Physical-Layer Data Encryption for Bandwidth-Efficient Optical Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encryption technologies based on the MACSEC protocol occupy significant user service bandwidth, require high power consumption, and fail to encrypt source and destination MAC addresses, leading to security risks.
Innovation Solution
Implement encryption and decryption functions at the physical layer of optical modules or network devices, using alignment markers and encryption parameter sets to encrypt data flows, thereby reducing bandwidth overhead and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption technology based on MACSEC protocol is used at the MAC layer, then data confidentiality is improved, but user service bandwidth is occupied and power consumption increases
Solution Approach 1:
The patent moves the encryption function from the MAC layer to the physical layer, changing the dimensional position of the encryption operation. This allows encryption parameters to be transmitted through dedicated physical layer channels rather than occupying user service bandwidth at the MAC layer, thereby resolving the bandwidth occupation problem while maintaining confidentiality
Solution Approach 2:
The patent segments the data transmission into multiple independent data flows (N ciphertext data flows), each with its own alignment markers and encryption parameters. This segmentation allows parallel processing and transmission of encrypted data without interfering with the overall user service bandwidth, as each flow is independently managed at the physical layer
2Reliability
If MACSEC encryption is applied to each user frame, then data security is improved, but the amount of user data that can be sent in each user frame is reduced
Solution Approach 1:
By relocating encryption from the MAC layer to the physical layer, the patent changes the operational dimension of encryption. This allows encryption parameters to be handled at the physical layer without reducing the payload capacity of user frames at the MAC layer, thus maintaining both security and data volume
3Reliability
If MACSEC protocol is used for encryption, then data confidentiality is improved, but source MAC address and destination MAC address are not encrypted leading to security risks
Solution Approach 1:
The patent moves encryption to the physical layer where all bits including MAC addresses are processed uniformly. This dimensional change ensures that no address information is left unencrypted, as the physical layer encryption operates on the complete bit stream before MAC layer processing, thereby eliminating address information exposure while maintaining confidentiality
Solution Approach 2:
The physical layer encryption mechanism provides universal encryption for all data types including MAC addresses, not just user data. This multi-functional approach ensures comprehensive security coverage for all transmitted information, addressing the limitation of MACSEC which only encrypts user data but not address fields
Data Source
AI summary
This application provides a data transmission method, a communication apparatus, and a communication system. The method includes: generating N ciphertext data flows, where a first ciphertext data flow is any one of the N ciphertext data flows. The first ciphertext data flow includes at least two first alignment markers AMs, at least two encryption parameter sets, and at least two ciphertext data segments. One ciphertext data segment and one encryption parameter set are included between every two first AMs. The at least two first AMs are used for data alignment of the N ciphertext data flows. The method further includes sending the N ciphertext data flows. The data transmission method may be applied to a physical layer of an optical module or a network device.