Security protection method and apparatus, and communication system and storage medium

Abstract

The embodiments of the present application belong to the technical field of communications. Disclosed are a security protection method and apparatus, and a communication system and a storage medium. In the embodiments of the present application, a first communication apparatus acquires a code block stream, then determines a plurality of block frames on the basis of the code block stream, and carries security information in a PAD field of each block frame, and carries, in a payload field of each block frame, a code block that has been processed on the basis of the security information, so as to implement security protection for code blocks in the code block stream. PHYSec technology is provided in the embodiments of the present application to solve problems existing in MACSec technology, etc. In addition, the PHYSec technology provided in the embodiments of the present application can also be applied to high-speed coherent optical modules.

Description

Safety protection methods, devices, communication systems and storage media

[0001] This application claims priority to Chinese Patent Application No. 202510495535.9, filed on April 18, 2025, entitled "Security Protection Method, Apparatus, Communication System and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of communication technology, and in particular to a security protection method, device, communication system and storage medium. Background Technology

[0003] In Ethernet networks, data needs to be encrypted before being sent to another device to ensure the security of data transmitted between the two devices. Furthermore, with the development of fiber optic technology in recent years, communication devices are now transmitting data via fiber optic cables. In this scenario, ensuring the security of data transmitted over fiber optic cables is a key concern. Summary of the Invention

[0004] This application provides a security protection method, device, communication system, and storage medium, which can implement a physical layer security (PHYSec) technology, and this PHYSec technology can be applied in high-speed coherent optical modules. The technical solution is as follows:

[0005] Firstly, a security protection method is provided, which is applied to a first communication device in an Ethernet network. In this method, the first communication device acquires a code block stream, which includes multiple code blocks; the first communication device determines multiple block frames based on the code block stream, each block frame including a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes code blocks processed based on the security information. The size of each block frame is M×N bits, where M and N are both positive integers greater than 1.

[0006] In the security protection method provided in this application embodiment, the first communication device acquires a code block stream, then determines multiple block frames based on the code block stream, and carries security information in the PAD field of the block frame, and carries code blocks processed based on the security information in the payload field of the block frame, wherein the security information is used to encrypt data and / or perform integrity verification on the data, so as to achieve security protection of code blocks in the code block stream.

[0007] On the one hand, since the code block stream is obtained by the first communication device processing the MAC frame stream at the physical layer, this application provides a physical layer security (PHYSec) technology to solve the problems existing in MACSec technology. PHYSec technology can be understood as encrypting the data sent from the sender to the receiver at the physical layer. It utilizes the native physical layer mechanism to carry protocol parameters, thus avoiding the need to carry at least 28 bytes of parameters in each MAC frame. Furthermore, it can also protect information other than user data.

[0008] On the other hand, in the scenario where the optical module in the first communication device is a high-speed coherent optical module, after acquiring the code block stream, the high-speed coherent optical module can map the code block stream into multiple block frames through a generic mapping procedure (GMP). Therefore, the PHYSec technology provided in this application embodiment can be applied to high-speed coherent optical modules.

[0009] On the other hand, in OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology, the block frame obtained by the optical module through GMP mapping includes an alignment marker (AM) field, a padding (PAD) field, and an overhead (OH) field. The PAD field does not carry any information; therefore, in these technologies, the PAD field value is usually set to all zeros by default. Based on this, in this embodiment, to improve the applicability of the PHYsec scheme provided, security information is carried in the PAD field of the block frame. Thus, the PHYsec technology provided in this embodiment can be applied to any of the OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology.

[0010] Based on the method provided in the first aspect, in one possible implementation, the PAD field also includes an error correction code for security information; or, the PAD field includes at least one redundant copy of security information.

[0011] In the PHYSec technology provided in this application embodiment, in some scenarios, such as poor channel quality, the probability of uncorrectable codewords appearing during forward error correction (FEC) encoding of security information on the line side is relatively high. In such scenarios, if the security information is erroneous, it will lead to errors in the security information, which in turn will prevent the decoding side from correctly reconstructing all code blocks in the block frame, resulting in a significant increase in the frame loss rate. Based on this, in this application embodiment, when it is necessary to increase the protection of security information, the PAD field may not only include the security information, but may also further include error correction codes for the security information or at least a redundant copy of security information (i.e., redundant backup of the security information) to achieve the protection of the security information.

[0012] In cases where the PAD field includes a security information error correction code, the subsequent second communication device, upon receiving a block frame, can correct the security information based on this error correction code to obtain the correct security information, thus avoiding the inability to reconstruct the code block stream due to security information errors. This ensures data transmission security while improving data transmission reliability.

[0013] When the PAD field includes at least one redundant security information, the subsequent second communication device, upon receiving a block frame, can compare the multiple security information entries in the PAD field to select the correct security information. This avoids the inability to reconstruct the code block stream due to incorrect security information, thereby improving the reliability of data transmission while ensuring data transmission security.

[0014] The number of redundant security information copies can be, for example, 2 or 3.

[0015] Based on the method provided in the first aspect, in one possible implementation, the security information includes at least one of the following: a key index KI, a frame number, or an authentication tag AT; wherein KI is used to indicate the key for processing the block frame, the frame number is used to generate the initialization vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

[0016] In encrypting and decrypting data within a block frame, KI and IV are required. However, verifying the integrity of data within a block frame requires not only ICV but also KI and IV. It should be noted that in various security algorithms, KI and IV are used to encrypt data, and KI, IV, and ICV are used to verify data integrity.

[0017] Based on the method provided in the first aspect, in one possible implementation, the block frame also includes an overhead (OH) field; the encryption scope of the block frame includes the payload field, or the encryption scope includes both the payload field and the OH field.

[0018] The information carried in the OH field can represent at least one of the following: network behavior (such as multi-frame alignment signal (MFAS) and status (STAT)), management protocols (such as FlexO management communication channel (FCC1) and OTN synchronization message channel (OSMC)) and user characteristics (such as payload type). In this embodiment, not only the payload field can be encrypted, but the OH field can also be encrypted at the same time to prevent attackers from obtaining data such as network behavior, management protocols, and user characteristics.

[0019] Based on the method provided in the first aspect, in one possible implementation, the security information includes first information; the first information is used to instruct the other block frame to implement a security protection mode, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to instruct a mode that does not implement security protection for the other block frame.

[0020] Specifically, when implementing confidentiality protection for a block frame, the first communication device encrypts the data in the block frame using KI and IV, and subsequently, the second communication device decrypts the data in the block frame using KI and IV. When implementing integrity protection for a block frame, the first communication device generates an ICV for the data in the block frame, and subsequently, the second communication device verifies the integrity of the data in the block frame using KI, IV, and the ICV.

[0021] In this application embodiment, first information can be used to indicate whether to perform security protection on the block frame, and the first information can also indicate the security protection mode implemented when performing security protection. Through the first information, this application embodiment provides a PHYsec technology that can flexibly indicate the security mode. Unlike FlexOsec technology, which requires simultaneous confidentiality and integrity protection of data, this technology can flexibly select whether to perform confidentiality protection or integrity protection on the data in the block frame according to the application scenario. Therefore, the PHYsec technology provided in this application embodiment has a wide range of applications.

[0022] Based on the method provided in the first aspect, in one possible implementation, the security information includes first information; the first information is a first value, which indicates that neither confidentiality protection nor integrity protection is implemented; or, the first information is a second value, which indicates that confidentiality protection is implemented but integrity protection is not implemented; or, the first information is a third value, which indicates that neither confidentiality protection is implemented but integrity protection is implemented; or, the first information is a fourth value, which indicates that both confidentiality protection and integrity protection are implemented.

[0023] In this embodiment of the application, different modes can be indicated by setting different values ​​of the first information.

[0024] Based on the method provided in the first aspect, in one possible implementation, the first information includes first sub-information and second sub-information. The first sub-information is used to indicate whether confidentiality protection is implemented for the other block frame, and the second sub-information is used to indicate whether integrity protection is implemented for the other block frame. The first sub-information is a first sub-value, which indicates that confidentiality protection is not implemented for the other block frame; or, the first sub-information is a second sub-value, which indicates that confidentiality protection is implemented for the other block frame; the second sub-information is a third sub-value, which indicates that integrity protection is not implemented for the other block frame; or, the second sub-information is a fourth sub-value, which indicates that confidentiality protection is implemented for the other block frame.

[0025] The first and second sub-information typically each consist of 2 bits. In this scenario, when the first sub-information is 00, it indicates that the other party's block frame does not implement confidentiality protection; when the first sub-information is 01, it indicates that the other party's block frame implements confidentiality protection. When the second sub-information is 00, it indicates that the other party's block frame does not implement integrity protection; when the second sub-information is 01, it indicates that the other party's block frame implements integrity protection.

[0026] Based on the method provided in the first aspect, in one possible implementation, the security information further includes second information and third information, wherein the second information is used to instruct the other party's block frame to implement a confidentiality protection algorithm, and the third information is used to instruct the other party's block frame to implement an integrity protection algorithm.

[0027] In this scenario, the receiving end can determine which security algorithm is used to protect confidentiality based on the second information, and determine which security algorithm is used to protect integrity based on the value of the third information.

[0028] Based on the method provided in the first aspect, in one possible implementation, the security information also includes fourth information, which is used to indicate the version number of the physical layer security PHYsec technology, which refers to the technology of determining multiple block frames based on the code block stream.

[0029] In this way, the decoding side can determine the version of the PHYsec technology currently being used based on the fourth information.

[0030] Based on the method provided in the first aspect, in one possible implementation, the security information also includes a key suite type CST, which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled; wherein, CST is a fifth value, which indicates that the FlexOsec technology is not enabled.

[0031] Since the information in the PAD field of the block frame is currently determined using the PHYsec technology provided in this application embodiment, CST is the fifth value in this scenario, used to indicate that the FlexOsec technology is not enabled.

[0032] Optionally, if the first communication device needs to implement security protection for the code block stream based on FlexOsec technology, after acquiring the code block stream, the first communication device can map the code block stream into multiple FlexO frames using FlexOsec technology. For any FlexO frame, the FlexO frame includes an AM field, an EOH field, a BOH field, and a payload field. The EOH field includes AT, KI, and a frame number, and the payload field includes code blocks encrypted with KI and the frame number. Subsequently, when the second communication device receives a FlexO frame, it can decrypt and verify the integrity of the FlexO frame. The EOH field also includes CST, used to indicate that FlexOsec technology is enabled.

[0033] Based on the method provided in the first aspect, in one possible implementation, M is 128 and N is 5140; security information is carried in the 21st to 52nd bytes of the PAD field.

[0034] By using the above settings, the format of the block frame in the PHYSec technology provided in this application embodiment can be made compatible with the format of the FlexO frame in the FlexOsec technology.

[0035] Based on the method provided in the first aspect, in one possible implementation, the multiple block frames include a first block frame and a second block frame, the second block frame being the next block frame after the first block frame, and the security information in the first block frame being used to protect the confidentiality of the second block frame.

[0036] For example, the security information includes the KI (Key Information) and the frame number. When sending the first block frame, the sending end includes the KI and frame number used for confidentiality protection of the next block frame (the second block frame) in the first block frame. Thus, the receiving end receives the KI and frame number needed to decrypt the second block frame before receiving the second block frame itself, reducing the latency required for decryption.

[0037] Based on the method provided in the first aspect, in one possible implementation, the multiple block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the next block frame after the third block frame, and the security information in the fourth block frame is used to protect the integrity of the third block frame.

[0038] For example, the security information includes AT (Attack Value). When the sending end transmits a third-party block frame, it calculates an AT value based on the data in the third-party block frame. However, this AT value is not sent along with the security information in the third-party block frame; instead, it is buffered. When transmitting the next block frame, i.e., the fourth block frame, the AT value is included in the security information of the fourth block frame. Thus, when the receiving end receives a third-party block frame, it can first calculate an AT value based on the data in the third-party block frame. If the receiving end has just finished calculating the AT value for the third-party block frame and has just received the fourth block frame, it can compare the calculated AT value with the AT value in the fourth block frame to determine if the data in the third-party block frame is complete. This allows the receiving end to calculate the AT value for the data in the third-party block frame and receive the corresponding AT value in the third-party block frame in parallel, thereby reducing latency.

[0039] Based on the method provided in the first aspect, in one possible implementation, the first communication device can acquire the code block stream as follows: the first communication device acquires an initial code block stream, the size of which is P × 100 gigages (GE), where P is an integer greater than 0; the first communication device divides the initial code block stream into at least one instance code block stream, the size of which is 100 GE; wherein, the code block stream is an instance code block stream.

[0040] In the manner described above, the PHYSsec technology provided in this application embodiment can be applied to any of the following technologies: OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology.

[0041] Based on the method provided in the first aspect, in one possible implementation, after the first communication device determines multiple block frames according to the code block stream, the first communication device can also interleave the block frames determined by at least one instance code block stream to obtain a line frame stream; the first communication device converts the line frame stream into an optical signal to send the optical signal to the second communication device in the Ethernet.

[0042] The above method can be used to achieve security protection for block frames after GMP mapping and before block frame interleaving.

[0043] Based on the method provided in the first aspect, in one possible implementation, the security information may further include: a key exchange communication channel (KCC) and fifth information; wherein the fifth information is used to indicate whether the KCC is enabled.

[0044] When the fifth message indicates that KCC is enabled, the first communication device and the second communication device use KCC to transmit some control information, such as the key negotiated by both parties. When the fifth message indicates that KCC is disabled, the first communication device and the second communication device do not use KCC to transmit some control information. At this time, KCC is in the default state, that is, KCC does not carry the control information exchanged between the two parties.

[0045] Based on the method provided in the first aspect, in one possible implementation, the security information may further include: sixth information; the sixth information is used to indicate the security channel number.

[0046] The security channel number indicated in the sixth piece of information refers to the security channel number used by the first and second communication devices to currently transmit block frames. A security channel can be understood as a logically defined virtual channel, thus enabling the construction of multiple security channels between the first and second communication devices to transmit block frames corresponding to different services in different security channels.

[0047] Secondly, a security protection method is provided, which is applied to a second communication device in an Ethernet network. The technical effects of the security protection method provided in this application are basically the same as those of the security protection method provided in the first aspect, and therefore will not be repeated hereafter.

[0048] In this method, the second communication device acquires multiple block frames, each block frame including a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes code blocks processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1. The second communication device processes the multiple block frames based on the security information in the multiple block frames.

[0049] Based on the method provided in the second aspect, in one possible implementation, the PAD field also includes an error correction code for security information; in this scenario, the second communication device corrects the security information based on the error correction code; or, the PAD field includes at least one redundant security information, in which case the second communication device selects the security information for processing the block frame based on the at least one redundant security information.

[0050] Based on the method provided in the second aspect, in one possible implementation, the security information includes at least one of the following: a key index KI, a frame number, or an authentication tag AT; wherein KI is used to indicate the key for processing the block frame, the frame number is used to generate the initial vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

[0051] Based on the method provided in the second aspect, in one possible implementation, the block frame also includes an overhead (OH) field; the encryption scope of the block frame includes the payload field, or the encryption scope includes both the payload field and the OH field.

[0052] Based on the method provided in the second aspect, in one possible implementation, the security information includes first information; the first information is used to instruct the other block frame to implement a security protection mode, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to instruct a mode that does not implement security protection for the other block frame.

[0053] Based on the method provided in the second aspect, in one possible implementation, the security information includes first information; the first information is a first value, which indicates that neither confidentiality protection nor integrity protection is implemented; or, the first information is a second value, which indicates that confidentiality protection is implemented but integrity protection is not implemented; or, the first information is a third value, which indicates that neither confidentiality protection is implemented but integrity protection is implemented; or, the first information is a fourth value, which indicates that both confidentiality protection and integrity protection are implemented.

[0054] Based on the method provided in the second aspect, in one possible implementation, the first information includes first sub-information and second sub-information. The first sub-information is used to indicate whether confidentiality protection is implemented for the other block frame, and the second sub-information is used to indicate whether integrity protection is implemented for the other block frame. Alternatively, the first sub-information may be a first sub-value, which indicates that confidentiality protection is not implemented for the other block frame; or, the first sub-information may be a second sub-value, which indicates that confidentiality protection is implemented for the other block frame; or, the second sub-information may be a third sub-value, which indicates that integrity protection is not implemented for the other block frame; or, the second sub-information may be a fourth sub-value, which indicates that confidentiality protection is implemented for the other block frame.

[0055] Based on the method provided in the second aspect, in one possible implementation, the security information further includes second information and third information, wherein the second information is used to instruct the other party's block frame to implement a confidentiality protection algorithm, and the third information is used to instruct the other party's block frame to implement an integrity protection algorithm.

[0056] Based on the method provided in the second aspect, in one possible implementation, the security information also includes fourth information, which is used to indicate the version number of the physical layer security PHYsec technology, which refers to the technology for determining multiple block frames.

[0057] Based on the method provided in the second aspect, in one possible implementation, the security information also includes a key suite type CST, which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled; wherein, CST is a fifth value, which indicates that the FlexOsec technology is not enabled.

[0058] Based on the method provided in the second aspect, in one possible implementation, M is 128 and N is 5140; security information is carried in the 21st to 52nd bytes of the PAD field.

[0059] Based on the method provided in the second aspect, in one possible implementation, the multiple block frames include a first block frame and a second block frame, wherein the second block frame is the next block frame after the first block frame; the implementation of the second communication device processing the multiple block frames based on the security information in the multiple block frames can be as follows: the second communication device decrypts the data in the second block frame based on the security information in the first block frame.

[0060] Based on the method provided in the second aspect, in one possible implementation, the multiple block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the next block frame after the third block frame; the implementation of the second communication device processing the multiple block frames based on the security information in the multiple block frames can be as follows: the second communication device performs integrity verification on the data in the third block frame based on the security information in the fourth block frame.

[0061] Based on the method provided in the second aspect, in one possible implementation, the Ethernet further includes a first communication device; the second communication device can acquire multiple block frames in the following manner: the second communication device receives an optical signal from the first communication device; the second communication device processes the optical signal to obtain a line frame stream; the second communication device performs deinterleaving processing on the line frame stream to obtain at least one block frame stream, the size of the block frame stream is 100GE, and the block frame stream includes multiple block frames.

[0062] Thirdly, a communication device is provided, which has the function of implementing the security protection method described in the first aspect. The communication device includes at least one module for implementing the security protection method provided in the first aspect.

[0063] Fourthly, a communication device is provided, which has the function of implementing the security protection method described in the second aspect above. The communication device includes at least one module for implementing the security protection method provided in the second aspect above.

[0064] Fifthly, a communication device is provided, the communication device including a first communication device, the first communication device including a processor; the processor is configured to execute instructions to cause the first communication device to perform the security protection method as described in any of the first aspects.

[0065] In a sixth aspect, a communication device is provided, the communication device including a second communication device, the second communication device including a processor; the processor is configured to execute instructions to cause the second communication device to perform the security protection method as described in any of the second aspects.

[0066] In a seventh aspect, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a communication device, cause the communication device to perform the security protection method described in the first aspect.

[0067] Eighthly, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a communication device, cause the communication device to perform the security protection method described in the second aspect above.

[0068] Ninthly, a computer program product containing instructions is provided, which, when run on a communication device, causes the communication device to perform the security protection method described in the first aspect.

[0069] In a tenth aspect, a computer program product containing instructions is provided, which, when run on a communication device, causes the communication device to perform the security protection method described in the second aspect above.

[0070] Eleventhly, a communication system is provided, the communication system comprising a first communication device and a second communication device; the first communication device is used to implement the security protection method described in any one of the first aspects; the second communication device is used to implement the security protection method described in any one of the second aspects.

[0071] The technical effects achieved by the technical means corresponding to the third to eleventh aspects mentioned above are similar to the technical effects achieved by the technical means corresponding to the first or second aspects, and will not be repeated here. Attached Figure Description

[0072] Figure 1 is a schematic diagram of the architecture of a communication system provided in an embodiment of this application;

[0073] Figure 2 is a flowchart of a security protection method provided in an embodiment of this application;

[0074] Figure 3 is a schematic diagram of a block frame structure provided in an embodiment of this application;

[0075] Figure 4 is a schematic diagram of an encryption range provided in an embodiment of this application;

[0076] Figure 5 is a schematic diagram of an integrity protection range provided by an embodiment of this application;

[0077] Figure 6 is a schematic diagram of the structure of a type of FlexO frame;

[0078] Figure 7 is a detailed structural diagram of a block frame in a PHYsec technology provided in an embodiment of this application;

[0079] Figure 8 is a schematic diagram illustrating how to carry KI and frame number according to an embodiment of this application;

[0080] Figure 9 is a schematic diagram illustrating how an AT can be carried according to an embodiment of this application;

[0081] Figure 10 is a schematic diagram of how a transmitting end carries security information according to an embodiment of this application;

[0082] Figure 11 is a schematic diagram of how a receiving end uses security information according to an embodiment of this application;

[0083] Figure 12 is a flowchart of another security protection method provided in an embodiment of this application;

[0084] Figure 13 is a schematic diagram of an encryption / decryption process provided in an embodiment of this application;

[0085] Figure 14 is a schematic diagram of another encryption / decryption process provided in an embodiment of this application;

[0086] Figure 15 is a schematic diagram of another encryption / decryption process provided in an embodiment of this application;

[0087] Figure 16 is a schematic diagram of another encryption / decryption process provided in an embodiment of this application;

[0088] Figure 17 is a schematic diagram of an application scenario provided by an embodiment of this application;

[0089] Figure 18 is a schematic diagram of the encryption side processing flow in the scenario shown in Figure 17, provided by an embodiment of this application;

[0090] Figure 19 is a schematic diagram of the decryption side processing flow in the scenario shown in Figure 17, provided by an embodiment of this application;

[0091] Figure 20 is a schematic diagram of another application scenario provided by an embodiment of this application;

[0092] Figure 21 is a schematic diagram of the encryption side processing flow in the scenario shown in Figure 20, provided by an embodiment of this application;

[0093] Figure 22 is a schematic diagram of the decryption side processing flow in the scenario shown in Figure 20, provided by an embodiment of this application;

[0094] Figure 23 is a comparative diagram of different encryption and decryption technologies provided in an embodiment of this application;

[0095] Figure 24 is a comparative diagram of another different encryption and decryption technologies provided in the embodiments of this application;

[0096] Figure 25 is a structural schematic diagram of a safety protection device provided in an embodiment of this application;

[0097] Figure 26 is a structural schematic diagram of another safety protection device provided in an embodiment of this application;

[0098] Figure 27 is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Detailed Implementation

[0099] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0100] Before explaining the embodiments of this application, the application scenarios of the embodiments of this application will be introduced first.

[0101] With the development of artificial intelligence (AI) technology, applications such as AI-generated content (AIGC) are expected to generate trillions of dollars in economic value globally. As the infrastructure for the development of AI technology, intelligent computing centers (also known as data centers) are gradually being built and deployed on a large scale around the world.

[0102] Intelligent computing centers utilize massive amounts of data as resources, leveraging powerful computing capabilities to drive AI models for in-depth data processing, generating various intelligent computing capabilities, which are then provided to organizations and individuals as cloud services. This process involves the processing of large amounts of data within the intelligent computing center and its transmission between different centers. If this data is attacked or leaked, it will result in incalculable economic losses; therefore, ensuring data security is a core issue for the development of intelligent computing centers. In scenarios with long interconnection distances between intelligent computing centers, the risk of data leakage during transmission is even greater. Therefore, encrypting data transmitted between intelligent computing centers has become a necessity.

[0103] Media access control security (MACSec) is a standardized Layer 2 encryption technology. MACSec is widely used in network devices where data confidentiality is critical, such as when two routers are connected via a multi-hop intermediate transmission device. In this scenario, MACSec can ensure the security of data transmitted between the two routers.

[0104] MACSec technology encrypts the user data carried in the payload of each MAC frame (also known as a data frame or packet) at the data link layer, while also carrying the parameters required for decryption in the MAC frame so that the receiver can decrypt the user data based on these parameters.

[0105] However, MACSec technology has the following drawbacks:

[0106] (1) MACSec technology requires encryption of user data in each MAC frame, so each MAC frame needs to carry at least 28 bytes (typically 32 bytes) of parameters. Thus, when the average frame length of a MAC frame is 64 bytes, the parameters will occupy 28 / 64 = 43% of the user bandwidth, which is quite costly.

[0107] (2) MACSec technology only protects user data in MAC frames. Other information in MAC frames, such as the address and length carried by the MAC frame, is exposed in the network. As a result, attackers may be able to analyze user privacy information through these traffic characteristics. Therefore, MACSec technology has blind spots in data security protection.

[0108] Furthermore, IPSec, implemented at the Internet Protocol (IP) layer, and Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS), implemented at the transport layer, both suffer from the same problems as MACSec.

[0109] Based on this, the present application provides a security protection method. In the security protection method provided in the present application, a first communication device acquires a code block stream, then determines multiple block frames based on the code block stream, and carries security information in the PAD field of the block frame, and carries code blocks processed based on the security information in the payload field of the block frame, so as to realize the security protection of code blocks in the code block stream.

[0110] On the one hand, since the code block stream is obtained by the first communication device processing the MAC frame stream at the physical layer, this application provides a physical layer security (PHYSec) technology to solve the problems existing in MACSec technology. PHYSec technology can be understood as: providing security protection, such as encryption, to the data sent from the sender to the receiver at the physical layer. It utilizes native physical layer mechanisms to carry protocol parameters, thus avoiding the need to carry at least 28 bytes of parameters in each MAC frame. Furthermore, it can also protect information other than user data.

[0111] On the other hand, in the scenario where the optical module in the first communication device is a high-speed coherent optical module, after acquiring the code block stream, the high-speed coherent optical module can map the code block stream into multiple block frames through a generic mapping procedure (GMP). Therefore, the PHYSec technology provided in this application embodiment can be applied to high-speed coherent optical modules.

[0112] On the other hand, in OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology, the block frame obtained by the optical module through GMP mapping includes an alignment marker (AM) field, a padding (PAD) field, and an overhead (OH) field. The PAD field does not carry any information; therefore, in these technologies, the PAD field value is usually set to all zeros by default. Based on this, in this embodiment, to improve the applicability of the PHYsec scheme provided, security information is carried in the PAD field of the block frame. Thus, the PHYsec technology provided in this embodiment can be applied to any of the OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology.

[0113] On the other hand, in the PHYSec technology provided in this application embodiment, in some scenarios, such as poor channel quality, the probability of uncorrectable codewords appearing during forward error correction (FEC) encoding of security information on the line side is relatively high. In such scenarios, if the security information is erroneous, it will lead to errors in the security information, which in turn will prevent the decoding side from correctly reconstructing all code blocks in the block frame, resulting in a significant increase in the frame loss rate. Based on this, in this application embodiment, when it is necessary to increase the protection of security information, the PAD field may not only include the security information, but may also further include error correction codes for the security information or at least a redundant copy of security information (i.e., redundant backup of the security information) to achieve the protection of the security information.

[0114] In cases where the PAD field includes a security information error correction code, the subsequent second communication device, upon receiving a block frame, can correct the security information based on this error correction code to obtain the correct security information, thus avoiding the inability to reconstruct the code block stream due to security information errors. This ensures data transmission security while improving data transmission reliability.

[0115] When the PAD field includes at least one redundant security information, the subsequent second communication device, upon receiving a block frame, can compare the multiple security information entries in the PAD field to select the correct security information. This avoids the inability to reconstruct the code block stream due to incorrect security information, thereby improving the reliability of data transmission while ensuring data transmission security.

[0116] The following describes the communication system, security protection method, device, and hardware related to the embodiments of this application.

[0117] Figure 1 is a schematic diagram of the architecture of a communication system provided in an embodiment of this application. As shown in Figure 1, the communication system includes a first communication device 1 and a second communication device 2 deployed in an Ethernet network. The first communication device 1 and the second communication device 2 are connected by an optical fiber link to communicate.

[0118] The first communication device 1 and the second communication device 2 are used to implement the security protection method provided in this application embodiment to ensure the security of data sent from the first communication device 1 to the second communication device 2, or to ensure the security of data sent from the first communication device 2 to the second communication device 1. Subsequent embodiments will be described using the first communication device 1 as the data sender (hereinafter referred to as the sender) and the second communication device 2 as the data receiver (hereinafter referred to as the receiver) as an example.

[0119] In the security protection method provided in this application embodiment, the confidentiality of the data exchanged between the first communication device 1 and the second communication device 2 can be protected, that is, the data exchanged between the two parties can be encrypted. In this scenario, the first communication device 1 can also be called the encryptor, and the second communication device 2 can also be called the decryptor. Optionally, in the security protection method provided in this application embodiment, the integrity of the data exchanged between the first communication device 1 and the second communication device 2 can also be protected, that is, the receiving end needs to verify the integrity of the data. Confidentiality protection and integrity protection are described in detail in subsequent embodiments, and will not be elaborated here.

[0120] For example, as shown in FIG1, the first communication device 1 includes a first component 11 and a first optical module 12, and the second communication device 2 includes a second component 21 and a second optical module 22.

[0121] The first component 11 performs physical layer processing on the MAC frame stream to obtain a physical layer bit stream, and sends the physical layer bit stream to the first optical module 12. The first optical module 12 converts the physical layer bit stream into an optical signal and transmits it. The second optical module 22 receives the optical signal and converts the received optical signal into a physical layer bit stream. The second component 21 processes the physical layer bit stream from the second optical module 22 to reconstruct the MAC frame stream.

[0122] In this embodiment, the first optical module 12 is further configured to perform physical layer security protection, such as encryption, on the information to be sent to the second communication device 2, and the second optical module 22 is further configured to perform physical layer processing, such as decryption, on the received information, to implement the PHYSec technology provided in this embodiment. Detailed implementation methods will be described in subsequent embodiments.

[0123] Furthermore, the first optical module 12 and the second optical module 22 can, for example, be high-speed coherent optical modules to implement the PHYSec technology provided in this application embodiment. Upon receiving the physical layer bitstream, the high-speed coherent optical module restores the physical layer bitstream to multiple virtual lane (VL) signals. After restoring each VL signal to a 257-bit code block stream, further processing is performed on the code block stream, such as mapping, interleaving, and encoding. Then, the digital signal is converted into an optical signal, and coherent technology is further used to modulate the optical signal to achieve long-distance transmission of the optical signal. Coherent technology refers to the optical module modulating the optical signal in two mutually perpendicular directions to transmit the modulated optical signal.

[0124] Understandably, high-speed coherent optical modules can be used in long-distance fiber optic links to ensure long-distance transmission of optical signals. Optionally, high-speed coherent optical modules can also be used in medium- or short-distance fiber optic links to improve the quality of optical signals transmitted in the fiber optic link. For example, IEEE 802.3 already uses high-speed coherent optical modules to transmit 800GE optical signals, with transmission distances including 20 km and 40 km.

[0125] It should be noted that the first optical module 12 and the second optical module 22 can also be other types of optical modules, as long as the optical modules can implement the PHYSec technology provided in the embodiments of this application.

[0126] As shown in Figure 1, when the security protection method provided in this embodiment is applied to the first optical module 12, the first optical module 12 includes a first security protection device. The first security protection device includes at least one module, which is used to implement the function of the transmitting end in the security protection method provided in this embodiment. The functions of each module in the first security protection device are described in detail in subsequent embodiments and will not be elaborated here.

[0127] Referring again to Figure 1, when the security protection method provided in this embodiment is applied to the second optical module 22, the second optical module 22 includes a second security protection device. This second security protection device includes at least one module, which is used to implement the function of the receiving end in the security protection method provided in this embodiment. The functions of each module in the second security protection device are described in detail in subsequent embodiments and will not be elaborated upon here.

[0128] Alternatively, the first component 11 can be a physical layer (PHY) chip. In this scenario, the first communication device 1 also includes a MAC chip, and the first component 11 is used to receive the MAC frame stream processed by the MAC chip. Optionally, the first component can also be a part of the circuitry in a MAC / PHY chip that integrates the MAC chip and the PHY chip. In this scenario, the first component 11 obtains the MAC frame stream obtained by the MAC / PHY chip after processing at the data link layer.

[0129] For example, the first component 11 can be a PHY chip in a network device such as a switch or router. The first optical module 12 is connected to the network device, for example, via a serializer / deserializer (SerDes) bus. In this scenario, the first optical module 12 can be pluggable or non-pluggable.

[0130] In addition, in the scenario where the security protection method provided in the embodiments of this application is applied to the first optical module 12, the first optical module 12 may also include an optical digital signal processor (oDSP) chip to implement the security protection method provided in the embodiments of this application through the oDSP in the first optical module 12.

[0131] The hardware implementation of the second component 21 and the second optical module 22 can be referred to the hardware implementation of the first component 11 and the first optical module 12 described above, and will not be repeated here.

[0132] Furthermore, the first security protection device in the first optical module 12 can be implemented in software. Optionally, the first security protection device can also be implemented in hardware. When the first security protection device is implemented in hardware, it can be a separate chip or a hardware circuit in an oDSP. This application embodiment is not limited in this respect.

[0133] The second security protection device in the second optical module 22 can be implemented in software. Optionally, the second security protection device can also be implemented in hardware. When the second security protection device is implemented in hardware, it can be a separate chip or a hardware circuit in an oDSP. This application embodiment is not limited in this respect.

[0134] Furthermore, the embodiments of this application do not limit the details regarding the functions of the first component 11 and the second component 21. The functions of the first optical module 12 and the second optical module 22 are described in detail in subsequent embodiments and will not be elaborated here.

[0135] In addition, in this embodiment of the application, the MAC frame stream, code block stream, physical layer bit stream processed inside the first communication device 1, and the optical signal stream output by the first optical module 12 are all used to carry user data sent from the first communication device 1 to the second communication device 2. Therefore, these streams can also be collectively referred to as data streams.

[0136] Figure 2 is a flowchart of a security protection method provided in an embodiment of this application. This method is applied to the first communication device shown in Figure 1, and exemplarily to the first optical module in the first communication device shown in Figure 1. In a specific implementation, the security protection method shown in Figure 2 can be implemented by a first security protection device in the first optical module. As shown in Figure 2, the method includes the following steps.

[0137] Step 201: The first communication device acquires a code block stream, which includes multiple code blocks.

[0138] Each code block is typically 257 bits in size. In some scenarios, a 257-bit code block is obtained by encoding the MAC frame stream using 64B / 66B and transcoding it to 256B / 257B. Therefore, in some scenarios, a 257-bit code block can also be labeled as a 256B / 257B code block.

[0139] In the architecture shown in Figure 1, after the first component in the first communication device acquires the MAC frame stream, it performs physical layer processing on the MAC frame stream to obtain the physical layer bit stream. Then, the first optical module performs signal recovery processing on the physical layer bit stream to obtain the initial code block stream, and then determines the code block stream in step 201 based on the initial code block stream.

[0140] Based on this, in some embodiments, the first communication device can acquire the code block stream in the following ways: the first communication device acquires an initial code block stream, the size of which is P×100 gigabit ethernet (GE), where P is an integer greater than 0; the first communication device divides the initial code block stream into P instance code block streams, the size of which is 100GE; wherein, the code block stream is an instance code block stream.

[0141] The application scenario for the above implementation method is as follows: the first optical module in the first communication device adopts OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology in IEEE 802.3. OIF is short for Optical Internetworking Forum, ROADM is short for Reconfigurable Optical Add-Drop Multiplexer, ER indicates that the distance of the optical fiber link connecting the optical modules is more than 40 kilometers, and ER1-20 indicates that the distance of the optical fiber link connecting the optical modules is more than 20 kilometers.

[0142] To facilitate subsequent understanding, a brief explanation of OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology will be provided here first.

[0143] In OIF 800G ZR technology, Open ZR+ (100G~400G) technology, Open ROADM (100G~400G / 600G / 800G) technology, 800GE ER1-20 / ER1 technology, and future 1.6T related technologies (1.6T means that the optical module can transmit 1.6 trillion bits of data per second), the first optical module can process the initial code block stream by interleaving and multiplexing 100GE instance-side frames into line-side frames. That is, after the first optical module restores the physical layer bit stream from the first component to the initial code block stream, it divides the initial code block stream into several code block streams of size 100GE. Each 100GE code block stream can be called an instance code block stream. Then, the code blocks in each instance code block stream are mapped using GMP to obtain block frames. In this way, each instance code block stream is converted into a block frame stream, resulting in several block frame streams that correspond one-to-one with several instance code block streams. Finally, the block frames in several block frame streams are interleaved to obtain a line frame stream.

[0144] In the process of mapping code blocks in a code block stream to obtain a block frame using GMP, GMP mapping mainly includes the following two operations. One operation is to maintain a relatively small deviation between the rate of the code block stream before GMP processing and the rate of the block frame stream after GMP processing by adding or deleting stuffing code blocks. The other operation is to insert OH, PAD, and AM fields at the beginning of a certain number of code blocks to form a block frame of size M×N.

[0145] In OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology, the block frame structure obtained by the first optical module through GMP mapping is the block frame structure shown in Figure 3. As shown in Figure 3, the block frame consists of 128 rows, with each row containing 5140 bits. That is, the size of the block frame is 128 rows × 5140 columns, with both rows and columns in bits. For ease of explanation, the size of the block frame shown in Figure 3 can be simplified to 128 × 5140.

[0146] Referring again to Figure 3, the first 1280 bits of the first row are used to carry the alignment marker (AM) field, the padding (PAD) field, and the overhead (OH) field, respectively. Specifically, the first 480 bits of the first row carry the AM field, bits 481 to 960 carry the PAD field, and bits 961 to 1280 carry the OH field. In current OIF 800G ZR, Open ZR+, Open ROADM, or 800GE ER1-20 / ER1 technologies, the PAD field does not carry any information; therefore, in these technologies, the PAD field value is usually set to all zeros by default.

[0147] Referring back to Figure 3, bits 1281 of the first row to the last bit of the 128th row are used to carry code blocks. Bits 1281 to 1285 of the first row are reserved and not used to fill code blocks. Bits 1286 to 5140 of the first row are used together to carry 15 code blocks. Each row from the second to the last row carries 20 code blocks.

[0148] Based on this, in order to improve the applicability of the PHYsec scheme provided in this application embodiment, the data in the block frame shown in Figure 3 is protected by security, and security information is carried in the PAD field of the block frame. In other words, the PHYsec technology provided in this application embodiment can be applied to any of the following technologies: OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology.

[0149] Optionally, in this embodiment, when the first optical module in the first communication device adopts OIF 400G ZR technology, after the first optical module obtains the initial 400GE code block stream, it may not directly perform GMP mapping on the initial 400GE code block stream as in OIF 400G ZR technology. Instead, it may divide the initial 400GE code block stream into four code block streams of size 100GE, each code block stream being an instance code block stream. Then, GMP mapping is performed on each 100GE code block stream to obtain the block frame in the structure shown in Figure 3. Then, the PHYsec technology provided in this embodiment is implemented in the mapped block frame through step 202.

[0150] In other words, the process of OIF 400G ZR technology can be appropriately adjusted in this application embodiment to apply the PHYsec technology provided in this application embodiment in OIF 400G ZR technology through the block frame structure shown in FIG3.

[0151] Optionally, in this embodiment, the size of each instance code block stream is not limited to 100GE; for example, the size of each instance code block stream can be 200GE or 400GE, etc. These will not be illustrated further here. When the size of the instance code block stream is other sizes, the size of the block frame after mapping the instance code block stream can also be other sizes accordingly, and this embodiment does not limit this. In other words, the structure of the block frame provided in this embodiment is not limited to the structure shown in Figure 3.

[0152] In addition, in this embodiment, after the first optical module restores the physical layer bitstream to the initial code block stream, it may not divide the initial code block stream into multiple instance code block streams. Instead, it may directly perform GMP mapping on the initial code block stream and then implement the PHYsec technology provided in this embodiment in the mapped block frame through step 202. In this scenario, the mapped block frame can be the block frame in the structure shown in Figure 3, or it can be a block frame with other constructions. This embodiment does not limit this.

[0153] For example, in this embodiment, when the first optical module in the first communication device adopts OIF 400G ZR technology, after acquiring the initial 400GE code block stream, the first optical module continues to perform GMP mapping on the initial 400GE code block stream directly, as in the OIF 400G ZR technology. The resulting block frame size is 2*128×2*5140, meaning the block frame includes 2*128 rows of bits, with each row containing 2*5140 bits. In the first row, the AM field is 4*480 bits, the PAD field is 4*480 bits, the OH field is 4*320 bits, and the remaining area is the payload field. Then, the PHYsec technology provided in this embodiment is implemented in the mapped block frame through step 202.

[0154] For example, in this embodiment, when the first optical module in the first communication device uses OpenZR+300G technology, after acquiring three 100GE initial code block streams, the first optical module directly performs GMP mapping on the three 100GE initial code block streams. The resulting block frame size is 192×2*5140, meaning the block frame includes 192 rows of bits, with each row containing 2*5140 bits. In the first row, the AM field is 3*480 bits, the PAD field is 3*480 bits, the OH field is 3*320 bits, and the remaining area is the payload field. Then, the PHYsec scheme provided in this embodiment is implemented in the mapped block frame through step 202.

[0155] For example, in this embodiment, when the first optical module in the first communication device uses OpenZR+200G technology, after acquiring the initial 200GE code block stream, the first optical module directly performs GMP mapping on the initial 200GE code block stream. The resulting block frame size is 128×2*5140, meaning the block frame includes 128 rows of bits, with each row containing 2*5140 bits. In the first row, the AM field is 2*480 bits, the PAD field is 2*480 bits, the OH field is 2*320 bits, and the remaining area is the payload field. Then, the PHYsec scheme provided in this embodiment is implemented in the mapped block frame through step 202.

[0156] Step 202: The first communication device determines multiple block frames based on the code block stream. For any block frame, the block frame includes a PAD field and a payload field. The PAD field includes security information, and the payload field includes code blocks processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1.

[0157] The implementation method for determining multiple block frames based on the code block stream has been explained in detail in step 201, and will not be repeated here.

[0158] Each block frame includes a PAD field and a payload field. The PAD field carries security information, and the payload field carries the code block processed based on the security information.

[0159] In some embodiments, the block frame size is M×N bits, meaning the block frame includes M rows of bits, and each row includes N bits. In this embodiment, N can be an integer multiple of the block size. For example, if the size of a single block is 257 bits, then N can be an integer multiple of 257, such as 20 times 257, i.e., N = 5140.

[0160] For example, M is 128 and N is 5140. In this case, the block frame is the block frame shown in Figure 3. For details about the block frame shown in Figure 3, please refer to the aforementioned embodiment, which will not be repeated here.

[0161] Optionally, in this embodiment, the size of the block frame can be other than the size shown in Figure 3. For example, M is 2*128, N = 2*5140. Or, M is 192, N = 2*5140. Or, M is 128, N = 2*5140. The application scenarios for these values ​​of M and N have been explained in step 201 and will not be repeated here.

[0162] In this application embodiment, the PAD field in the block frame is extended to implement the PHYsec technology provided in this application embodiment. The extension of the PAD field in the block frame in this application embodiment may include the following aspects.

[0163] 1. The PAD field contains security information.

[0164] The security information may also be referred to as PHYsec parameters or PHYsec information, but this application does not limit this.

[0165] In some embodiments, to achieve secure protection of the block frame, the data in the block frame can be protected by confidentiality, i.e., encrypted. Optionally, the data in the block frame can also be protected by integrity. Therefore, in the embodiments of this application, the security information may include at least one of parameters for encrypting data or parameters for verifying data integrity.

[0166] For ease of understanding, the security algorithm used by the first communication device to process block frames is illustrated here. The security algorithms provided in this application embodiment can be, for example, Advanced Encryption Standard-Counter Mode (AES) ciphertext and service symmetric key system (Galois / counter mode, GCM) security algorithms, Advanced Encryption Standard-Counter Mode (AES-CTR), or SM4-CTR, where SM4 is also a key standard. The following explanation uses AES-CTR as an example.

[0167] AES-CTR is a block symmetric key encryption algorithm. Blocks mean dividing the plaintext into groups of equal length, encrypting one group at a time until the entire plaintext is encrypted. In the AES standard specification, the block length is 128 bits, meaning each block is 16 bytes (8 bits per byte).

[0168] AES-CTR can be calculated from the key index and IV using the following formula: k Then E k The encrypted information (i.e., ciphertext) is calculated by combining the ciphertext with the information to be encrypted (i.e., plaintext). k =AES(key,Y) i Y0=IV||C0 Y i =incr(Y i-1 )=IV||(C i-1 +1), i = 1, ..., n

[0169] Based on this, in the embodiments of this application, the security information includes at least one of the following: key index (KI), frame number, or authentication tag (AT). KI is used to indicate the key for processing the block frame, the frame number is used to generate the initialization vector (IV) for processing the block frame, and the AT is used to indicate the integrity check value (ICV) of the data in the block frame.

[0170] In this example, KI and IV are used to encrypt and decrypt data within a block frame. However, verifying the integrity of data within a block frame requires not only ICV but also KI and IV. Therefore, in the above example, the parameters used for encrypting data include KI and IV, while the parameters used for verifying data integrity include KI, IV, and ICV. It should be noted that in various security algorithms, KI and IV can be used to encrypt data, while KI, IV, and ICV can be used to verify data integrity.

[0171] Furthermore, the KI, frame number, and AT in the security information can, for example, be carried by any field in the PAD field, and this application embodiment does not limit this. For example, when the block frame is the block frame shown in FIG3, in some embodiments, the KI can be carried in the first two bits of the 39th byte of the first row of the block frame, the frame number can be carried in the 41st to 48th bytes of the first row of the block frame, and the AT can be carried in the 21st to 36th bytes of the first row of the block frame.

[0172] 2. The PAD field includes an error correction code for security information or includes at least one redundant security information.

[0173] In scenarios where the communication channel between the first and second communication devices has good quality, the PAD field may not include error correction codes for security information, nor may it perform redundant backups of security information.

[0174] Optionally, if the communication channel between the first and second communication devices has poor quality, the PAD field may further include an error correction code for the security information or at least a redundant copy of the security information. Since the PAD field includes not only the security information but also an error correction code for the security information or at least a redundant copy of the security information, when the second communication device receives a block frame, it can correct the security information based on the error correction code or the redundant copy of the security information if an error occurs, thus preventing the inability to reconstruct the block stream due to security information errors. This improves the reliability of data transmission while ensuring data transmission security.

[0175] For example, if the PAD field contains three security information entries, and the second communication device detects that two of the security information entries are the same when it receives the block frame, but the third security information entry is different from the first two, then it can be confirmed that the first two security information entries are the correct security information entries.

[0176] In addition, in this embodiment of the application, the error correction code can be an RS parity error correction code. The error correction code typically requires 24 bytes to carry.

[0177] When the block frame is the block frame shown in Figure 3, the security information and error correction code can be set at any position in the PAD field. Optionally, in some embodiments, to facilitate compatibility between the PHYsec technology provided in this application and the current FlexOsec technology, the security information is carried in bytes 21 to 52 of the PAD field; the error correction code is carried in bytes 5 to 20 and bytes 53 to 60 of the PAD field. Details regarding the FlexOsec technology are described in detail in subsequent embodiments and will not be elaborated here.

[0178] Alternatively, in other embodiments, if the compatibility of the PHYsec technology provided in this application embodiment with the current FlexOsec technology is not considered, 24 bytes can be arbitrarily selected from the 5th to the 20th byte and the 49th to the 60th byte of the PAD field to carry the error correction code.

[0179] For example, bytes 21 to 48 of the PAD field are used to carry security information, as are bytes 5 to 20 and bytes 49 to 56 of the PAD field. Alternatively, bytes 21 to 48 of the PAD field are used to carry security information, as are bytes 5 to 16 and bytes 49 to 60 of the PAD field.

[0180] Optionally, in scenarios where the error correction code requires a different number of bytes to carry it, any number of bytes can be selected from the 5th to 20th bytes and the 49th to 60th bytes of the PAD field to carry the error correction code. For example, in a scenario where the error correction code requires 16 bytes to carry it, the error correction code can be carried in the 5th to 20th bytes of the PAD field.

[0181] Additionally, if the PAD field includes at least one redundant security information, this approach can be exemplified in scenarios where the block frame size is 2*128×2*5140. In this scenario, the block frame includes 2*128 rows of bits, with each row containing 2*5140 bits, where the PAD field in the first row is 4*480 bits in size. Thus, the PAD field can carry a total of four copies of security information, meaning it contains three redundant copies.

[0182] For another example, including at least one redundant security information in the PAD field can be applied in a scenario where the block frame size is 192×2*5140. In this scenario, the block frame consists of 192 rows of bits, with each row containing 2*5140 bits. The PAD field in the first row is 3*480 bits in size. Thus, the PAD field can carry a total of 3 copies of security information, meaning it contains two redundant copies of security information.

[0183] Other implementations of including at least one redundant security information in the PAD field will not be illustrated here.

[0184] In addition, in this embodiment of the application, in addition to including at least one of the parameters for encrypting data or the parameters for verifying data integrity, the security information further includes at least one of the following information to achieve more technical effects.

[0185] 3. Security information includes primary information to support multiple flexible security modes.

[0186] In this embodiment of the application, to improve the flexibility of security protection, the security information may further include first information, which is used to indicate the mode of implementing security protection for the other block frame, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to indicate a mode of not implementing security protection for the other block frame.

[0187] That is, in the embodiments of this application, the first information can be used to indicate whether to perform security protection on block frames, and the first information can be used to indicate the security protection mode implemented when performing security protection.

[0188] For ease of explanation, in this embodiment, if the mode indicated by the first information is a mode that does not implement security protection for the block frame, then this mode is referred to as the first security mode. If the mode indicated by the first information is a mode that implements confidentiality protection for the block frame but does not implement integrity protection, then this mode is referred to as the second security mode. If the mode indicated by the first information is a mode that does not implement confidentiality protection for the block frame but implements integrity protection, then this mode is referred to as the third security mode. If the mode indicated by the first information is a mode that implements security protection for the block frame, then this mode is referred to as the fourth security mode.

[0189] For example, different modes can be indicated by setting different values ​​for the first information. As shown in Table 1, the first information is a first value, which indicates that neither confidentiality protection nor integrity protection is implemented; that is, the mode indicated by the first information is the first security mode. The first information is a second value, which indicates that confidentiality protection is implemented but integrity protection is not; that is, the mode indicated by the first information is the second security mode. The first information is a third value, which indicates that neither confidentiality protection nor integrity protection is implemented; that is, the mode indicated by the first information is the third security mode. The first information is a fourth value, which indicates that both confidentiality protection and integrity protection are implemented; that is, the mode indicated by the first information is the second security mode.

[0190] Table 1

[0191] Furthermore, the first information includes a first sub-information and a second sub-information. The first sub-information is used to indicate whether confidentiality protection is implemented for the block frame, and the second sub-information is used to indicate whether integrity protection is implemented for the block frame.

[0192] For example, the first sub-information is a first sub-value, which is used to indicate that the other party's block frame does not implement confidentiality protection; or, the first sub-information is a second sub-value, which is used to indicate that the other party's block frame implements confidentiality protection; the second sub-information is a third sub-value, which is used to indicate that the other party's block frame does not implement integrity protection; or, the second sub-information is a fourth sub-value, which is used to indicate that the other party's block frame implements confidentiality protection.

[0193] The first and second sub-information typically each consist of 2 bits. In this scenario, when the first sub-information is 00, it indicates that the other party's block frame does not implement confidentiality protection; when the first sub-information is 01, it indicates that the other party's block frame implements confidentiality protection. When the second sub-information is 00, it indicates that the other party's block frame does not implement integrity protection; when the second sub-information is 01, it indicates that the other party's block frame implements integrity protection.

[0194] In this scenario, the relationship between the first information, the first sub-information, the second sub-information, and the aforementioned four security modes is shown in Table 2.

[0195] Table 2

[0196] Additionally, as shown in Table 2, the first sub-information can be labeled Au, and the second sub-information can be labeled En. In some embodiments, when the block frame is the block frame shown in Figure 3, Au can be carried in the first two bits of the 38th byte in the first row of the block frame, and En can be carried in the third and fourth bits of the 38th byte in the first row of the block frame. Optionally, Au and En can also be carried in other bytes of the PAD field, which will not be illustrated here.

[0197] It should be noted that Table 2 is an example illustrating four security modes indicated by the first information. In the embodiments of this application, the first information indicating the four security modes can also be achieved through other means. For example, the first and second sub-information can each be one bit, so that the four security modes shown in Table 1 can be indicated by the flexible values ​​of these two bits.

[0198] Furthermore, when the mode indicated by the first information is the first security mode, since no confidentiality or integrity protection is currently applied to the block frames, the data in the block frames is not encrypted; that is, the data in the block frames is unencrypted, and the receiving end does not need to verify the integrity of the data in the block frames. In this scenario, the security information may not carry parameters for encryption or parameters for integrity verification. Optionally, the security information may carry either parameters for encryption or parameters for integrity verification, but the receiving end does not use these parameters.

[0199] When the first information indicates the second security mode, the block frame is protected for confidentiality but not for integrity. Therefore, the data in the block frame is encrypted, meaning the data in the block frame is encrypted, and the receiving end does not need to verify the integrity of the data in the block frame. In this scenario, the security information needs to include parameters for encryption. However, the security information may or may not include parameters for integrity verification; the receiving end simply does not verify the integrity of the data in the block frame.

[0200] When the first information indicates the third security mode, since the current block frame is not protected for confidentiality but for integrity, the data in the block frame does not need to be encrypted; that is, the data in the block frame is unencrypted. Simultaneously, the receiving end needs to verify the integrity of the data in the block frame. In this scenario, the security information needs to include parameters for verifying integrity.

[0201] When the first information indicates the fourth security mode, since the current block frame is simultaneously protected for confidentiality and integrity, the data in the block frame is encrypted. That is, the data in the block frame is encrypted, and the receiving end also needs to verify the integrity of the data in the block frame. In this scenario, the security information needs to include parameters for encryption and parameters for verifying integrity, so that the receiving end can decrypt the block frame and verify the integrity of the data in the block frame.

[0202] Table 3 is a schematic diagram illustrating the correspondence between a security mode and the corresponding parameters in the security information, as provided in an embodiment of this application. Table 3 uses the example of "parameters used for encrypting data including KI and frame number, and parameters used for verifying data integrity including KI, frame number, and ICV" for illustration. It should be noted that Table 3 is only for illustrative purposes. Based on the foregoing, it can be seen that there is no strict binding relationship between the security mode and the parameters used for encrypting data or verifying data integrity in the security information.

[0203] Table 3

[0204] Based on the first information, this application embodiment provides a PHYsec technology that can flexibly indicate the security mode. In this technology, unlike the FlexOsec technology, it is not necessary to simultaneously protect the confidentiality and integrity of the data. Instead, it can flexibly choose whether to protect the confidentiality or integrity of the data in the cross-block frame according to the application scenario. Therefore, the PHYsec technology provided by this application embodiment has a wide range of applications.

[0205] 4. In scenarios where security information is used to protect the confidentiality of block frames, the encryption scope of the block frame includes the payload field, or the encryption scope of the block frame includes both the payload field and the OH field.

[0206] In this embodiment, the encryption scope can be the payload field. In this scenario, the code blocks in the payload field can be encrypted using security information. Thus, the code blocks in the payload field of the block frame are encrypted code blocks.

[0207] Optionally, the encryption scope can also include both the payload field and the OH field. In this scenario, the code blocks in the payload field and the information in the OH field are encrypted simultaneously using security information. Thus, the code blocks in the payload field of the block frame are encrypted code blocks, and the information in the OH field of the block frame is also encrypted information.

[0208] The information carried in the OH field can represent at least one of network behavior (such as MFAS and STAT), management protocols (such as FCC1 and OSMC), and user characteristics (such as payload type). In this embodiment, not only the payload field is encrypted, but the OH field is also encrypted to prevent attackers from obtaining data such as network behavior, management protocols, and user characteristics.

[0209] Figure 4 is a schematic diagram of an encryption range provided by an embodiment of this application. As shown in Figure 4, in a scenario where the block frame is the block frame shown in Figure 3, the encryption range is from the 961st bit of the first row in the block frame to the last bit in the block frame. Thus, the encryption range covers the OH field and the payload field.

[0210] It should be noted that Figure 4 uses the square frame shown in Figure 3 as an example for illustration. Optionally, in scenarios where the square frame structure is other, Figure 4 can also be referred to to set the encryption range.

[0211] In addition, in scenarios where security information is used to protect the integrity of block frames, the scope of integrity protection for block frames may include the payload field, or the scope of integrity protection for block frames may include the payload field and other information other than the payload field.

[0212] Figure 5 is a schematic diagram of an integrity protection range provided by an embodiment of this application. As shown in Figure 5, in a scenario where the block frame is the block frame shown in Figure 3, the integrity protection range is from the 769th bit of the first row in the block frame to the last bit in the block frame. Thus, the integrity protection range covers part of the information in the OH field, payload field, and PAD field.

[0213] It should be noted that Figure 5 uses the block frame shown in Figure 3 as an example for illustration. Furthermore, the integrity protection range in Figure 5 is compatible with FlexOsec technology, which will be described in detail in subsequent embodiments and will not be elaborated upon here. Optionally, in scenarios where the block frame structure is other, the encryption range can be flexibly set according to requirements.

[0214] 5. Security information includes second and third information to support various confidentiality and integrity protection algorithms.

[0215] As can be seen from the foregoing, the PHYsec technology provided in this application can support a variety of security algorithms. Based on this, in some embodiments, the security information also includes second information and third information. The second information is used to instruct the other party's block frame to implement a confidentiality protection algorithm, and the third information is used to instruct the other party's block frame to implement an integrity protection algorithm.

[0216] In this scenario, the receiving end can determine which security algorithm is used to protect confidentiality based on the second information, and determine which security algorithm is used to protect integrity based on the value of the third information.

[0217] It should be noted that there is no strict binding relationship between the second and third information and the first information. For example, when the security mode indicated by the first information is no confidentiality protection or integrity protection, the second and third information can still indicate specific security algorithms. This application does not limit this aspect.

[0218] The second and third information can be carried by any byte in the PAD field, and this application embodiment does not limit this.

[0219] 6. Security information includes a fourth piece of information to indicate the version of the PHYsec technology.

[0220] In this embodiment, the security information further includes fourth information, which indicates the version number of the PHYsec technology provided in this embodiment. This allows the decoding side to determine the version of the PHYsec technology currently in use based on the fourth information.

[0221] The fourth piece of information can be labeled V. In some embodiments, when the block frame is the block frame shown in Figure 3, V can be carried in the last four bits of the 38th byte in the first row of the block frame. Optionally, V can also be carried in other bytes of the PAD field, which will not be illustrated here.

[0222] 7. Security information includes KCC and fifth information to flexibly indicate whether KCC is enabled.

[0223] In this embodiment of the application, the security information may further include: a key exchange communication channel (KCC) and fifth information; wherein the fifth information is used to indicate whether the KCC is enabled.

[0224] The fifth piece of information can be labeled MCE. In some embodiments, when the block frame is the block frame shown in Figure 3, the MCE can be carried in the first two bits of the 40th byte in the first row of the block frame. Optionally, the MCE can also be carried in other bytes of the PAD field, which will not be illustrated here.

[0225] When the fifth message (MCE) indicates that KCC is enabled, the first communication device and the second communication device transmit some control information, such as the key negotiated by both parties, through KCC. When the fifth message (MCE) indicates that KCC is disabled, the first communication device and the second communication device do not transmit some control information through KCC. At this time, KCC is in the default state, that is, KCC does not carry the control information exchanged between the two parties.

[0226] 8. Security information includes a sixth piece of information to support secure channels.

[0227] In this embodiment of the application, the security information may further include: sixth information; the sixth information is used to indicate the security channel number.

[0228] The sixth piece of information can be labeled SC. In some embodiments, when the block frame is the block frame shown in Figure 3, SC can be carried in the last six bits of the 40th byte in the first row of the block frame. Optionally, SC can also be carried in other bytes of the PAD field, which will not be illustrated here.

[0229] The security channel number indicated in the sixth piece of information refers to the security channel number used by the first and second communication devices to currently transmit block frames. A security channel can be understood as a logically defined virtual channel, thus enabling the construction of multiple security channels between the first and second communication devices to transmit block frames corresponding to different services in different security channels.

[0230] In addition, in order to make the PHYsec technology provided in this application compatible with the flexible optical transport network security (FlexOsec) technology, in some embodiments, the security information also includes a cipher suite type (CST), which is used to indicate whether the FlexOsec technology is enabled.

[0231] In step 202, since the information in the PAD field of the block frame is currently determined by the PHYsec technology provided in this application embodiment, CST is the fifth value in this scenario, used to indicate that the FlexOsec technology is not enabled.

[0232] Optionally, if the first communication device needs to implement security protection for the code block stream based on FlexOsec technology, after acquiring the code block stream, the first communication device can map the code block stream into multiple FlexO frames using FlexOsec technology. For any FlexO frame, the FlexO frame includes an AM field, an EOH field, a BOH field, and a payload field. The EOH field includes AT, KI, and a frame number, and the payload field includes code blocks encrypted with KI and the frame number. Subsequently, when the second communication device receives a FlexO frame, it can decrypt and verify the integrity of the FlexO frame.

[0233] Figure 6 is a structural diagram of a type of FlexO frame (labeled as FlexO-1 frame). As shown in Figure 6, the size of the FlexO-1 frame is 128×5140. The first 480 bits of the first row are used to carry AM, the 481st to 960th bits of the first row are used to carry EOH, the first 961st to 1208th bits of the first row are used to carry BOH, and the 1281st bit of the first row to the last bit of the last row are used to carry the encrypted code block.

[0234] Referring again to Figure 6, in bytes 21 to 52 of the EOH, bytes 21 to 36 are used to carry AT, byte 37 is used to carry the key exchange communication channel (KCC), byte 38 is a reserved byte, byte 39 is used to carry KI and CST, byte 40 is a reserved byte, bytes 41 to 48 are used to carry the frame number (FN), and bytes 49 to 52 are all reserved bytes (marked as RES in Figure 6).

[0235] In other words, after the first communication device acquires the code block stream, if it maps the code block stream into multiple FlexO frames using FlexOsec technology, the structure of the resulting FlexO frame is the frame structure shown in Figure 4.

[0236] To further understand the effects of the PHYsec technology provided in the embodiments of this application, the differences between the two are explained below.

[0237] Figure 7 is a detailed structure of a block frame in a PHYsec technology provided in this application embodiment. Figure 7 uses the block frame shown in Figure 3 as an example. As shown in Figure 7, the first to fourth bytes of the PAD field are all 0 by default and are not used to carry security information or checksums. The 21st to 52nd bytes of the PAD field are used to carry security information, and the 5th to 20th bytes and the 53rd to 60th bytes of the PAD field are used to carry error correction codes.

[0238] In the PAD field, bytes 21 to 36 are used to carry the AT security information, byte 37 is used to carry the KCC security information, byte 38 is used to carry the first and fourth information (marked as A / E / V in Figure 7), byte 39 is used to carry the KI and CST security information, byte 40 is used to carry the fifth and sixth information (marked as MCESC in Figure 7), bytes 41 to 48 are used to carry the frame number, and bytes 49 to 52 are reserved bytes.

[0239] Table 4 is a functional comparison of the block frame shown in Figure 7 and the FlexOsec frame shown in Figure 6 provided in the embodiments of this application.

[0240] Table 4

[0241] It should be noted that the information in any of the second to eighth aspects of the PAD field extension mentioned above is optional. Examples will not be provided for each aspect here.

[0242] The above description illustrates the structure of the block frame in the PHYsec technology provided in this application. Furthermore, in this application embodiment, for any block frame, the security information carried in the block frame can be used to protect the data within that block frame. Optionally, the security information carried in the block frame can also be used to protect data in other block frames adjacent to this block frame.

[0243] Based on this, in some embodiments, in the scenario of protecting the confidentiality of block frames, the multiple block frames include a first block frame and a second block frame, the second block frame is the block frame following the first block frame, and the security information in the first block frame is used to protect the confidentiality of the second block frame.

[0244] For example, the security information includes the KI (Key Information) and the frame number. When sending the first block frame, the sending end includes the KI and frame number used for confidentiality protection of the next block frame (the second block frame) in the first block frame. Thus, the receiving end receives the KI and frame number needed to decrypt the second block frame before receiving the second block frame itself, reducing the latency required for decryption.

[0245] It should be noted that when the communication link is initialized between the first and second communication devices, the data in the first block frame sent by the first communication device to the second communication device is unencrypted because the first block frame needs to carry the KI and frame number used for encryption of the next block frame. Furthermore, the block frames exchanged between the first and second communication devices during the initialization of the communication link generally do not carry service data; therefore, there is no need to worry about the data in the first block frame being leaked.

[0246] Figure 8 is a schematic diagram illustrating how KI and frame number are carried according to an embodiment of this application. As shown in Figure 8, assuming the first communication device sequentially sends block frame 1, block frame 2, block frame 3, etc., then the KI and frame number carried in block frame 1 are used for data encryption in block frame 2, the KI and frame number carried in block frame 2 are used for data decryption in block frame 3, and the KI and frame number carried in block frame 3 are used for data encryption in the next block frame after block frame 3.

[0247] In addition, in some embodiments, in the scenario of protecting the integrity of block frames, multiple block frames include third-party block frames and fourth-party block frames, where the fourth-party block frame is the block frame following the third-party block frame, and the security information in the fourth-party block frame is used to protect the integrity of the third-party block frame.

[0248] For example, the security information includes AT (Attack Value). When the sending end transmits a third-party block frame, it calculates an AT value based on the data in the third-party block frame. However, this AT value is not sent along with the security information in the third-party block frame; instead, it is buffered. When transmitting the next block frame, i.e., the fourth block frame, the AT value is included in the security information of the fourth block frame. Thus, when the receiving end receives a third-party block frame, it can first calculate an AT value based on the data in the third-party block frame. If the receiving end has just finished calculating the AT value for the third-party block frame and has just received the fourth block frame, it can compare the calculated AT value with the AT value in the fourth block frame to determine if the data in the third-party block frame is complete. This allows the receiving end to calculate the AT value for the data in the third-party block frame and receive the corresponding AT value in the third-party block frame in parallel, thereby reducing latency.

[0249] Figure 9 is a schematic diagram illustrating how AT is carried according to an embodiment of this application. As shown in Figure 9, assume that the first communication device sequentially sends block frame 1, block frame 2, block frame 3, etc. Then, the AT carried in block frame 1 is the integrity check value of the data in the previous block frame, the AT carried in block frame 2 is the integrity check value of the data in block frame 1, and the AT carried in block frame 3 is the integrity check value of the data in block frame 2.

[0250] Furthermore, in scenarios where confidentiality and integrity protection of block frames are performed simultaneously, Figures 10 and 11 below are used as examples for illustration. Figure 10 is a schematic flowchart illustrating how a first communication device, according to an embodiment of this application, transmits KI, frame number, and AT. Figure 11 is a schematic flowchart illustrating how a second communication device, according to an embodiment of this application, receives KI, frame number, and AT.

[0251] As shown in Figure 10, the first communication device sends the first frame at time T0, the second frame at time T1, the third frame at time T2, and so on, until T... i-1 The process begins by sending frame I, and so on. In frame 1, the KI and frame number in the security information are the same KI and frame number used to encrypt frame 2. The data in frame 1 is unencrypted, and an AT value is calculated and cached based on the data in frame 1. Similarly, in frame 2, the KI and frame number in the security information are the same KI and frame number used to encrypt frame 3. The data in frame 2 is encrypted, and the AT value in the security information is calculated based on the data in frame 1. Likewise, in frame 3, the KI and frame number in the security information are the same KI and frame number used to encrypt frame 4. The data in frame 3 is encrypted, and the AT value in the security information is calculated based on the data in frame 2. This process continues.

[0252] As shown in Figure 11, the second communication device receives the first frame at time T0, the second frame at time T1, the third frame at time T2, and so on, until T... i-1 The system continuously receives frame I, and so on. Since the KI and frame number in the security information of frame I are the same KI and frame number used to encrypt frame II, and the data in frame I is not encrypted, the second communication device does not decrypt the data in frame I upon receiving it. Instead, it directly caches the KI and frame number from the security information of frame I and calculates the integrity check value of the data in frame I. When the second communication device receives frame II, it can verify the integrity of the data in frame I based on the AT carried in frame II, and simultaneously decrypt the data in frame II based on the cached KI and frame number, and cache the KI and frame number from the security information of frame II. This process continues in sequence.

[0253] In addition, in some embodiments, such as when the first optical module in the first communication device adopts OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology, after the first communication device determines multiple block frames based on the code block stream, the first communication device further interleaves the block frames determined based on multiple instance code block streams to obtain a line frame stream; the first communication device converts the line frame stream into an optical signal to send the optical signal to the second communication device.

[0254] The line frame stream includes multiple line frames. For any given line frame, the line frame includes information from at least one block frame among multiple block frames determined based on each instance code block stream.

[0255] It should be noted that the main difference between OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology lies in the different interleaving granularities when interleaving block frames.

[0256] For example, in OIF 800G ZR technology or 800GE ER1-20 / ER1 technology, during interleaving, the eight block frame streams determined based on eight 100GE instance code block streams are interleaved. For instance, one block frame is extracted from each of these eight block frame streams, resulting in eight block frames. These eight block frames are then divided into 128-bit granularities. First, one 128-bit bit is extracted from each of the eight block frames and placed into the first 8*128 bits of the line frame. This process is repeated for the second time, extracting one 128-bit bit from each of the eight block frames, and so on.

[0257] For example, in Open ZR+ technology, the AM, PAD, and OH fields in a block frame are interleaved with a 10-bit granularity, while the payload field in the block frame is interleaved with a 257-bit granularity. Similarly, in Open ROADM MSA5.0 technology, all fields in a block frame are interleaved with a 10-bit granularity, while in Open ROADM MAS6.0 technology, all fields in a block frame are interleaved with a 128-bit granularity.

[0258] Furthermore, the above embodiments use "security protection performed on block frames after GMP mapping and before interleaving" as an example to explain the PHYsec scheme provided in this application. Optionally, in this application example, security protection can also be performed on the interleaved line frames. Here, the interleaved line frames are essentially composed of multiple block frames. If encryption is performed on the interleaved line frames, it is essentially still encryption on the block frames within the interleaved line frames. Therefore, even if security protection is performed on the interleaved line frames, if the line frames are restored to block frames, the information carried in the block frames is consistent with the aforementioned embodiments, and therefore will not be repeated here.

[0259] The interleaving granularity differs among OIF 800G ZR, Open ZR+, Open ROADM, and 800GE ER1-20 / ER1 technologies. Therefore, for different technologies, if encryption is to be performed in the interleaved line frame, the position of each field in each block frame must first be identified from the interleaved line frame, and then security information and error correction codes must be added to the relevant positions before encryption. This application's embodiments will not elaborate on this.

[0260] Figure 12 is a flowchart of a security protection method provided in an embodiment of this application. This method is applied to the second communication device shown in Figure 1, and exemplarily to the second optical module in the second communication device shown in Figure 1. In a specific implementation, the security protection method shown in Figure 12 can be implemented by a second security protection device in the second optical module. As shown in Figure 12, the method includes the following steps.

[0261] Step 1201: The second communication device acquires multiple block frames. For any block frame, the block frame includes a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes a code block processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1.

[0262] For an explanation of the block frame, please refer to the relevant content in the embodiment shown in Figure 2, which will not be repeated here.

[0263] In some embodiments, the second communication device may acquire multiple block frames in the following manner: the second communication device receives an optical signal from the first communication device; the second communication device processes the optical signal to obtain a line frame stream; the second communication device performs deinterleaving processing on the line frame stream to obtain at least one block frame stream, the size of the block frame stream is 100GE, and the block frame stream includes multiple block frames.

[0264] The application scenarios for the above implementation method can also be referred to the embodiment shown in Figure 2, and will not be repeated here.

[0265] Step 1202: The second communication device processes multiple block frames based on the security information in the multiple block frames.

[0266] As shown in Figure 2, in some embodiments, the multiple block frames include a first block frame and a second block frame, where the second block frame is the next block frame after the first block frame, and the security information in the first block frame is used to protect the confidentiality of the second block frame. In this scenario, the second communication device can process the multiple block frames based on the security information in the multiple block frames in the following way: the second communication device decrypts the data in the second block frame based on the security information in the first block frame.

[0267] Furthermore, based on the embodiments shown in Figure 2, in some embodiments, the multiple block frames include a third block frame and a fourth block frame, where the fourth block frame is the next block frame after the third block frame, and the security information in the fourth block frame is used to protect the integrity of the third block frame. In this scenario, the implementation method of the second communication device processing multiple block frames based on the security information in the multiple block frames can be as follows: the second communication device performs integrity verification on the data in the third block frame based on the security information in the fourth block frame.

[0268] Optionally, in scenarios where the security information carried in each block frame is used to protect the block frame itself, the second communication device can process the data in the block frame based on the security information in each block frame, which will not be described in detail here.

[0269] Furthermore, as shown in the embodiment of Figure 2, the PAD field may also include an error correction code for the security information. In this scenario, the second communication device can also correct the security information based on the error correction code. For example, when the second communication device decodes the security information using FEC decoding technology, if it detects erroneous information in the security information, it can correct the security information based on the error correction code.

[0270] Furthermore, as shown in the embodiment of Figure 2, the PAD field can also include multiple pieces of security information. In this scenario, the second communication device can also select the correct security information from these multiple pieces of security information to process the block frame, as described in detail in the foregoing embodiments, and will not be repeated here.

[0271] The following uses the encryption / decryption system shown in Figure 1 as an example to illustrate the overall process of the security protection method provided in this application embodiment.

[0272] Figure 13 is a schematic diagram of an encryption / decryption process provided in an embodiment of this application. As shown in Figure 13, after obtaining the MAC frame stream, the first component in the first communication device performs reconciliation sublayer (RS) processing on the MAC frame stream. The purpose of RS processing is to adapt the serial MAC frame stream to a media independent interface (MII) and maintain the link state (including up or down state) to facilitate subsequent processing of the MAC frame stream by the first component. Here, MII is an interface defined in IEEE 802.3 located between the MAC layer and the PHY layer.

[0273] Referring again to Figure 13, after the first component performs RS processing on the MAC frame stream, it continues to process the MAC frame stream using the physical coding sublayer (PCS) layer. The PCS layer processing mainly includes: 64B / 66B encoding and 256B / 257B transcoding of the MAC frame stream to obtain a code block stream. This code block stream is then further scrambled, and AM groups are added to it. The code block stream with added AM groups is then distributed to each reed-solomon forward error correction (RS-FEC) encoder. Each RS-FEC encoder performs RS-FEC processing to generate checksums for the code blocks. Finally, the serial code block stream is distributed to multiple virtual lanes (VLs) at a granularity of 10 bits per symbol, thereby converting the serial second code block stream into parallel multi-channel VL signals. These multi-channel VL signals are then sent to the physical medium attachment (PMA) layer of the first component. The purpose of scrambling is to avoid consecutive 0 bits (also known as long 0s) or consecutive 1 bits (also known as long 1s) in the code block stream, thereby avoiding the problem of difficulty in recovering the clock from the signal when the hardware in the first component performs subsequent processing.

[0274] Referring again to Figure 13, the PMA layer of the first component is used to multiplex the received VL signals (MUX) into at least one serializer / deserialize (Serdes) signal and send it to the first optical module.

[0275] Referring again to Figure 13, after receiving at least one SerDes signal from the SerDes bus, the first optical module converts the at least one SerDes signal into multiple VL signals at the PMA layer. Then, it performs PCS layer processing on the multiple VL signals. The PCS layer processing includes: AM locking on each VL signal, de-jittering and reordering each AM-locked VL signal, RS-FEC decoding on the reordered signal, interleaving the multiple signals after RS-FEC decoding to obtain a serial bit stream, then deleting the AM in the serial bit stream to obtain a code block stream, and descrambling the code block stream to obtain the initial code block stream.

[0276] Referring again to Figure 13, after obtaining the initial code block stream, the first optical module obtains a block frame including the AM field, PAD field, and OH field through GMP mapping. Then, the PHYsec technology provided in the embodiments of this application is implemented in the block frame. Finally, the processed block frame is interleaved into a line frame, and the line frame is converted into an optical signal through PMA layer processing and physical media dependent (PMD) layer processing. Then, the optical signal is sent to the second communication device through the optical fiber link.

[0277] Referring again to Figure 13, when the second optical module in the second communication device receives an optical signal, it processes the optical signal sequentially using the PMD layer and the PMA layer to obtain a line frame stream. Then, it deinterleaves the line frames in the line frame stream to obtain a block frame stream. Based on the security information in the PAD field of the block frame, it implements the PHYsec technology provided in this application embodiment. After processing the block frame, it obtains the code block stream through the inverse operation of GMP mapping (i.e., GMP demapping, abbreviated as DE-GMP). The subsequent processing flow is the reverse of the processing flow of the first communication device, and will not be described again here.

[0278] Figure 14 is a schematic diagram of another encryption / decryption process provided in an embodiment of this application. As shown in Figure 14, on the encryption side, i.e., at the first communication device, for each 100GE instance code block, the AM field, PAD field, and OH field are inserted through GMP mapping to obtain a block frame, and the PHYSec technology provided in this embodiment is implemented on the block frame. Then, the block frames obtained from the N instance code block streams are interleaved in an N:1 manner to obtain a line frame stream. After FEC encoding of the line frame stream, it is transmitted to the optical interface through the oDSP, and then the optical interface converts the digital signal into an optical signal through the DAC.

[0279] Referring again to Figure 14, on the decryption side, i.e., at the second communication device, the optical interface converts the received optical signal into a digital signal via an ADC and sends the digital signal to the oDSP. The oDSP receives the digital signal and performs FEC decoding to obtain the line frame stream. Then, it performs 1:N deinterleaving processing on the line frame stream to obtain N block frame streams. AM and PAD are detected for each block frame stream to lock the block frame, and security information such as KI, IV, and ICV are extracted from the block frame. The extracted security information is then used to process the block frame.

[0280] The detailed implementation of Figure 14 has been explained in the relevant content of the foregoing embodiments, and will not be repeated here.

[0281] Figure 15 is a schematic diagram of another encryption / decryption process provided in an embodiment of this application. As shown in Figure 15, the information blocks in the encryption range of the block frame are sequentially marked as P0 to Pn. The first communication device calculates E based on the key index and IV using a security algorithm. k After (including E0 to En), P0 to Pn are calculated with E0 to En respectively to obtain C0 to Cn, which are the encrypted data.

[0282] Referring again to Figure 15, after receiving the block frame, the second communication device sequentially labels the information blocks within the encrypted range of the block frame as C0 to Cn. The second communication device then calculates E using a security algorithm based on the key index and IV obtained from the security information. k After (including E0 to En), C0 to Cn are calculated with E0 to En respectively to obtain P0 to Pn, which is the data in the block frame that is decrypted.

[0283] The following uses Figure 16 as an example to illustrate the overall security protection method provided in this application embodiment. The process shown in Figure 16 is applied to a scenario where the confidentiality and integrity of block frames are protected simultaneously.

[0284] As shown in Figure 16, when both confidentiality and integrity of the block frame are protected simultaneously, the operation of the security control logic on the encryption side (i.e., at the first communication device) includes: firstly, obtaining the block frame through GMP mapping, the block frame including the AM field, PAD field, OH field, and payload field; then, inputting the key index and IV into the AES algorithm, and finally, the AES algorithm outputting E. k E k The ciphertext is calculated by combining the plaintext within the range to be encrypted in the block frame, and the ICV is calculated by the AES algorithm based on the ciphertext and the symmetric key system (galois / counter mode, GCM). Finally, the key index, IV, and ICV are carried in the PAD field to obtain the block frame after security protection.

[0285] Correspondingly, the security control logic on the decryption side (i.e., at the second communication device) operates as follows: locking the PAD field in the received block frame; extracting the key index, IV, and ICV from the PAD field; calculating the ICV using the AES algorithm based on the ciphertext and GCM; comparing the calculated ICV with the ICV extracted from the PAD field; if they match, it indicates that the data in the ciphertext is complete, and therefore the key index and IV are further input into the AES algorithm, which then outputs E. k E k The plaintext is obtained by calculating the ciphertext, and the processed block frame is demapped using GMP to obtain the code block stream.

[0286] In Figure 16, for details on how to insert the key index, IV, and ICV into the PAD field, please refer to the embodiment shown in Figure 2 above, which will not be repeated here.

[0287] Furthermore, Figure 16 uses AES-GCM as an example for illustration. In scenarios using other types of security algorithms, the process shown in Figure 16 can also be referenced to encrypt and decrypt data.

[0288] The following two scenarios further illustrate the security protection method provided in the embodiments of this application.

[0289] As shown in Figure 17, the first communication device is the outgoing switch of Intelligent Computing Center A, and the second communication device is the outgoing switch of Intelligent Computing Center B. Intelligent Computing Center A and Intelligent Computing Center B transmit valuable and sensitive data, such as AI training models. The first and second communication devices support interconnection via 400G Ethernet MAC / PHY interfaces, thereby enabling transmission over a 40KM long-distance fiber optic network.

[0290] Referring again to Figure 17, the PHYsec technology provided in this application embodiment is deployed in the oDSP of the first optical module in the first communication device and the oDSP of the second optical module in the second communication device, thereby ensuring the security and reliability of the data transmitted between the intelligent computing center A and the intelligent computing center B.

[0291] The processing flow of the oDSP (i.e., the encryption side) in the first optical module is illustrated in Figure 18. A 400GE code block stream (each code block is 257 bits) is round-routing (RR) to form four instance code block streams, each 100GE in size. Each 100GE instance code block stream is mapped using GMP to insert AM / PAD / OH (where the security information of the PAD portion is protected by error correction code encoding) to form a 5140-column * 128-row block frame. The security algorithm supports AES-GCM, and the encryption scope includes the payload field and the OH field of the block frame. Finally, the four block frame streams are interleaved to obtain a line frame stream. This line frame stream is then encoded using OFEC or CFEC, and further processed by the PMA layer to transmit the optical signal.

[0292] The processing flow of the oDSP (i.e., the decryption side) in the second optical module is illustrated in Figure 19. After receiving the physical layer bitstream, the PMA layer of the oDSP in the second optical module processes the physical layer bitstream at the PMA layer, and then performs FEC decoding such as concatenated FEC (OFEC) or open FEC (CFEC) to obtain the line frame stream. The line frame stream is then deinterleaved to obtain four block frame streams. For any block frame in the block frame stream, the AM field and PAD field in the block frame are detected to extract the RS error correction code and security information in the PAD field. Based on the RS error correction code, the security information in the PAD field is corrected to extract KI and IV from the security information, thereby decrypting the block frame.

[0293] It should be noted that in the scenario shown in Figure 17, the processes shown in Figures 18 and 19 only implement confidentiality protection for the block frames, without implementing integrity protection. Optionally, in the scenario shown in Figure 17, only integrity protection can be implemented for the block frames, without implementing confidentiality protection. Alternatively, both confidentiality protection and integrity protection can be implemented simultaneously.

[0294] As shown in Figure 20, the first communication device is the outgoing switch of Intelligent Computing Center A, and the second communication device is the outgoing switch of Intelligent Computing Center B. Intelligent Computing Center A and Intelligent Computing Center B transmit valuable and sensitive data, such as AI training models. The first and second communication devices support interconnection via 800G Ethernet MAC / PHY interfaces, thereby enabling long-distance fiber optic network transmission.

[0295] Referring again to Figure 20, the PHYsec technology provided in this application embodiment is deployed in the oDSP of the first optical module in the first communication device and the oDSP of the second optical module in the second communication device, thereby ensuring the security and reliability of the data transmitted between the intelligent computing center A and the intelligent computing center B.

[0296] The processing flow of the oDSP (i.e., the encryption side) in the first optical module is illustrated in Figure 21. An 800GE code block stream (each code block is 257 bits) is round-routing (RR) to form eight instance code block streams, each 100GE in size. Each 100GE instance code block stream is mapped using GMP to insert AM / PAD / OH (where the security information of the PAD portion is protected by error correction code encoding) to form a 5140-column * 128-row block frame. The security algorithm supports AES-GCM, and the encryption scope includes the payload field and the OH field of the block frame. Finally, the four block frame streams are interleaved to obtain the line frame stream. The line frame stream is then encoded using OFEC or CFEC, and further processed by the PMA layer to transmit the optical signal.

[0297] The processing flow of the oDSP (i.e., the decryption side) in the second optical module is illustrated in Figure 22. After receiving the physical layer bitstream, the PMA layer of the oDSP in the second optical module processes the physical layer bitstream at the PMA layer, and then performs OFEC or CFEC decoding to obtain the line frame stream. The line frame stream is then deinterleaved to obtain 8 block frame streams. For any block frame in the block frame stream, the AM field and PAD field in the block frame are detected to extract the RS error correction code and security information in the PAD field. Based on the RS error correction code, the security information in the PAD field is corrected to extract KI, IV, and AT from the security information. Then, the integrity of the data in the block frame is checked, and the data in the block frame is decrypted.

[0298] It should be noted that in the scenario shown in Figure 20, the processes shown in Figures 21 and 22 simultaneously implement confidentiality protection and integrity protection for the block frames. Optionally, in the scenario shown in Figure 20, only integrity protection can be implemented for the block frames, without confidentiality protection. Alternatively, confidentiality protection can be omitted, but integrity protection can be implemented.

[0299] It should be noted that the scenarios or processes shown in Figures 13 to 22 are for illustrative purposes only and do not constitute a limitation on the embodiments shown in Figure 2 or Figure 12.

[0300] In summary, the embodiments of this application provide a security protection method. In the security protection method provided by the embodiments of this application, a first communication device acquires a code block stream, then determines multiple block frames based on the code block stream, carries security information in the PAD field of the block frame, and carries code blocks processed based on the security information in the payload field of the block frame, so as to realize the security protection of code blocks in the code block stream.

[0301] On the one hand, since the code block stream is obtained by the first communication device processing the MAC frame stream at the physical layer, this application provides a physical layer security (PHYSec) technology to solve the problems existing in MACSec technology. PHYSec technology can be understood as encrypting the data sent from the sender to the receiver at the physical layer. It utilizes the native physical layer mechanism to carry protocol parameters, thus avoiding the need to carry at least 28 bytes of parameters in each MAC frame. Furthermore, it can also protect information other than user data.

[0302] On the other hand, in the scenario where the optical module in the first communication device is a high-speed coherent optical module, after acquiring the code block stream, the high-speed coherent optical module can map the code block stream into multiple block frames through a generic mapping procedure (GMP). Therefore, the PHYSec technology provided in this application embodiment can be applied to high-speed coherent optical modules.

[0303] On the other hand, in OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology, the block frame obtained by the optical module through GMP mapping includes an alignment marker (AM) field, a padding (PAD) field, and an overhead (OH) field. The PAD field does not carry any information; therefore, in these technologies, the PAD field value is usually set to all zeros by default. Based on this, in this embodiment, to improve the applicability of the PHYsec scheme provided, security information is carried in the PAD field of the block frame. Thus, the PHYsec technology provided in this embodiment can be applied to any of the OIF 800G ZR technology, Open ZR+ technology, Open ROADM technology, or 800GE ER1-20 / ER1 technology.

[0304] On the other hand, in the PHYSec technology provided in this application embodiment, in some scenarios, such as poor channel quality, the probability of uncorrectable codewords appearing during forward error correction (FEC) encoding of security information on the line side is relatively high. In such scenarios, if the security information is erroneous, it will lead to errors in the security information, which in turn will prevent the decoding side from correctly reconstructing all code blocks in the block frame, resulting in a significant increase in the frame loss rate. Based on this, in this application embodiment, when it is necessary to increase the protection of security information, the PAD field may not only include the security information, but may also further include error correction codes for the security information or at least a redundant copy of security information (i.e., redundant backup of the security information) to achieve the protection of the security information.

[0305] In cases where the PAD field includes a security information error correction code, the subsequent second communication device, upon receiving a block frame, can correct the security information based on this error correction code to obtain the correct security information, thus avoiding the inability to reconstruct the code block stream due to security information errors. This ensures data transmission security while improving data transmission reliability.

[0306] When the PAD field includes at least one redundant security information, the subsequent second communication device can compare multiple security information sets upon receiving a block frame to select the correct one. This avoids the inability to reconstruct the code block stream due to incorrect security information, thus improving data transmission reliability while ensuring data transmission security.

[0307] The effects of the technical solutions provided in this application embodiment are further illustrated below using Figures 23 and 24 as examples.

[0308] Figure 23 is a comparative diagram of different encryption and decryption technologies provided in an embodiment of this application. As shown in Figure 23, for a MAC frame stream processed at the data link layer, if MACSec technology is implemented at the MAC layer, the confidentiality of the user data carried in the payload field of the MAC frame can be protected, but the information carried in the frame header of the MAC frame cannot be protected. However, in the PHYSec technology provided in this embodiment, the information carried in both the payload field and the frame header of the MAC frame can be protected simultaneously.

[0309] Figure 24 is a comparative diagram of different encryption and decryption technologies provided in an embodiment of this application. As shown in Figure 24, if MACSec technology is implemented at the MAC layer for the MAC frame stream, additional overhead of the MAC frame is required because encrypted information needs to be carried in the MAC frame. Furthermore, when the frame length of the MAC frame is relatively small, the proportion of additional overhead of the MAC frame due to MACSec technology is higher, thus having a greater impact on user bandwidth. In contrast, the PHYSec technology provided in this embodiment does not require additional overhead of the MAC frame.

[0310] Figure 25 is a schematic diagram of a security protection device provided in an embodiment of this application. This security protection device is applied to the first communication device shown in Figure 1. As shown in Figure 25, the security protection device 2500 includes an acquisition module 2501 and a determination module 2502. For example, when the security protection method provided in this embodiment is applied to the first optical module 12 shown in Figure 1, the security protection device 2500 is typically deployed in the first optical module 12; that is, the security protection device is the first security protection device in Figure 1, thereby providing a PHYSec technology implemented in the first optical module 12.

[0311] The acquisition module 2501 is used to acquire the code block stream, which includes multiple code blocks; the specific implementation method can be referred to step 201 in the embodiment of Figure 2.

[0312] The determining module 2502 is used to determine multiple block frames based on the code block stream. Each block frame includes a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes code blocks processed based on the security information. The block frame size is M×N bits, where M and N are both positive integers greater than 1. For a specific implementation, refer to step 202 in the embodiment shown in Figure 2.

[0313] In some embodiments, the PAD field may also include an error correction code for security information; or, the PAD field may include at least one redundant copy of security information.

[0314] In some embodiments, the security information includes at least one of the following: key index KI, frame number, or authentication tag AT;

[0315] Wherein, KI is used to indicate the key for processing the block frame, the frame number is used to generate the initial vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

[0316] In some embodiments, the block frame also includes an overhead (OH) field;

[0317] The encryption scope of the block frame includes the payload field, or the encryption scope includes both the payload field and the OH field.

[0318] In some embodiments, security information includes first information;

[0319] The first information is used to instruct the other block frame to implement a security protection mode, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to instruct a mode that does not implement security protection for the other block frame.

[0320] In some embodiments, security information includes first information;

[0321] The first information is the first value, which indicates that neither confidentiality nor integrity protection is implemented; or,

[0322] The first information is the second value, which is used to indicate that confidentiality protection is implemented, but integrity protection is not; or,

[0323] The first piece of information is the third value, which is used to indicate that confidentiality protection is not implemented, but integrity protection is implemented; or,

[0324] The first piece of information is the fourth value, which is used to indicate that confidentiality and integrity protection are implemented.

[0325] In some embodiments, the first information includes a first sub-information and a second sub-information, wherein the first sub-information is used to indicate whether confidentiality protection is implemented for the other block frame and the second sub-information is used to indicate whether integrity protection is implemented for the other block frame.

[0326] Wherein, the first sub-information is the first sub-value, which is used to indicate that the other party's block frame does not implement confidentiality protection, or the first sub-information is the second sub-value, which is used to indicate that the other party's block frame implements confidentiality protection;

[0327] The second sub-information is the third sub-value, which is used to indicate that the other party's block frame does not implement integrity protection; or, the second sub-information is the fourth sub-value, which is used to indicate that the other party's block frame implements confidentiality protection.

[0328] In some embodiments, the security information further includes second information and third information, wherein the second information is used to instruct the other party's block frame to implement an algorithm for confidentiality protection, and the third information is used to instruct the other party's block frame to implement an algorithm for integrity protection.

[0329] In some embodiments, the security information further includes fourth information, which indicates the version number of the physical layer security PHYsec technology, which is a technology for determining multiple block frames based on a code block stream.

[0330] In some embodiments, the security information also includes a key suite type (CST), which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled.

[0331] CST is the fifth value, used to indicate that FlexOsec technology is disabled.

[0332] In some embodiments, M is 128 and N is 5140;

[0333] Security information is carried in bytes 21 to 52 of the PAD field.

[0334] In some embodiments, the plurality of block frames includes a first block frame and a second block frame, wherein the second block frame is the block frame following the first block frame, and the security information in the first block frame is used to protect the confidentiality of the second block frame.

[0335] In some embodiments, the plurality of block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the block frame following the third block frame, and the security information in the fourth block frame is used to protect the integrity of the third block frame.

[0336] In some embodiments, the acquisition module is used for:

[0337] Obtain the initial code block stream, the size of which is P × 100 gigages (GE), where P is an integer greater than 0;

[0338] The initial code block stream is divided into at least one instance code block stream, and the size of the instance code block stream is 100GE;

[0339] Among them, the code block stream is the instance code block stream.

[0340] In some embodiments, the apparatus further includes an interlacing module for:

[0341] Interleave the block frames determined by at least one instance code block stream to obtain a line frame stream;

[0342] The line frame stream is converted into an optical signal to be sent to a second communication device in the Ethernet.

[0343] It should be noted that the security protection device provided in the above embodiments is only illustrated by the division of the above functional modules when processing data. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the security protection device provided in the above embodiments and the security protection method embodiment shown in Figure 2 belong to the same concept, and the specific implementation process can be found in the method embodiment, which will not be repeated here.

[0344] Figure 26 is a schematic diagram of a security protection device provided in an embodiment of this application. This security protection device is applied to the second communication device shown in Figure 1. As shown in Figure 26, the security protection device 2600 includes an acquisition module 2601 and a processing module 2602. For example, when the security protection method provided in this embodiment is applied to the second optical module 22 shown in Figure 1, the security protection device 2600 is typically deployed in the second optical module 22; that is, the security protection device is the second security protection device in Figure 1, thereby providing a PHYSec technology implemented in the second optical module 22.

[0345] The acquisition module 2601 is used to acquire multiple block frames. The block frame includes a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes a code block processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1. For specific implementation, refer to step 801 in the embodiment of Figure 8.

[0346] The decryption module 2602 is used to process multiple block frames based on security information in multiple block frames. For a specific implementation, refer to step 802 in the embodiment shown in Figure 8.

[0347] In some embodiments, the PAD field further includes an error correction code for security information; the method further includes: a second communication device correcting the security information based on the error correction code; or...

[0348] The PAD field includes at least one redundant security information, and the method further includes: the second communication device determining security information for processing block frames based on the at least one redundant security information.

[0349] In some embodiments, the security information includes at least one of the following: key index KI, frame number, or authentication tag AT;

[0350] Wherein, KI is used to indicate the key for processing the block frame, the frame number is used to generate the initial vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

[0351] In some embodiments, the block frame also includes an overhead (OH) field;

[0352] The encryption scope of the block frame includes the payload field, or the encryption scope includes both the payload field and the OH field.

[0353] In some embodiments, security information includes first information;

[0354] The first information is used to instruct the other block frame to implement a security protection mode, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to instruct a mode that does not implement security protection for the other block frame.

[0355] In some embodiments, security information includes first information;

[0356] The first information is the first value, which indicates that neither confidentiality nor integrity protection is implemented; or,

[0357] The first information is the second value, which is used to indicate that confidentiality protection is implemented, but integrity protection is not; or,

[0358] The first piece of information is the third value, which is used to indicate that confidentiality protection is not implemented, but integrity protection is implemented; or,

[0359] The first piece of information is the fourth value, which is used to indicate that confidentiality and integrity protection are implemented.

[0360] In some embodiments, the first information includes a first sub-information and a second sub-information, wherein the first sub-information is used to indicate whether confidentiality protection is implemented for the other block frame and the second sub-information is used to indicate whether integrity protection is implemented for the other block frame.

[0361] The first sub-information is the first sub-value, which is used to indicate that the other party's block frame does not implement confidentiality protection; or, the first sub-information is the second sub-value, which is used to indicate that the other party's block frame implements confidentiality protection.

[0362] The second sub-information is the third sub-value, which is used to indicate that the other party's block frame does not implement integrity protection; or, the second sub-information is the fourth sub-value, which is used to indicate that the other party's block frame implements confidentiality protection.

[0363] In some embodiments, the security information further includes second information and third information, wherein the second information is used to instruct the other party's block frame to implement an algorithm for confidentiality protection, and the third information is used to instruct the other party's block frame to implement an algorithm for integrity protection.

[0364] In some embodiments, the security information further includes fourth information, which indicates the version number of the physical layer security PHYsec technology, which is a technology for determining multiple block frames.

[0365] In some embodiments, the security information also includes a key suite type (CST), which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled.

[0366] CST is the fifth value, used to indicate that FlexOsec technology is disabled.

[0367] In some embodiments, M is 128 and N is 5140;

[0368] Security information is carried in bytes 21 to 52 of the PAD field.

[0369] In some embodiments, the plurality of block frames includes a first block frame and a second block frame, wherein the second block frame is the block frame following the first block frame;

[0370] The processing module is used for: the second communication device to decrypt the data in the second block frame based on the security information in the first block frame.

[0371] In some embodiments, the plurality of block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the block frame following the third block frame;

[0372] The processing module is used for: the second communication device to perform integrity verification on the data in the third block frame based on the security information in the fourth block frame.

[0373] In some embodiments, Ethernet further includes a first communication device;

[0374] The acquisition module is used to: receive optical signals from the first communication device; process the optical signals to obtain a line frame stream; and perform deinterleaving processing on the line frame stream to obtain at least one block frame stream, the size of which is 100GE and includes multiple block frames.

[0375] It should be noted that the security protection device provided in the above embodiments is only illustrated by the division of the above functional modules when processing data. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the security protection device provided in the above embodiments and the security protection method embodiment shown in Figure 12 belong to the same concept, and the specific implementation process can be found in the method embodiment, which will not be repeated here.

[0376] Figure 27 is a schematic diagram of a communication device provided in an embodiment of this application. This communication device can be the first communication device or the second communication device described in the foregoing embodiments. As shown in Figure 27, the communication device includes at least one processor 2701.

[0377] The processor 2701 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program in this application.

[0378] In a specific implementation, as one embodiment, the communication device may include multiple processors, such as processors 2701 and 2705 shown in FIG. 27. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0379] In a specific implementation, as one embodiment, the communication device may further include a communication bus 2702.

[0380] The communication bus 2702 may include a path for transmitting information between the aforementioned components.

[0381] In a specific implementation, as one embodiment, the communication device may also include a memory 2703.

[0382] Memory 2703 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 2703 may exist independently and be connected to processor 2701 via communication bus 2702. Memory 2703 may also be integrated with processor 2701.

[0383] The memory 2703 stores program code for executing the scheme of this application, and its execution is controlled by the processor 2701. The processor 2701 executes the program code stored in the memory 2703. The program code may include one or more software modules. The foregoing embodiments can use the processor 2701 and one or more software modules in the program code in the memory 2703 to determine the data used for application development.

[0384] In a specific implementation, as one embodiment, the communication device may also include at least one communication interface 2704.

[0385] Communication interface 2704, using any transceiver-like device, is used to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. For example, communication interface 2704 includes an optical module.

[0386] In a specific implementation, as one embodiment, the communication device may further include an output device 2706 and an input device 2707. The output device 2706 communicates with the processor 2701 and can display information in various ways. For example, the output device 2706 may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 2707 communicates with the processor 2701 and can receive user input in various ways. For example, the input device 2707 may be a mouse, a keyboard, a touchscreen device, or a sensing device, etc.

[0387] The aforementioned communication device can be a general-purpose communication device or a dedicated communication device. In specific implementations, the communication device can be a network device such as a switch or router. This application does not limit the type of communication device.

[0388] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0389] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, not to describe a specific order of objects, and should not be construed as indicating or implying relative importance.

[0390] In the description of the embodiments in this application, unless otherwise stated, "at least one" means one or more. "More than one" means two or more.

[0391] A references B, which means that A is the same as B or A is a simple variation of B.

[0392] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that there are three possible relationships. For example, A and / or B means: A exists alone, A and B exist simultaneously, or B exists alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0393] Optionally, in the above embodiments, all or part of the implementation is carried out by software, hardware, firmware, or any combination thereof. Optionally, when implemented using software, it is implemented in the form of a computer program product, which is implemented in whole or in part. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Optionally, the computer instructions are stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. Optionally, the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. Alternatively, the available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video disks (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0394] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A security protection method, characterized in that, The method is applied to a first communication device in an Ethernet network; the method includes: The first communication device acquires a code block stream, the code block stream comprising multiple code blocks; The first communication device determines multiple block frames based on the code block stream. Each block frame includes a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes code blocks processed based on the security information. The size of each block frame is M×N bits, where M and N are both positive integers greater than 1.

2. The method as described in claim 1, characterized in that, The PAD field also includes the error correction code for the security information; or... The PAD field includes at least one redundant copy of the security information.

3. The method as described in claim 1 or 2, characterized in that, The security information includes at least one of the following: key index KI, frame number, or authentication tag AT; Wherein, KI is used to indicate the key for processing the block frame, the frame number is used to generate the initial vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

4. The method according to any one of claims 1-3, characterized in that, The block frame also includes an overhead (OH) field; The encryption range of the block frame includes the payload field, or the encryption range includes the payload field and the OH field.

5. The method according to any one of claims 1-4, characterized in that, The security information includes first information; The first information is used to indicate a mode in which security protection is implemented for the block frame, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to indicate a mode in which no security protection is implemented for the block frame.

6. The method according to any one of claims 1-5, characterized in that, The security information includes first information; The first information is a first value, which indicates that neither confidentiality protection nor integrity protection is implemented; or, The first information is a second value, which is used to indicate that confidentiality protection is implemented but integrity protection is not; or, The first information is a third value, which indicates that confidentiality protection is not implemented, but integrity protection is implemented; or, The first information is the fourth value, which is used to indicate that confidentiality protection and integrity protection are implemented.

7. The method as described in claim 5 or 6, characterized in that, The first information includes a first sub-information and a second sub-information. The first sub-information is used to indicate whether to implement confidentiality protection for the block frame, and the second sub-information is used to indicate whether to implement integrity protection for the block frame. Wherein, the first sub-information is a first sub-value, which is used to indicate that confidentiality protection is not implemented for the block frame; or, the first sub-information is a second sub-value, which is used to indicate that confidentiality protection is implemented for the block frame. The second sub-information is a third sub-value, which is used to indicate that no integrity protection is implemented for the block frame; or, the second sub-information is a fourth sub-value, which is used to indicate that confidentiality protection is implemented for the block frame.

8. The method as described in any one of claims 5-7, characterized in that, The security information also includes second information and third information, wherein the second information is used to indicate an algorithm for implementing confidentiality protection for the block frame, and the third information is used to indicate an algorithm for implementing integrity protection for the block frame.

9. The method according to any one of claims 1-8, characterized in that, The security information also includes a fourth piece of information, which is used to indicate the version number of the physical layer security PHYsec technology, which refers to the technology of determining the plurality of block frames based on the code block stream.

10. The method according to any one of claims 1-9, characterized in that, The security information also includes a key suite type (CST), which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled. CST is the fifth value, used to indicate that the FlexOsec technology is not enabled.

11. The method according to any one of claims 1-10, characterized in that, M is 128, and N is 5140; The security information is carried in bytes 21 to 52 of the PAD field.

12. The method according to any one of claims 1-11, characterized in that, The plurality of block frames includes a first block frame and a second block frame, wherein the second block frame is the block frame following the first block frame, and the security information in the first block frame is used to protect the confidentiality of the second block frame.

13. The method according to any one of claims 1-12, characterized in that, The plurality of block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the block frame following the third block frame, and the security information in the fourth block frame is used to protect the integrity of the third block frame.

14. The method according to any one of claims 1-13, characterized in that, The first communication device acquires the code block stream, including: The first communication device acquires an initial code block stream, the size of which is P × 100 gigages (GE), where P is an integer greater than 0. The first communication device divides the initial code block stream into at least one instance code block stream, the size of which is 100GE; Wherein, the code block stream is the instance code block stream.

15. The method as described in claim 14, characterized in that, After the first communication device determines multiple block frames based on the code block stream, the method further includes: The first communication device interleaves the block frames determined by the at least one instance code block stream to obtain a line frame stream; The first communication device converts the line frame stream into an optical signal to send the optical signal to the second communication device in the Ethernet.

16. A security protection method, characterized in that, The method is applied to a second communication device in an Ethernet network; the method includes: The second communication device acquires multiple block frames, each block frame including a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes a code block processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1. The second communication device processes the plurality of block frames based on the security information in the plurality of block frames.

17. The method as described in claim 16, characterized in that, The PAD field also includes an error correction code for the security information; the method further includes: the second communication device correcting the security information based on the error correction code; or... The PAD field includes at least one redundant copy of the security information, and the method further includes: the second communication device determining security information for processing the block frame based on the at least one redundant copy of the security information.

18. The method as described in claim 16 or 17, characterized in that, The security information includes at least one of the following: key index KI, frame number, or authentication tag AT; Wherein, KI is used to indicate the key for processing the block frame, the frame number is used to generate the initial vector IV for processing the block frame, and AT is used to indicate the integrity check value (ICV) of the data in the block frame.

19. The method according to any one of claims 16-18, characterized in that, The block frame also includes an overhead (OH) field; The encryption range of the block frame includes the payload field, or the encryption range includes the payload field and the OH field.

20. The method according to any one of claims 16-19, characterized in that, The security information includes first information; The first information is used to indicate a mode in which security protection is implemented for the block frame, the security protection including at least one of confidentiality protection or integrity protection; or, the first information is used to indicate a mode in which no security protection is implemented for the block frame.

21. The method according to any one of claims 16-20, characterized in that, The security information includes first information; The first information is a first value, which indicates that neither confidentiality protection nor integrity protection is implemented; or, The first information is a second value, which is used to indicate that confidentiality protection is implemented but integrity protection is not; or, The first information is a third value, which indicates that confidentiality protection is not implemented, but integrity protection is implemented; or, The first information is the fourth value, which is used to indicate that confidentiality protection and integrity protection are implemented.

22. The method as described in claim 20 or 21, characterized in that, The first information includes a first sub-information and a second sub-information. The first sub-information is used to indicate whether to implement confidentiality protection for the block frame, and the second sub-information is used to indicate whether to implement integrity protection for the block frame. The first sub-information is a first sub-value, which is used to indicate that no confidentiality protection is implemented for the block frame; or, the first sub-information is a second sub-value, which is used to indicate that confidentiality protection is implemented for the block frame. The second sub-information is a third sub-value, which is used to indicate that no integrity protection is implemented for the block frame; or, the second sub-information is a fourth sub-value, which is used to indicate that confidentiality protection is implemented for the block frame.

23. The method according to any one of claims 20-22, characterized in that, The security information also includes second information and third information, wherein the second information is used to indicate an algorithm for implementing confidentiality protection for the block frame, and the third information is used to indicate an algorithm for implementing integrity protection for the block frame.

24. The method according to any one of claims 16-23, characterized in that, The security information also includes a fourth piece of information, which indicates the version number of the physical layer security PHYsec technology, the PHYsec technology being the technology for determining the plurality of block frames.

25. The method according to any one of claims 16-24, characterized in that, The security information also includes a key suite type (CST), which indicates whether the Flexible Optical Transport Network Layer Security (FlexOsec) technology is enabled. CST is the fifth value, used to indicate that the FlexOsec technology is not enabled.

26. The method according to any one of claims 16-25, characterized in that, M is 128, and N is 5140; The security information is carried in bytes 21 to 52 of the PAD field.

27. The method according to any one of claims 16-26, characterized in that, The plurality of block frames includes a first block frame and a second block frame, wherein the second block frame is the block frame following the first block frame; The second communication device processes the plurality of block frames based on the security information in the plurality of block frames, including: The second communication device decrypts the data in the second block frame based on the security information in the first block frame.

28. The method as described in any one of claims 16-27, characterized in that, The plurality of block frames include a third block frame and a fourth block frame, wherein the fourth block frame is the block frame following the third block frame; The second communication device processes the plurality of block frames based on the security information in the plurality of block frames, including: The second communication device performs integrity verification on the data in the third block frame based on the security information in the fourth block frame.

29. The method according to any one of claims 16-28, characterized in that, The Ethernet also includes a first communication device; The second communication device acquires multiple block frames, including: The second communication device receives an optical signal from the first communication device; The second communication device processes the optical signal to obtain a line frame stream; The second communication device performs deinterleaving processing on the line frame stream to obtain at least one block frame stream, the size of which is 100GE, and the block frame stream includes the plurality of block frames.

30. A safety protection device, characterized in that, The device is used in a first communication device in an Ethernet network; the device includes: The acquisition module is used to acquire a code block stream, wherein the code block stream includes multiple code blocks; A determining module is used to determine multiple block frames based on the code block stream. The block frame includes a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes a code block processed based on the security information. The size of the block frame is M×N bits, where M and N are both positive integers greater than 1.

31. A safety protection device, characterized in that, The device is used as a second communication device in an Ethernet network; the device includes: An acquisition module is used to acquire multiple block frames, each block frame including a padding PAD field and a payload field. The PAD field includes security information, and the payload field includes a code block processed based on the security information. The size of each block frame is M×N bits, where M and N are both positive integers greater than 1. The processing module is used to process the multiple block frames based on the security information in the multiple block frames.

32. A communication device, characterized in that, The communication device includes a processor; The processor is configured to execute instructions to cause the communication device to perform the method as described in any one of claims 1-15 or 16-29.

33. A communication system, characterized in that, The communication system includes a first communication device and a second communication device; The first communication device is used to implement the security protection method according to any one of claims 1-15; The second communication device is used to implement the security protection method according to any one of claims 16-29.

34. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a communication device, cause the communication device to perform the method as described in any one of claims 1-15 or 16-29.

Images