing the computer programs or instructions stored in the memory. When the computer programs or instructions are executed, the processor is used to perform the method provided by any of the implementations of the first or second aspect described above.

[0052] The beneficial effects of the third to tenth aspects mentioned above can be found in the descriptions of the beneficial effects in the first or second aspects, and will not be repeated here. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of an OTN optical network system applicable to the embodiments of this application.

[0054] Figure 2 This is a schematic diagram of the hardware structure of an OTN device applicable to the embodiments of this application.

[0055] Figure 3 This is a schematic diagram of the hardware structure of an optical module applicable to an embodiment of this application.

[0056] Figure 4 This is a schematic diagram of an fgOTN frame structure.

[0057] Figure 5 This is a schematic diagram illustrating an application scenario applicable to an embodiment of this application.

[0058] Figure 6 This is a schematic flowchart illustrating an OSU encrypted transmission method provided in an embodiment of this application.

[0059] Figure 7 This is a schematic diagram of an fgOTN frame structure.

[0060] Figure 8 This is a schematic diagram of an fgOTN frame structure.

[0061] Figure 9 This is a schematic diagram of an fgOTN frame structure.

[0062] Figure 10 This is a schematic diagram of an fgOTN frame structure.

[0063] Figure 11 This is a schematic block diagram of an optical communication device provided in an embodiment of this application.

[0064] Figure 12This is a schematic diagram of the structure of an optical communication device provided in an embodiment of this application.

[0065] Figure 13 This is a schematic diagram of a chip system provided in an embodiment of this application. Detailed Implementation

[0066] The following description is provided to facilitate understanding of the embodiments of this application.

[0067] (1) In this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0068] (2) In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates that the related objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can mean: a, or, b, or, c, or, a and b, or, a and c, or, b and c, or, a, b, and c. Where a, b, and c can be single or multiple.

[0069] (3) In this application, the terms "first," "second," and various numerical designations are used for convenience of description and are not intended to limit the scope of the embodiments of this application. For example, they are used to distinguish different messages, rather than to describe a specific order or sequence. It should be understood that such descriptions can be interchanged where appropriate to describe solutions other than those in the embodiments of this application.

[0070] (4) In this application, “instruction” or “for instruction” can include both direct instruction and indirect instruction. When describing an instruction as being used to instruct A, it can include whether the instruction directly instructs A or indirectly instructs A, but does not necessarily mean that the instruction carries A.

[0071] The indication methods involved in the embodiments of this application should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. Moreover, the sending period and / or sending time of these sub-information can be the same or different. This application does not limit the sending method, for example.

[0072] (5) In this application, the words “exemplary,” “for example,” “such as,” etc., are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as an “example” in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word “example” is intended to present the concept in a specific manner. In the embodiments of this application, “of,” “corresponding, relevant,” “corresponding,” and “associate” may sometimes be used interchangeably, and it should be noted that their intended meanings are consistent when their distinctions are not emphasized.

[0073] (6) In this application, "send" and "receive" indicate the direction of signal transmission. For example, "receiving information from YY" can be understood as the source of the information being YY, which may include receiving directly from YY through a communication interface (or input / output interface), or receiving indirectly from YY through a communication interface from other units or modules. "Send" can also be understood as the "output" of the chip interface, and "receive" can also be understood as the "input" of the chip interface. In other words, sending and receiving can be performed between devices, such as between OTN device #1 and OTN device #2, or they can be performed within a device, for example, by sending or receiving between components, modules, chips, software modules, or hardware modules within the device via a bus, trace, or interface.

[0074] (7) In this application, "data frame" may also be referred to as "frame" or "signal". For example, an OTN frame may be referred to as an OTN signal, an OTN frame, or an OTN data frame. It should be noted that both "frame" and "signal" in this application are used to carry service data. When used to describe the data structure carrying service data, it is generally understood as "frame" such as an OSU frame; when used to describe the carrier carrying service data, or to describe the transmission of service data, it is generally understood as "signal". In the following description, this application does not make a special distinction between "frame" and "signal".

[0075] Specifically, the OTN signal can be any of the following: optical payload unit (OPU) signal, ODU signal (such as ODUk, ODUflex, etc.), optical transport unit (OTU) signal (such as OTUk, OTUCn, where k represents different rate levels and Cn represents variable rate), FlexO signal, etc. It should be understood that this application also applies to other data frames, such as metro transport network (MTN) frames, or to new types of OTN and MTN frames that may be defined as OTN and MTN technologies develop.

[0076] (8) In this application, examples are given using a transmitting device and a receiving device as the implementing entities. A device may be referred to as a node or node device, and a transmitting device may be referred to as a transmitting node, transmitting end, or source node. Similarly, in this application, a receiving device may be referred to as a receiving device, receiving end, or destination node. Exemplarily, a transmitting device may be referred to as a transmitting end device, transmitting end node, or transmitting node, etc., and similarly, in this application, a receiving device may be referred to as a receiving end device, receiving end node, or receiving node, etc. For example, the transmitting device may be one of the following OTN devices (such as...). Figure 1 The OTN device A shown in the figure, from the customer equipment (such as Figure 1 The client equipment shown in the diagram receives service data. Alternatively, the transmitting device can be any other device capable of implementing an OTN device. The specific form of the transmitting or receiving device is not limited in this application embodiment, as long as it can achieve the corresponding communication function.

[0077] The technical solution of this application will be described in detail below with reference to the accompanying drawings.

[0078] The embodiments of this application are applicable to optical networks, such as OTN. An OTN is typically composed of multiple devices connected by optical fibers, and can be configured into different topologies such as linear, ring, and mesh, depending on specific needs.

[0079] Figure 1 This is a schematic diagram of an OTN optical network system to which this application's embodiments apply. Figure 1 As shown, OTN 100 includes eight interconnected OTN devices 101, also known as devices AH. 102 indicates an optical fiber used to connect two devices; 103 indicates a customer service interface used to receive or transmit customer service data. Figure 1 As shown, OTN 100 is used to transmit service data for customer devices 1-3. Customer devices 1-3 can be Ethernet devices, and the service data can be Ethernet service data. The customer devices are connected to the OTN device through customer service interfaces. For example, Figure 1In the middle, customer equipment 1-3 are connected to OTN equipment A, H and F respectively.

[0080] Depending on the specific needs, an OTN device may possess different functions. Generally speaking, OTN devices are categorized into optical layer devices, electrical layer devices, and hybrid optoelectronic devices. Optical layer devices refer to those capable of processing optical layer signals, such as optical amplifiers and optical add-drop multiplexers. Optical amplifiers amplify optical signals to support longer transmission distances while maintaining specific optical signal performance. Optical add-drop multiplexers perform spatial transformations on optical signals, allowing them to be output from different output ports (sometimes referred to as directions). Electrical layer devices refer to those capable of processing electrical layer signals, such as devices capable of processing OTN signals. Hybrid optoelectronic devices refer to devices capable of processing both optical and electrical layer signals. It should be noted that, depending on specific integration requirements, an OTN device can integrate multiple different functions. The technical solutions provided in this application are applicable to OTN devices with different forms and integration levels that include electrical layer functions.

[0081] Figure 2 This is a schematic diagram of the hardware structure of an OTN device applicable to embodiments of this application. Specifically, the OTN device may include one or more of a tributary board, a line board, and a cross-connect board, and may also include one or more of a system control board, a power supply, a fan, and auxiliary boards.

[0082] The circuit board can also be an optical layer processing board. Depending on specific needs, the type and number of boards included in each device may differ. For example, an OTN device acting as a core node may not have tributary boards. An OTN device acting as an edge node may have multiple tributary boards. Power supply boards are used to power the OTN device and may include primary and backup power supplies. Fan boards are used for heat dissipation. Auxiliary boards provide auxiliary functions such as external alarms or access to external clocks. Tributary boards, cross-connect boards, and circuit boards are primarily used to process OTN electrical layer signals (also known as OTN frames). Tributary boards are used to receive and transmit various client signals (also known as client services). Client signals can include constant bit rate (CBR) signals (e.g., synchronous digital hierarchy (SDH) signals) and packet signals (e.g., Ethernet signals). Furthermore, tributary boards can include client-side optical modules and signal processors. Client-side optical modules are used to receive and / or transmit client signals. Signal processors are used to perform mapping and demapping processing of client signals to OTN frames. The signal processor can be located inside or outside the customer-side optical module. If the signal processor is a combination of multiple chips, one (or some) of these chips can be inside the customer-side optical module, while the others are outside. The cross-connect board is used to implement the switching of OTN frames, for example, to perform the switching of one or more types of OTN frames. The line board primarily implements the processing of line-side OTN frames. Specifically, the line board can include a line-side optical module and a signal processor. The line-side optical module, which can be called an optical transceiver, is used to receive and / or transmit optical signals carrying OTN frames. The signal processor is used to implement multiplexing and demultiplexing, or mapping and demapping, of the line-side OTN frames. The signal processor can be located inside or outside the line-side optical module. If the signal processor is a combination of multiple chips, one (or some) of these chips can be inside the line-side optical module, while the others are outside. The customer-side optical module or the line-side optical module can also be collectively referred to as an optical module or an optical transceiver. The signal processors in either the customer-side or line-side optical modules can be optical digital signal processors (oDSPs) or framers, or a combination of framers and oDSPs. System control boards are used for system control. Specifically, the system control board can collect information from different boards or send control commands to the corresponding boards.

[0083] It should be noted that, unless otherwise specified, a specific component (such as a tributary board) may be one or more, and this application does not impose any restrictions. This application also does not impose any restrictions on the type of boards included in the device, or on the functional design and quantity of the boards. It should also be noted that, in a specific implementation, the two boards mentioned above may also be designed as a single board. Furthermore, network devices may also include backup power supplies, fans for device cooling, auxiliary boards for providing external alarms or accessing external clocks, etc.

[0084] Figure 3 This is a schematic diagram of the hardware structure of an optical module applicable to an embodiment of this application. Figure 3 As shown, an optical module may include a signal processor, an optical transmitting component, and an optical receiving component. As mentioned above, the signal processor may include a framer or an oDSP, or a combination of a framer and an oDSP. An optical module can be a unidirectional optical module, meaning it includes either an optical transmitting component or an optical receiving component. An optical module can also be a bidirectional optical module, meaning it includes both an optical transmitting component and an optical receiving component.

[0085] Framer, also known as a service chip or physical layer (PHY) chip, is primarily used for OTN electrical layer encapsulation / decapsulation (or mapping / demapping). Framers encapsulate client signals into OTN frames or decapsulate OTN frames to obtain client signals. For example, a framer can encapsulate client signals into ODUs, encapsulate low-rate ODUs into high-rate ODUs, encapsulate ODUs into flexible OTN (FlexO) frames, or directly encapsulate client signals into FlexO frames. Decapsulation is the reverse process of encapsulation.

[0086] The oDSP is used to perform digital signal processing on OTN frames generated by the Framer, or on electrical signals obtained from the optical receiving component. The oDSP is used to perform one or more of the following processing operations: forward error correction (FEC), clock recovery, equalization, sequence detection, and signal decision.

[0087] FEC is an error control method that refers to pre-encoding the signal according to a certain algorithm before it is sent into the transmission channel, adding redundant data with the characteristics of the signal itself, and then decoding the received signal at the receiving end according to the corresponding algorithm to find and correct the error codes generated during transmission.

[0088] Optical transmitting module (TOSA): Also known as a transmitter optical subassembly, it is used to convert electrical signals into optical signals. A TOSA may include a light source, a driver chip, and a modulator. The light source can be a semiconductor laser (also known as a laser diode (LD) or a light emitting diode (LED). The driver chip processes the electrical signals generated by the oDSP and drives the light source to emit modulated optical signals. The modulated optical signals are transmitted to the fiber optic line via an optical fiber interface.

[0089] Optical receiver assembly (ROSA), also known as a receiver optical subassembly, is used to convert optical signals into electrical signals. ROSA may include photodetectors, amplifiers, etc. The photodetector can be an avalanche photodiode (APD) or a PIN photodiode. The amplifier may include a preamplifier and a post-amplifier. After the optical signal enters from the fiber optic interface, it is converted into an electrical signal by the photodetector, and then amplified by the amplifier to output an amplified electrical signal.

[0090] It should be noted that the client signal involved in the embodiments of this application can refer to the service carried by the optical transport network or the metropolitan area transport network, such as Ethernet service, packet service, or wireless backhaul service. The client signal can also be referred to as client-side signal, client signal, service signal, service data, client data, or client service data, etc.

[0091] The above Figures 1 to 3 The examples provided are for illustrative purposes only and do not preclude other structural schemes.

[0092] To facilitate understanding of the technical solutions of the embodiments of this application, some terms or concepts that may be involved in the embodiments of this application will be briefly described first.

[0093] 1. OTN Frame: The data frame structure used by OTN devices is the OTN frame. OTN frames can also be called OTN transmission frames. OTN frames are used to carry various service data and provide rich management and monitoring functions. OTN frames can be Flexible Optical Service Unit (OSUflex) frames, which can also be simply called OSU frames. Alternatively, OTN frames can also be ODUk, ODUCN, ODUflex, or OTUk, OTUCn, or Flexible OTN (FlexO) frames, etc. Alternatively, OTN frames can also be Flexible Fine Grain Optical Data Unit (fgODUflex) frames, which can also be simply called fgODU frames or fgOTN frames.

[0094] It should be noted that this application is based on a scheme proposed for encrypting fgOTN frames.

[0095] 2. fgOTN frame structure

[0096] In this application, fgOTN frame refers to fgODUflex frame.

[0097] The fgODUflex frame structure is as follows: Figure 4 As shown, the fgODUflex frame has a 4-row, 3824-byte column structure and includes two main regions: 1) fgODUflex overhead region 2) fgOPUflex region Among them, the first to 14th byte columns and the 1905th to 1918th byte columns are the fgODUflex overhead areas.

[0098] Among them, columns 15 to 1904 and columns 1919 to 3824 are dedicated to the fgOPUflex region.

[0099] The fgOPUflex frame includes two main regions: 1) fgOPUflex overhead area 2) fgOPUflex net load area Among them, the 15th to 16th byte column and the 1919th to 1920th byte column are the fgOPUflex overhead area.

[0100] Among them, bytes 17 to 1904 and bytes 1921 to 3824 are the fgOPUflex payload area.

[0101] In this application, all frame structures and overhead are transmitted from left to right, with the most significant bit of each byte transmitted first. The first bit of each byte is the most significant bit, and the eighth bit is the least significant bit.

[0102] With increasing emphasis on the security of business transmission, it is necessary to encrypt the transmitted business. For scenarios that use fgOTN frames to encapsulate business, existing encryption technologies cannot provide end-to-end channel encryption for fgOTN frames.

[0103] In view of this, embodiments of this application provide a method and apparatus for encrypted transmission of fgOTN frames, applicable to, for example... Figure 5 In the scenario shown, by physically encrypting the payload area of ​​the fgOTN frame before encapsulating it into an OTN frame (e.g., ODU), the security of service data transmission over the operator's network is ensured. Physical layer encryption of the fgOTN frame can carry any type of service and offers advantages such as minimal network latency (intermediate nodes can pass through, encryption latency is in the nanosecond (ns) range), high bandwidth utilization (100%), no impact on upper layers, and no bandwidth loss.

[0104] The following will describe in detail, with reference to the accompanying drawings, the method for encrypted transmission of fgOTN frames provided in the embodiments of this application, which can be applied to the above. Figure 1 The communication system shown. It should be understood that the embodiments of this application can be applied to scenarios where the transmitting device and the receiving device communicate.

[0105] It should also be understood that the embodiments shown below do not specifically limit the structure of the execution subject of the method provided in the embodiments of this application, as long as it is possible to communicate according to the method provided in the embodiments of this application by running the code or program that records the method provided in the embodiments of this application. For example, the method provided in the embodiments of this application can be executed by a transmitting device and a receiving device. Unless otherwise specified, the device in this application, such as the transmitting device and the receiving device, can refer to the device itself (e.g., an OTN device), or a component in the device (e.g., a communication module, processor, circuit, chip, or chip system, etc.), or it can be a logic module or software that can implement all or part of the device functions.

[0106] Figure 6 This is a schematic flowchart illustrating a method 500 for encrypted transmission of fgOTN frames provided in an embodiment of this application. Figure 6 As shown, the transmitting device can be an OTN device, or it can be performed by a component of an OTN device (such as a chip or chip system). The receiving device can be an OTN device, or it can be performed by a component of an OTN device (such as a chip or chip system). Specifically, the method includes the following steps.

[0107] S501, the transmitting device acquires N channels of service data.

[0108] For example, service data refers to services that can be carried by an optical transport network or metropolitan area transport network, including but not limited to Ethernet services, packet services, or wireless backhaul services. Service data can also be called service signals, customer data, customer-side signals, client signals, or customer service data. The application scenarios corresponding to service data can be data center networks (including intra-data center interconnections and inter-data center interconnections), enterprise networks, carrier networks, etc. Furthermore, the service type corresponding to service data can also be Ethernet services, constant bit rate (CBR) services, etc. Simultaneously, the services corresponding to the service can include various types of services, such as internet access, video and voice calls, etc. This application does not limit the type and name of service data.

[0109] S702, the transmitting device maps N channels of service data into N channels of fgOTN frames, and maps N channels of fgOTN frames into OTN frames.

[0110] Among them, N service data channels correspond one-to-one with N fgOTN frames. The N service data channels include the first service data channel, and the N fgOTN frames include the first fgOTN frame. The payload area of ​​the first fgOTN frame includes the first service data channel encrypted according to the first encryption information, and the overhead area of ​​the first fgOTN frame includes the first encryption information.

[0111] It should be understood that after mapping N service data to N fgOTN frames, the N fgOTN frames are further mapped to higher-order OTN frames, such as ODUk, OTUk, etc.

[0112] Optionally, the sending and receiving devices can pre-agree on the encryption information to be used. Specifically, the sending device encrypts the business data according to the agreed-upon first encryption information.

[0113] The first encryption information, also known as encryption overhead, is used to encrypt and decrypt business data.

[0114] The following section will use the frame structure of fgOTN frames as an example to explain in detail the frame structure of encrypted fgOTN frames and how fgOTN frames carry encryption overhead.

[0115] Specifically, the first fgOTN frame includes a first multiframe. The overhead area of ​​each fgOTN frame in the first multiframe includes a first field, a second field, and a third field. The first multiframe includes M first fields, M second fields, and M third fields. The first field is used to carry FN data, the second field is used to carry KEY data, and the third field is used to carry security management channel data.

[0116] The first encrypted information includes at least one of the following: 1) Encrypted frame number (FN), also known as inter-frame counter or FN overhead, or inter_mf_cnt, is 24 bits long and is transmitted in single-frame mode.

[0117] 2) Key data (KEY) is used to transmit overhead such as encryption switching, Key Control Channel (KCC) mapping status indication, and GCM authentication. It is transmitted in 32-frame mode. It can also be called KEY overhead.

[0118] 3) Security Management Channel Data, or KCC data, is 64 bits long and is used for key negotiation and exchange, employing an even / odd frame mode. It can also be referred to as KCC overhead.

[0119] In this context, FN adopts a single-frame mode, which can be understood as follows: each first fgOTN frame in the first multiframe carries one FN. That is, each of the M first fields in the first multiframe is used to carry one FN, and the M first fields are used to carry 32 FNs.

[0120] The KEY data uses a 32-frame multiframe mode, which can be understood as carrying a complete set of KEY data in a period of 32 fgOTN frames. In other words, every 32 fgOTN frames in the first multiframe are used to carry a set of KEY data; specifically, the 32 second fields corresponding to every 32 fgOTN frames in the first multiframe are used to carry a set of KEY data.

[0121] The KCC data uses an even / odd frame mode, which can be understood as follows: KCC data is transmitted in 64-bit units, with each first fgOTN frame transmitting 32 bits. MFAS[0] serves as the even / odd frame indicator. MFAS[0]=0 means even frames transmit KCC[63:32], i.e., the high 32 bits; MFAS[0]=1 means odd frames transmit KCC[31:0], i.e., the low 32 bits. A complete set of KCC data is transmitted in two first fgOTN frames. In other words, the first multiframe includes P even / odd frames, and the two third fields included in each of the P even / odd frames are used to carry a set of security management channel data.

[0122] It should be understood that for an fgOTN frame in the first multiframe, there are 64 bits of fields carrying the first encryption information. Among them, the 24 bits carrying an FN are called the first field, the 8 bits carrying the KEY data are called the second field, and the 32 bits carrying the KCC data are called the third field.

[0123] The following describes how to define the encryption overhead of any fgOTN frame in the first fgOTN frame.

[0124] Method 1 like Figure 4 As shown, the 14th and 1918th byte columns of the fgOTN frame are reserved for future standardization (RES) fields, which are all 0 by default. The 14th byte column contains 4 rows of RES fields, and the 1918th byte column contains 4 rows of RES fields, with each row of RES fields consisting of 1 byte.

[0125] In other words, each fgOTN frame includes 8 bytes (64 bits) of available fields that can be used to carry the first encrypted information. These 64 bits can be used to carry the first field (24 bits), the second field (8 bits), and the third field (32 bits).

[0126] like Figure 7 As shown, in Method 1, the first field is the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is the first row of the 1918th byte column of the fgOTN frame, and the third field is the 14th byte column of the fgOTN frame. Alternatively, the second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry FN data, the first row of the 1918th byte column of the fgOTN frame is used to carry KEY data, and the 14th byte column of the fgOTN frame is used to carry security management channel data.

[0127] Method 2 like Figure 4 As shown, the first and second rows of the 8th to 11th byte columns of the fgOTN frame are the RES field.

[0128] In other words, each fgOTN frame includes 8 bytes (64 bits) of available fields that can be used to carry the first encrypted information. These 64 bits can be used to carry the first field (24 bits), the second field (8 bits), and the third field (32 bits).

[0129] like Figure 8As shown, in Method 2, the first field is the first row of the 9th to 11th byte columns of the fgOTN frame, the second field is the first row of the 8th byte column of the fgOTN frame, and the third field is the second row of the 8th to 11th byte columns of the fgOTN frame.

[0130] Alternatively, the first row of the 9th to 11th byte columns of the fgOTN frame is used to carry FN, the first row of the 8th byte column of the fgOTN frame is used to carry KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry security management channel data.

[0131] Method 3 like Figure 4 As shown, the 1908th and 1910th byte columns of the fgOTN frame are PM TTI fields.

[0132] Method 3 carries encryption overhead via the PM TTI field. It should be understood that if PM TTI overhead is used as encryption overhead, the encrypted pipeline does not support TTI functionality.

[0133] In other words, each fgOTN frame includes 8 bytes (64 bits) of available fields that can be used to carry the first encrypted information. These 64 bits can be used to carry the first field (24 bits), the second field (8 bits), and the third field (32 bits).

[0134] like Figure 9 As shown, in Method 3, the first field is the second to fourth rows of the 1910th byte column of the fgOTN frame, the second field is the first row of the 1910th byte column of the fgOTN frame, and the third field is the 1909th byte column of the fgOTN frame.

[0135] Alternatively, the second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry FN, the first row of the 1918th byte column of the fgOTN frame is used to carry KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry security management channel data.

[0136] Method 4 like Figure 4 As shown, the second row of the 8th to 11th byte columns of the fgOTN frame is the RES field. In addition, the 1918th byte column of the fgOTN frame is the RES field.

[0137] In other words, each fgOTN frame includes 8 bytes (64 bits) of available fields that can be used to carry the first encrypted information. These 64 bits can be used to carry the first field (24 bits), the second field (8 bits), and the third field (32 bits).

[0138] like Figure 10 As shown, in Method 4, the first field is the second to fourth rows of the 1918th byte column of the fgOTN frame, the second field is the first row of the 1918th byte column of the fgOTN frame, and the third field is the second row of the 8th to 11th byte columns of the fgOTN frame.

[0139] Alternatively, the second to fourth rows of the 1910th byte column of the fgOTN frame are used to carry FN, the first row of the 1910th byte column of the fgOTN frame is used to carry KEY data, and the 1909th byte column of the fgOTN frame is used to carry security management channel data.

[0140] As an example, and not a limitation, the second row of the 1918th byte column of the fgOTN frame is used to carry FN[23:16], the third row of the 1918th byte column of the fgOTN frame is used to carry FN[15:08], and the fourth row of the 1918th byte column of the fgOTN frame is used to carry FN[07:00]. The encryption overhead of the first fgOTN frame can be defined using any of the four methods described above.

[0141] The following section provides a further introduction to the method for transmitting KEY data using 32 multiframes.

[0142] Since the KEY data is transmitted through 32 multiframes, and each fgOTN frame in the 32 multiframes includes a second field (8 bits), the 32 second fields in the 32 multiframes are used together to carry the KEY data.

[0143] In the 32-frame multiframe, the relationship between each fgOTN frame and the carried KEY data is shown in Table 1.

[0144] Table 1

[0145] The purpose of each part of the KEY data is shown in Table 2: Table 2

[0146] S503, the transmitting device sends an OTN frame to the receiving device; correspondingly, the receiving device receives the OTN frame.

[0147] S504, the receiving device obtains N service data based on the OTN frame.

[0148] The receiving device obtains N service data based on the OTN frame by: decrypting the first fgOTN frame based on the first encryption information to obtain the first service data.

[0149] The above, combined with Figures 1 to 10 This application describes a data frame transmission method provided in its embodiments. In the various embodiments of this application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the various embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0150] The following, combined with Figures 11 to 13 This application provides a detailed description of the apparatus, device, and chip system provided in the embodiments. It should be understood that the descriptions of the apparatus embodiments correspond to the descriptions of the method embodiments. Therefore, for details not described in detail, please refer to the above method embodiments; for brevity, some details are omitted.

[0151] Figure 11 This is a schematic block diagram of an optical communication device 1000 provided for an embodiment of this application. Figure 11 As shown, the device 1000 can be set in Figure 1 In the OTN device 101 shown, or the device 1000 may also be provided in Figure 2 The OTN device shown includes a transceiver module 1001, which can be used to implement corresponding transceiver functions. The transceiver module 1001 can also be referred to as a transceiver unit.

[0152] The device 1000 also includes a processing module 1002 (or processing unit), which can be used to implement corresponding processing functions.

[0153] Optionally, the device 1000 further includes a storage unit, which can be used to store instructions and / or data. The processing module 1002 can read the instructions and / or data in the storage unit so that the device can perform the operation of the relevant devices in the foregoing method embodiments.

[0154] The device 1000 can be used to perform the actions performed by the transmitting or receiving device in the above method embodiments. In this case, the device 1000 can be a component of the transmitting or receiving device. The transceiver module 1001 is used to perform the transmission and reception related operations of the transmitting or receiving device in the above method embodiments, and the processing module 1002 is used to perform the processing related operations of the transmitting or receiving device in the above method embodiments.

[0155] It should be understood that the specific process of each module performing the above-mentioned steps has been described in detail in the above method embodiments, and will not be repeated here for the sake of brevity. Figure 12 This is a schematic diagram of the structure of an optical communication device provided in an embodiment of this application. Figure 12As shown, the device 2000 includes a processor 2001 and an optical transceiver 2002. This device can be used in both transmitting and receiving devices. Figure 12 The apparatus shown may include Figure 1 Any of the OTN devices 101 shown, or Figure 12 The apparatus shown may also include Figure 2 The OTN device shown.

[0156] When applied to a transmitting device, processor 2001 is used to implement... Figure 6 In method 500 shown, S502, the optical transceiver 2002 is used to implement... Figure 6 S503 in method 500 is shown. When applied to a receiving device, processor 2001 is used to implement... Figure 6 In method 500 shown, S504, the optical transceiver 2002 is used to implement... Figure 6 S503 in method 500 is shown. In the implementation process, each step of the processing flow can be completed by the transmitting or receiving device through the integrated logic circuitry of the hardware in the processor 2001 or by instructions in the form of software.

[0157] In this application embodiment, the processor 2001 can be a general-purpose processor, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in this application embodiment. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software units within the processor.

[0158] Furthermore, the device 2000 may include one or more processors 2001.

[0159] Optionally, the device 2000 may further include a memory 2003, wherein the program code executed by the processor 2001 to implement the above methods can be stored in the memory 2003. The device 2000 may include one or more memories 2003.

[0160] Specifically, the memory 2003 can be coupled to the processor 2001. The coupling in this embodiment is an indirect coupling or communication connection between devices, units, or modules, and can be electrical, mechanical, or other forms, used for information exchange between devices, units, or modules. Alternatively, the processor 2001 can operate in conjunction with the memory 2003. The memory 2003 can be non-volatile memory, such as a hard disk drive (HDD), or volatile memory, such as random-access memory (RAM). The memory 2003 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited to these. It should be noted that... Figure 12 The device described above can also be used to perform the method steps involved in the variations of the embodiments shown in the foregoing figures, which will not be repeated here.

[0161] Figure 13 This is a schematic diagram of a chip system provided in an embodiment of this application. For example... Figure 13 As shown, the chip system 3000 (or processing system) includes logic circuitry 3010 and input / output interface 3020.

[0162] The logic circuit 3010 can be a processing circuit in the chip system 3000. The logic circuit 3010 can be coupled to a memory unit, calling instructions from the memory unit, enabling the chip system 3000 to implement the methods and functions of the embodiments of this application. The input / output interface 3020 can be an input / output circuit in the chip system 3000, outputting processed information from the chip system 3000, or inputting data or signaling information to be processed into the chip system 3000 for processing.

[0163] Optionally, the logic circuit 3010 may be implemented by one or more processors, including the one or more processors or the processing portion of the one or more processors.

[0164] Optionally, the input / output interface 3020 may include transceiver circuitry, a transceiver, input / output circuitry, or a communication interface.

[0165] As one approach, the chip system 3000 is used to implement the operations performed by the transmitting or receiving device in the various method embodiments described above.

[0166] Specifically, the logic circuit 3010 is used to implement the processing-related operations performed by the transmitting device or the receiving device in the above method embodiments; the input / output interface 3020 is used to implement the sending and / or receiving-related operations performed by the transmitting device or the receiving device in the above method embodiments.

[0167] Based on the above embodiments, this application also provides an optical module, which includes a signal processor and an optical transmitting component. The signal processor is used to: map N channels of service data to N channels of fgOTN frames and map N channels of fgOTN frames to OTN frames in method 500; the optical transmitting component is used to: transmit OTN frames. Alternatively, the optical module includes a signal processor and an optical receiving component. The optical receiving component is used to receive OTN frames; the signal processor is used to: decrypt the first fgOTN frame in method 500; the optical receiving component is used to: receive OTN frames.

[0168] Based on the above embodiments, this application also provides a computer-readable storage medium. This storage medium stores a software program, which, when read and executed by one or more processors, can implement the methods provided in any one or more of the above embodiments. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory, random access memory, magnetic disk, or optical disk.

[0169] Based on the above embodiments, this application provides a computer program product containing instructions. When this computer program product is run on a computer or processor, it can implement the methods provided in any one or more of the above embodiments.

[0170] Based on the above embodiments, this application also provides a chip. The chip includes a processor for implementing the functions involved in any one or more of the above embodiments, such as acquiring or processing OTN frames involved in the above methods. Optionally, the chip further includes a memory for storing necessary program instructions and data executed by the processor. The chip may be composed of a single chip or may include chips and other discrete devices.

[0171] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

[0172] It should be understood that the processor mentioned in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0173] It should also be understood that the memory mentioned in the embodiments of this application can be volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM can include the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0174] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0175] Those skilled in the art will recognize that the units and steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application; such implementations should not be considered beyond the scope of protection of this application.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of apparatus or units may be electrical, mechanical, or other forms.

[0177] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs). For example, the aforementioned available media can include, but are not limited to, various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0178] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for encrypted transmission over an optical transport network (OTN), characterized in that, include: Obtain N channels of business data; The N service data paths are mapped to N fine-grained optical transport network (fgOTN) frames, and the N fgOTN frames are mapped to OTN frames. Each of the N service data paths corresponds one-to-one with one of the N fgOTN frames. The N service data paths include a first service data path, and the N fgOTN frames include a first fgOTN frame. The payload area of ​​the first fgOTN frame includes the first service data path encrypted according to the first encryption information, and the overhead area of ​​the first fgOTN frame includes the first encryption information. N is an integer greater than 1. Send the OTN frame.

2. The method according to claim 1, characterized in that, The first encrypted information includes at least one of the following: Encrypted frame counter FN; Key data; Security management channel data.

3. The method according to claim 2, characterized in that, The overhead region of the first fgOTN frame includes the first encryption information, including: The first fgOTN frame includes a first multiframe, the first multiframe includes M fgOTN frames, and the overhead area of ​​each fgOTN frame in the first multiframe includes a first field, a second field and a third field. The first multiframe includes M first fields, M second fields and M third fields. The first field is used to carry the FN, the second field is used to carry the KEY data, and the third field is used to carry the security management channel data.

4. The method according to claim 3, characterized in that, The first field is used to carry the FN, including: Each of the M first fields is used to carry one FN, and the M first fields are used to carry M FNs.

5. The method according to claim 3 or 4, characterized in that, The second field is used to carry the KEY data, including: The first multiframe includes L 32 multiframes, and the 32 second fields corresponding to each of the L 32 multiframes are used to carry a set of KEY data.

6. The method according to any one of claims 3 to 5, characterized in that, The third field is used to carry the security management channel data, including: The first multiframe includes P odd and even frames, and the two third fields corresponding to each of the P odd and even frames are used to carry a set of security management channel data.

7. The method according to any one of claims 3 to 6, characterized in that, The first multiframe is a 32-frame multiframe, which includes 32 first fields, 32 second fields, and 32 third fields.

8. The method according to any one of claims 2 to 7, characterized in that, The second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the 14th byte column of the fgOTN frame is used to carry the security management channel data.

9. The method according to any one of claims 2 to 7, characterized in that, The first row of the 9th to 11th byte columns of the fgOTN frame is used to carry the FN, the first row of the 8th byte column of the fgOTN frame is used to carry the KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry the security management channel data.

10. The method according to any one of claims 2 to 7, characterized in that, The second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry the security management channel data.

11. The method according to any one of claims 8 to 10, characterized in that, The first field, the second field, and the third field are reserved as RES fields for future use.

12. The method according to any one of claims 2 to 7, characterized in that, The second to fourth rows of the 1910th byte column of the fgOTN frame are used to carry the FN, the first row of the 1910th byte column of the fgOTN frame is used to carry the KEY data, and the 1909th byte column of the fgOTN frame is used to carry the security management channel data.

13. The method according to claim 12, characterized in that, The first field, the second field, and the third field are path tracking indicators (TTI) fields for path monitoring (PM).

14. A method for encrypted transmission over an optical transport network (OTN), characterized in that, include: Receive OTN frames, wherein the OTN frames are obtained by mapping N fine-grained optical transport network (fgOTN) frames, and the N fgOTN frames are obtained by mapping N service data. The N service data correspond one-to-one with the N fgOTN frames, the N service data include a first service data, the N fgOTN frames include a first fgOTN frame, the payload area of ​​the first fgOTN frame includes the first service data encrypted according to the first encryption information, the overhead area of ​​the first fgOTN frame includes the first encryption information, and N is an integer greater than 1. The first fgOTN frame is decrypted based on the first encryption information to obtain the first channel service data.

15. The method according to claim 14, characterized in that, The first encrypted information includes at least one of the following: Encrypted frame counter FN; Key data; Security management channel data.

16. The method according to claim 15, characterized in that, The overhead region of the first fgOTN frame includes the first encryption information, including: The first fgOTN frame includes a first multiframe, and the overhead area of ​​each fgOTN frame in the first multiframe includes a first field, a second field and a third field. The first multiframe includes M first fields, M second fields and M third fields. The first field is used to carry the FN, the second field is used to carry the KEY data, and the third field is used to carry the security management channel data.

17. The method according to claim 16, characterized in that, The first field is used to carry the FN, including: Each of the M first fields is used to carry one FN, and the M first fields are used to carry M FNs.

18. The method according to claim 16 or 17, characterized in that, The second field is used to carry the KEY data, including: The first multiframe includes L 32 multiframes, and the 32 second fields corresponding to each of the L 32 multiframes are used to carry a set of KEY data.

19. The method according to any one of claims 16 to 18, characterized in that, The third field is used to carry the security management channel data, including: The first multiframe includes P odd and even frames, and the two third fields corresponding to each of the P odd and even frames are used to carry a set of security management channel data.

20. The method according to any one of claims 16 to 19, characterized in that, The first multiframe is a 32-frame multiframe, which includes 32 first fields, 32 second fields, and 32 third fields.

21. The method according to any one of claims 15 to 20, characterized in that, The second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the 14th byte column of the fgOTN frame is used to carry the security management channel data.

22. The method according to any one of claims 15 to 20, characterized in that, The first row of the 9th to 11th byte columns of the fgOTN frame is used to carry the FN, the first row of the 8th byte column of the fgOTN frame is used to carry the KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry the security management channel data.

23. The method according to any one of claims 15 to 20, characterized in that, The second to fourth rows of the 1918th byte column of the fgOTN frame are used to carry the FN, the first row of the 1918th byte column of the fgOTN frame is used to carry the KEY data, and the second row of the 8th to 11th byte columns of the fgOTN frame is used to carry the security management channel data.

24. The method according to any one of claims 20 to 23, characterized in that, The first field, the second field, and the third field are reserved as RES fields for future use.

25. The method according to any one of claims 15 to 20, characterized in that, The second to fourth rows of the 1910th byte column of the fgOTN frame are used to carry the FN, the first row of the 1910th byte column of the fgOTN frame is used to carry the KEY data, and the 1909th byte column of the fgOTN frame is used to carry the security management channel data.

26. The method according to claim 25, characterized in that, The first field, the second field, and the third field are path tracking indicators (TTI) fields for path monitoring (PM).

27. An optical communication device, characterized in that, include: A processor and an input / output interface are configured to perform the method as described in any one of claims 1 to 13, or the method as described in any one of claims 14 to 26, wherein the input / output interface is configured to receive and transmit OTN frames; and the processor is configured to process the OTN frames.

28. An optical module, characterized in that, The optical module includes a signal processor and an optical transmitting component, wherein the signal processor is used to perform the method as described in any one of claims 1 to 13; and the optical transmitting component is used to convert an optical transport network (OTN) frame into an optical signal and transmit the optical signal.

29. An optical module, characterized in that, The optical module includes a signal processor and an optical receiving component, wherein the optical receiving component is used to receive optical signals and convert the optical signals into Optical Transport Network (OTN) frames; the signal processor is used to execute the method as described in any one of claims 14 to 26.

30. An optical chip, characterized in that, The chip includes a processor and a communication interface for performing the method as described in any one of claims 1 to 13, or for performing the method as described in any one of claims 14 to 26, wherein the communication interface is used to receive and transmit light transmission network (OTN) frames; and the processor is used to process the OTN frames.

Images