Optical module with encryption and decryption communication function

Abstract

The utility model provides an optical module with encryption and decryption communication functions, which comprises a shell and an optical module circuit arranged in the shell, and the optical module circuit comprises an electrical interface module, a logic processing module, an authentication and secret key negotiation module, a laser driving module and an optical transceiver module. Client plaintext data needing to be transmitted in a service sending direction is sent to the logic processing module through the electrical interface module of the optical transceiver module, and is encrypted, framed and the like through an encryption function provided by the authentication and secret key negotiation module to form a ciphertext; and the laser driving module drives a light emitting assembly of the light receiving and transmitting module to become an encrypted light signal and send out. And the opposite processing process is executed in the service receiving direction. The authentication and secret key negotiation module completes identity legality authentication of the optical module, continuously negotiates a working secret key with an opposite terminal and provides the working secret key to the encryption and decryption processing module. And the potential safety hazard that the service data transmitted in the optical network is intercepted, copied and tampered is avoided.

Description

Technical Field

[0001] The utility model relates to the technical field of information transmission, and in particular to an optical module with encryption and decryption communication functions. Background Art

[0002] In recent years, network technology has developed rapidly and been widely used. Network security issues have attracted widespread attention from all over the world. However, the information transmission network, which is the basis of the network, especially the physical layer optical transmission network, has hardly taken any security protection measures and is in a naked state. For example, in the optical transmission network, the standard optical module does not take any protection measures for network security, and the data transmitted in the network is subject to major hidden dangers of being "intercepted, copied, and tampered with". Utility Model Content

[0003] In view of this, the purpose of the utility model is to propose an optical module with encryption and decryption communication functions to solve the problem that the standard network module in the existing network transmission has a major hidden danger of "being intercepted, copied, and tampered" for the data transmitted in the network.

[0004] Based on the above purpose, the utility model provides an optical module with encryption and decryption communication functions, including a housing and an optical module circuit arranged in the housing; the optical module circuit includes:

[0005] Electrical interface module, logic processing module, laser driver module, authentication and key negotiation module and optical transceiver module;

[0006] The first end of the electrical interface module is connected to the terminal device, the second end of the electrical interface module is connected to the first end of the logic processing module, the second end of the logic processing module is connected to the first end of the laser driving module and the authentication and key negotiation module, and the second end of the laser driving module is connected to the optical transceiver modules respectively, so that the transmitted data is transmitted through the optical module for encryption and decryption.

[0007] Optionally, the optical module circuit further includes a power module, and the power module is respectively connected to the electrical interface module, the logic processing module, the laser driving module and the authentication and key negotiation module.

[0008] Optionally, the optical transceiver module includes an optical receiving module and an optical sending module, and the optical receiving module and the optical sending module are respectively connected to the laser driving module.

[0009] Optionally, the electrical interface module includes an SFP standard electrical interface, the authentication and key negotiation module includes an encryption chip, the logic processing module includes an ASIC chip, the laser driving module includes a laser driving chip, and the power module includes a power chip, and the power chip is respectively connected to the SFP standard electrical interface, the ASIC chip, the encryption chip and the laser driving chip; the SFP standard electrical interface is connected to the ASIC chip, and the ASIC chip is connected to the encryption chip and the laser driving chip.

[0010] Optionally, the RD+, RD-, TD+, TD-, TxFault, LOS, and TxDisable pins of the SFP standard electrical interface are respectively connected to the D2, D1, B4, A4, V19, W19, and U19 pins of the ASIC chip; the SCL and SDA pins of the SFP standard electrical interface are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

[0011] Optionally, the B6, A6, B2, A2, J1, H1, and P1 pins of the ASIC chip are respectively connected to the PX_P, PX_N, TX_P, TX_N, DISABLE, LOS, and TX_FAULT pins of the laser driver chip, and the W16 and W17 pins of the ASIC chip are respectively connected to the GPIO23 and GPIO22 pins of the encryption chip.

[0012] Optionally, the CLK and SDA pins of the laser driving chip are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

[0013] Optionally, the V3.3out pin of the power chip is respectively connected to the VCC3V3 pin of the SFP standard electrical interface, the V3.3 pin of the ASIC chip, the VCC3.3 pin of the encryption chip and the V3V3 pin of the laser driver chip, and the V1.8, V1.2, and V1.0 pins of the power chip are respectively connected to the V1.8, V1.2, and V1.0 pins of the ASIC chip.

[0014] From the above description, it can be seen that the utility model provides an optical module with encryption and decryption communication functions, including a shell and an optical module circuit arranged in the shell, the optical module circuit includes: an electrical interface module, a logic processing module, a laser driving module, an authentication and key negotiation module and an optical transceiver module, the first end of the electrical interface module is connected to the terminal device, the second end of the electrical interface module is connected to the first end of the logic processing module, the second end of the logic processing module is connected to the first end of the laser driving module and the authentication and key negotiation module, and the second end of the laser driving module is connected to the optical transceiver module, so that the transmitted data is transmitted via the optical module through encryption and decryption. After the terminal device sends the data to be transmitted, it passes through the electrical interface module of the optoelectronic module along the service sending direction to receive the data, and then passes through the logic processing module in turn, and completes encryption and framing and other processing through the encryption function provided by the authentication and key negotiation module to become ciphertext, and then sends it to the laser driving module to drive the optical transmitting component of the optical transceiver module to become an encrypted optical signal for transmission, and transmits the encrypted optical signal to the target terminal through the optical transceiver module. It can also receive data through the optical transceiver module along the service receiving direction, and then pass through the laser driving module and the logic processing module in turn, and complete the identity legitimacy authentication of the optical module through the authentication and key negotiation module, and continuously negotiate with the other end to provide the working key to the logic processing module, decrypt the received encrypted data into original data, and transmit the decrypted data to the terminal device, thereby realizing the secure transmission of network data and avoiding the major hidden dangers of data transmitted in the network being "intercepted, copied, and tampered with". BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is a schematic diagram of an exemplary Gigabit SFP optical module functional framework of an embodiment of the utility model;

[0017] Figure 2 This is a schematic diagram of the circuit structure of an optical module according to an embodiment of the utility model;

[0018] Figure 3 This is a schematic diagram of the principle framework of an optical module with encryption and decryption communication functions according to an embodiment of the utility model;

[0019] Figure 4 This is a schematic diagram of the working process of an optical module with encryption and decryption communication functions according to an embodiment of the utility model;

[0020] Figure 5This is a schematic diagram of the structure of an optical module with encryption and decryption communication functions according to an embodiment of the utility model;

[0021] Figure 6 This is the OTU0LL line side ciphertext frame structure of the embodiment of the utility model;

[0022] Figure 7 The figure is a schematic diagram of the encryption / decryption principle framework of an embodiment of the utility model. Description of the drawings:

[0024] 01. Shell; 02. Optical module circuit; 1. Electrical interface module; 2. Logic processing module; 3. Laser drive module; 4. Authentication and key negotiation module; 5. Optical transceiver module; 6. Power module; 51. Optical receiving module; 52. Optical transmitting module. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0026] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the embodiments of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0027] Based on the description of the background technology, at present, there are the following solutions for secure transmission of network information: (1) Application layer encryption, which is mainly based on software implementation. The prominent problem is that the speed is relatively slow and the real-time performance is not good; (2) Network layer or data link layer encryption, which is implemented by developing special equipment, such as link encryption machine. The prominent problem is that the volume is large, encryption and communication are two systems, and the deployment cost is high. (3) Physical layer (optical layer) encryption is implemented on the optical transmission equipment board. Compared with the existing equipment, it has a large change and involves a large number of optical transmission equipment in the access network, metropolitan area network and backbone optical network. The impact is large and affects commercial deployment. In the optical transmission network, standard optical modules are widely used. In the optical transmission network, standard optical modules do not take any protection measures for network security, and the data transmitted in the network has a major hidden danger of being "intercepted, copied, and tampered".

[0028] In order to solve the above technical problems, Figure 1 As shown, the utility model provides an optical module with encryption and decryption communication functions, including a housing 01 and an optical module circuit 02 arranged in the housing 01; the optical module circuit 02 includes:

[0029] Electrical interface module 1, logic processing module 2, laser driving module 3, authentication and key negotiation module 4 and optical transceiver module 5;

[0030] The first end of the electrical interface module 1 is connected to the terminal device, the second end of the electrical interface module 1 is connected to the first end of the logic processing module 2, the second end of the logic processing module 2 is connected to the first end of the laser driving module 3 and the authentication and key negotiation module 4, and the second end of the laser driving module 3 is connected to the optical transceiver module 5, so that the transmitted data is transmitted via encryption and decryption via the optical module.

[0031] Specifically, after the terminal device sends out the data to be transmitted, the data is received by the electrical interface module 1 of the optoelectronic module along the service sending direction, and then passes through the logic processing module 2 in sequence, and is encrypted and framed by the encryption function provided by the authentication and key negotiation module 4 to become a ciphertext, and then is sent to the laser driving module 3 to drive the optical transmitting component of the optical transceiver module 5 to become an encrypted optical signal for transmission, and the encrypted optical signal is transmitted to the target terminal through the optical transceiver module 5. It can also receive data through the optical transceiver module 5 along the service receiving direction, and then pass through the laser driving module 3 and the logic processing module 2 in sequence, and complete the identity legitimacy authentication of the optical module through the authentication and key negotiation module 4, and continuously negotiate with the other end to provide the working key to the logic processing module 2, decrypt the received encrypted data to become the original data, and transmit the decrypted data to the terminal device, thereby realizing the secure transmission of network data and avoiding the major hidden dangers of data transmitted in the network being "intercepted, copied, and tampered with". Furthermore, the logic processing module 2 can be understood as a control module, which is used to process data, and the authentication and key negotiation module 4 can be understood as an authentication module and a key module, which completes the identity legitimacy authentication of the device and is also used to generate a working key and transmit it to the logic processing module. The logic processing module then generates a session key for data encryption and decryption.

[0032] In some embodiments, Figure 2 As shown, the optical module circuit 02 further includes a power module 6, and the power module 6 is respectively connected to the electrical interface module 1 and the third end of the logic processing module 2 and the power module 6.

[0033] Specifically, the power module 6 is respectively connected to the electrical interface module 1, the logic processing module 2, the laser driving module 3 and the authentication and key negotiation module 4. The power module 6 supplies power to the electrical interface module 1, the logic processing module 2, the laser driving module 3 and the authentication and key negotiation module 4, respectively, so that each module can operate stably. Among them, the third end of the logic processing module 2 is connected to the power module 6.

[0034] In some embodiments, the optical transceiver module 5 includes an optical receiving module 51 and an optical sending module 52 , and the optical receiving module 51 and the optical sending module 52 are connected to the laser driving module 3 respectively.

[0035] Specifically, the optical transceiver module 5 includes an optical receiving module 51 and an optical sending module 52. The optical receiving module 51 is used to receive the data transmitted by the target terminal, transmit the data to the authentication and key negotiation module 4 for decryption, and then transmit it to the logic processing module 2 via the laser driving module 3. The logic processing module 2 transmits the decrypted data to the terminal device through the electrical interface module 1, so that the terminal device can receive the decrypted data. The optical sending module 52 is used to transmit the encrypted data transmitted by the terminal device to the logic processing module 2, the laser driving module 3, and the authentication and key negotiation module 4 via the electrical interface module 1 to the target terminal device. Therefore, the optical receiving module 51 is used to receive data, and the optical sending module 52 is used to send encrypted data.

[0036] Specifically, Figure 1 As shown, the two output ends of the optical receiving module 51 are connected to the RX_P and RX_N pins of the laser driving chip (ie, the Drive chip) of the laser driving module 3 . The two input ends of the optical receiving module 51 are connected to the optical receiving module 51 .

[0037] Specifically, the two input ends of the optical transmission module 52 are connected to the TX_P and TX_N pins of the laser driver chip (also known as the Drive chip) of the laser driver module 3. In some embodiments, the electrical interface module includes an SFP standard electrical interface (which may be an SFP gold finger), the authentication and key negotiation module 4 includes an encryption chip Key, the logic processing module 4 includes an ASIC chip, the laser driver module 3 includes a laser driver chip (also known as the Drive chip), the power module includes a power chip (also known as the Power chip), and the power chip (also known as the Power chip) is respectively connected to the SFP standard electrical interface, the ASIC chip, the encryption chip and the laser driver chip.

[0038] Specifically, the V3.3out pin of the power chip (also known as the Power chip) is respectively connected to the VCC3V3 pin of the SFP standard electrical interface, the V3.3 pin of the ASIC chip, the VCC3.3 pin of the encryption chip and the V3V3 pin of the laser drive chip (also known as the Drive chip), and the V1.8, V1.2, and V1.0 pins of the power chip (also known as the Power chip) are respectively connected to the V1.8, V1.2, and V1.0 pins of the ASIC chip.

[0039] In some embodiments, Figure 2 As shown, the SFP standard electrical interface is connected to the ASIC chip, and the ASIC chip is connected to the encryption chip and the Dirve chip.

[0040] Specifically, the RD+, RD-, TD+, TD-, TxFault, LOS, and TxDisable pins of the SFP standard electrical interface are respectively connected to the D2, D1, B4, A4, V19, W19, and U19 pins of the ASIC chip; the SCL and SDA pins of the SFP standard electrical interface are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

[0041] The B6, A6, B2, A2, J1, H1, and P1 pins of the ASIC chip are respectively connected to the PX_P, PX_N, TX_P, TX_N, DISABLE, LOS, and TX_FAULT pins of the laser driver chip (i.e., Drive chip), and the W16 and W17 pins of the ASIC chip are respectively connected to the GPIO23 and GPIO22 pins of the encryption chip.

[0042] The CLK and SDA pins of the laser driving chip (ie, the Drive chip) are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

[0043] like Figure 3 and Figure 4 As shown, the ASIC chip and the encryption chip (encryption chip, wherein the encryption chip can adopt the existing encryption and decryption module) can realize the encryption and decryption communication function. The specific encryption and decryption communication functions can be realized: entity identification function, the entity identification function is based on national standards, industry standards or other schemes, through information interaction with the other party, the identity of the other party is authenticated to ensure that the other party is a legitimate information recipient. Negotiation and update of working keys, the negotiation and update of working keys are based on national standards, industry standards or other schemes, through information interaction with the other party, the negotiation of working keys is completed, and can be updated regularly or irregularly. The encryption of sent data and the decryption of received data are based on national standards, industry standards or other schemes, the business data is encrypted and sent, and the received ciphertext data is decrypted to restore the plaintext data. Security-related management and control functions, based on the existing module digital diagnostic functions of standard optical modules, add security-related functions. For example, SFP optical modules provide digital diagnostic functions through the I2C electrical interface, and optical modules with built-in encryption and communication functions also use the I2C electrical interface to expand a new register space or use the original xA0H or xA2H reserved address space to store security-related information, such as the optical module security status, security alarms, and other information for security management and control of the security center. The transmission of related interactive information can use the overhead bytes in the optical transmission channel, or use an independent signaling network.

[0044] The optical module of the utility model needs to go through a release process before engineering application: the authorized security center (CA) writes specific information to the optical module, such as the optical module's unique identification number (ID), public key / private key, CA center's public key, and key algorithm parameters, etc. The existing technology is specifically adopted, and the utility model will not be described in detail.

[0045] For example, Figure 5 and Figure 6 As shown, the optical module circuit is arranged on the circuit board in the housing 01 to realize the protection of the optical module circuit. The utility model adopts the Gigabit SFP optical module as an example. The Gigabit Ethernet optical module adopts the SFP packaging method, and the serial data (1.25Gbps) is accessed through the SFP electrical interface (gold finger). The International Telecommunication Union standard (ITU-T G.709) is used for service mapping, framing, error correction encoding and decoding, as well as encryption and decryption and overhead insertion to generate a line-side optical signal, and its ciphertext frame structure is OTU0LL, as shown in FIG. Figure 5 As shown. As an extension of the reserved bytes in the overhead defined by the standard ODU0, ESI (equipment status indication) and IEF (information exchange area) are added. ESI is one byte, located in the first column of the second row, and is used to indicate the working status of the optical module in real time, such as initialization, entity authentication, normal encryption / decryption, session key switching, alarm, etc., to facilitate the receiver to make corresponding processing; IEF is a total of 8 bytes, divided into IEF1 located in the 3rd row, 13-14 columns, 2 bytes; IEF2 is located in the 4th row, 9-14 columns, 6 bytes, used for information exchange with the other end, such as transmitting digital certificates, key negotiation information, etc.

[0046] The encryption / decryption technology in the utility model adopts the stream encryption / decryption technology suitable for high-speed data. The stream encryption / decryption implementation logic is very simple (data and session key XOR operation), which has outstanding advantages such as easy implementation and small delay for high-speed systems.

[0047] Furthermore, if Figure 7As shown, the extension of the seed key (working key) to the session key adopts the Zu Chongzhi algorithm independently developed in my country. The Zu Chongzhi sequence key algorithm is divided into an initialization phase and a working phase. The seed key generated by the authentication and key negotiation module is injected into the Zu Chongzhi algorithm module, and the ARM processor completes the calculation of the initialization phase. After that, the FPGA logic circuit implements the working phase, and generates a 32-bit session key for each beat. According to the equipment status indication (ESI) in the OTN frame, both parties switch the new session key at the same time in the specified frame. Encryption / decryption area: OPU0+IEF area. The device encryption / decryption function is bypassed before the device initialization key negotiation is completed. The encryption and decoding processes are actually the same. Encryption process: the plaintext data bit is XORed with the session key bit, and the ciphertext data bit is output; decryption process: the ciphertext data bit is XORed with the session key bit, and the plaintext data bit is restored. All adopt the existing technology, which will not be introduced in detail in the utility model.

[0048] It should be noted that some embodiments of the utility model are described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0049] Although the present invention has been described in conjunction with specific embodiments of the present invention, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures may use the discussed embodiments.

[0050] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the scope of protection of the present invention.

Claims

1. An optical module with encryption and decryption communication functions, comprising an optical module circuit; characterized in that: The optical module circuit comprises: An electrical interface module (1), a logic processing module (2), a laser driving module (3), an authentication and key negotiation module (4) and an optical transceiver module (5); The first end of the electrical interface module (1) is connected to the terminal device, the second end of the electrical interface module (1) is connected to the first end of the logic processing module (2), the second end of the logic processing module (2) is connected to the first end of the laser driving module (3) and the authentication and key negotiation module (4), and the second end of the laser driving module (3) is connected to the optical transceiver module (5), so that the transmitted data is transmitted through encryption and decryption via the optical module.

2. The optical module with encryption and decryption communication function according to claim 1, characterized in that: The optical module circuit also includes a power module (6), and the power module (6) is respectively connected to the electrical interface module (1), the logic processing module (2), the laser driving module (3) and the authentication and key negotiation module (4).

3. The optical module with encryption and decryption communication function according to claim 2, characterized in that: The optical transceiver module (5) comprises an optical receiving module (51) and an optical sending module (52); the optical receiving module (51) and the optical sending module (52) are respectively connected to the laser driving module (3).

4. The optical module with encryption and decryption communication function according to claim 2, characterized in that: The electrical interface module (1) includes an SFP standard electrical interface, the authentication and key negotiation module (4) includes an encryption chip, the logic processing module (2) includes an ASIC chip, the laser driving module (3) includes a laser driving chip, and the power module (6) includes a power chip, the power chip being respectively connected to the SFP standard electrical interface, the ASIC chip, the encryption chip and the laser driving chip; the SFP standard electrical interface is connected to the ASIC chip, and the ASIC chip is connected to the encryption chip.

5. The optical module with encryption and decryption communication function according to claim 4, characterized in that: The RD+, RD-, TD+, TD-, TxFault, LOS, and TxDisable pins of the SFP standard electrical interface are respectively connected to the D2, D1, B4, A4, V19, W19, and U19 pins of the ASIC chip; the SCL and SDA pins of the SFP standard electrical interface are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

6. The optical module with encryption and decryption communication function according to claim 4, characterized in that: The B6, A6, B2, A2, J1, H1, and P1 pins of the ASIC chip are respectively connected to the PX_P, PX_N, TX_P, TX_N, DISABLE, LOS, and TX_FAULT pins of the laser driver chip, and the W16 and W17 pins of the ASIC chip are respectively connected to the GPIO23 and GPIO22 pins of the encryption chip.

7. The optical module with encryption and decryption communication function according to claim 4, characterized in that: The CLK and SDA pins of the laser driving chip are respectively connected to the GPIO20 and GPIO21 pins of the encryption chip.

8. The optical module with encryption and decryption communication function according to claim 4, characterized in that: The V3.3out pin of the power chip is respectively connected to the VCC3V3 pin of the SFP standard electrical interface, the V3.3 pin of the ASIC chip, the VCC3.3 pin of the encryption chip and the V3V3 pin of the laser driver chip, and the V1.8, V1.2 and V1.0 pins of the power chip are respectively connected to the V1.8, V1.2 and V1.0 pins of the ASIC chip.

Images