CN115865499A - Payload compatible encryption system of military and civil integration optical transmission network based on slices - Google Patents

Abstract

The invention discloses a slice-based payload compatible encryption system for a civil-military fusion optical transmission network, and belongs to the technical field of optical communication. The system comprises a military OTN module, a civil OTN module and a military-civil fusion OTN compatible encryption module; the military and civil integration OTN compatible encryption module comprises a civil-to-military service decapsulation module, a civil change-over switch, an encryption module, a civil-to-military service encapsulation module, a military-to-civil service encapsulation module, a military change-over switch, a military-to-civil service decapsulation module and a control module. The invention protects the safety of the optical transmission layer by OTN encryption carried out from the optical layer end to end, can meet the safety requirement and effectively realize the backward compatibility of the network.

Description

Payload compatible encryption system of military and civil integration optical transmission network based on slices

Technical Field

The invention relates to the technical field of optical communication, in particular to a slice-based payload compatible encryption system for a civil-military fusion optical transport network.

Background

At present, with the expansion of the laying range and the increase of functions of the optical network, the optical network can provide wider services for users. The optical network is in an open state on a physical layer, and for most optical cable lines laid outdoors, almost no protective measures for ensuring the safety of the physical layer of the optical network are taken except for periodic line patrol of maintenance personnel. The special working environment, the lack of supervision and protection means and the increasingly open access platform of the optical network all cause the security of the optical network at a plurality of places such as a user end, a transmission link, a switching node and the like to be seriously threatened. Since the optical transport network carries a large amount of information transmission tasks, these security threats can cause loss and destruction of a large amount of user data and serious disasters to the society even if the service destruction time caused by attacks is short.

The Optical Transport Network (OTN) defined by the itu g.709 standard is a transport framework for next generation 100G + metro and core optical transport networks of multi-service, multi-rate aggregation layer worldwide, capable of supporting multiplexing, transport and switching of almost all customer types and protocols, including Constant Bit Rate (CBR) customers focusing on data centers from ethernet, SONET/SDH, fibre channel up to 1Gbps to 100Gbps data rates, etc., and is considered to have high confidentiality and security. Unlike other layer two (L2) and layer three (L3) network layer encryption techniques, OTN encryption techniques are independent of customer type, protocol or rate, providing a single encryption solution for network operators to satisfy all customer types and protocols end-to-end services in an optical transport network. Implementing L3 encryption certainly involves a cost, power consumption and complexity tradeoff. But in all cases the cost and increased power consumption caused by encryption traffic is related to the hardware implementation.

Since neither the underlying payload nor the existing OTN frame is padded or expanded in any way in order to facilitate encryption or authentication, the use of OTN encryption to secure the optical transport layer does not come at the expense of losing fiber bandwidth. OTN legacy encryption is directed to transport payload frames — optical path payload units (OPUk). At present, with the development of novel services with small bandwidth and a large number of private network clients, simple and rapid bandwidth flexible adjustment is required, and the traditional OTN technology cannot provide efficient bearer services for such services. In this context, slice-based Optical Service Unit (OSU) technology has emerged. In addition, some OTN processing chip solutions on the market today can provide support for the advanced encryption standard 256-bit block cipher (AES-256), and the encryption block cipher and authentication scheme used varies from application to application. However, at present, there is no OTN compatible encryption method design considering the OSU in a network scenario of military and civil integration. In summary, the present invention considers payload encryption of the latest sliced OTN technology in an optical transport network integrated by military and civilian, and realizes backward compatibility between the novel optical channel protection technology and the conventional protection technology.

Disclosure of Invention

Aiming at the problems in the background technology, the invention provides a slice-based payload compatibility encryption system for a military and civil integration optical transmission network, which aims to solve the problem that the latest slice OTN technical system is applied in the existing military and civil integration optical transmission network and the payload is encrypted, so that the system has the advantages of high safety, low delay and backward compatibility.

The technical solution of the present invention is achieved in that,

a slice-based payload compatible encryption system for a civil-military fusion optical transport network comprises a military OTN module, a civil OTN module and a civil-military fusion OTN compatible encryption module; the military and civil integration OTN compatible encryption module comprises a civil-to-military service decapsulation module, a compatible change-over switch, a compatible encryption module, a civil-to-military service encapsulation module, a compatible change-over switch, a civil-to-military service decapsulation module, a compatible decryption module and a control module;

the civil army service decapsulation module respectively carries out OPU, ODU and OTU overhead and payload part processing on civil 100G standard OTN layer by layer;

the civil-to-military service encapsulation module is used for carrying out standard military service adaptation:

the control module is used for encrypted overhead processing and key generation and negotiation;

the military service-to-civil service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer;

the encryption module is an encryption process carried out in a payload part of the OSU under the overhead control of the OSU;

the military-to-civilian service encapsulation module is used for carrying out standard civil service adaptation;

the decryption module is used for reversely decrypting to the encrypted parts of the OPU, the ODU and the OTU layer by layer;

military OTN module and civilian OTN module realize compatible encryption through army and civilian integration module, and wherein civilian specific process of changing to military is:

the civil army service decapsulation module performs OPU, ODU and OTU overhead and payload part processing on a civil 100G standard OTN layer by layer, the obtained OPU, ODU and OTU overhead part is controlled by the control module, and the compatible switch determines whether the OPU, ODU and OTU payload part needs to be encrypted or not; if the payload part of the OPU/ODU/OTU does not need to be encrypted, standard service adaptation is directly carried out through a civil army service encapsulation module; if encryption is needed, the encryption module encrypts payload parts of the OPU, the ODU and the OTU and then performs service adaptation;

the specific process of converting military use into civil use is as follows:

the military service-to-civilian service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer, the obtained OSU overhead part controls the compatible change-over switch through the control module to determine whether OSU payload decryption processing is needed or not, and if not, civil service adaptation is directly carried out; if necessary, the data is reversely decrypted to the OPU, ODU and OTU encryption parts layer by layer through a decryption module, and standard civil service adaptation is carried out.

The frame architecture of the 100GOTN comprises an OTN source node and a destination node which are fused by military and civilian,

the OTN source node of the military and civil fusion comprises an overhead part of an OSUk, a payload part of the OSUk and a forward error correction coding part of the OTUk; after the encryption and authentication processes, the receiving end receives the encrypted or unencrypted data frame in the payload part of the OSUk, and then recalculates the FEC part of the OTUk;

OSUk payload encryption comprises an encrypted part and an unencrypted part; the rearranged packet comprises a head part and a tail part which encapsulate a safe packet header protocol; the ESP is responsible for executing the encryption action of the packet; wherein the header of the ESP includes a 4-byte security parameter factor field, a 4-byte sequence), an 8-byte authentication value, and a trailer of the ESP including a 16-byte integrity check value; where the SPI tells the receiving OTN to use the key to encrypt this packet.

Further, the specific implementation process of 100GOTN is as follows:

step 1, receiving an OTN frame;

step 2, judging whether the received OTN frame is a standard OTN frame or an OTN frame based on an OSU; if the OTN frame is a standard OTN frame, performing the step 3, and if the OTN frame is an OSU-based OTN frame, performing the step 4;

step 3, payload processing is carried out according to the standard OTN;

step 4, dividing OSU payload units of OTN frames based on OSUs into time slots with fixed bandwidth, and grouping the time slots into time slot blocks; and then selecting 2 or more time slot blocks for AES encryption, and finally generating an encrypted OTN frame by the encrypted and authenticated 2 or more time slot blocks.

Compared with the prior art, the invention has the advantages that:

the invention provides a high-flexibility and low-delay safe transmission method for the OTN ensuring the service type and the rate. The standard 100GOTN is compatible in the military and civil fused OTN, the slice-based OTN encryption is used for protecting the optical transmission layer, the existing layer (L1) transmission network and the service mode used nowadays can be fused, an emerging OTN architecture and brand-new, high-value and high-benefit services are supported, and the deployment flexibility is provided to the maximum extent.

Drawings

Fig. 1 is a schematic structural diagram of a system according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a frame structure of 100GOTN encryption based on slices according to the present invention.

Fig. 3 is a schematic diagram illustrating a slice encryption process based on 100GOTN according to the present invention.

Detailed Description

The invention is described in detail below with reference to the figures and specific embodiments.

The increased processing power requirements of encrypting/decrypting the OPUk payload and inserting/reading the authentication fields at the OTN layer are lower than at the L2 and L3 layers due to the limited buffering and more complex filtering hardware required. Furthermore, all network layer encryption techniques themselves add to the network latency, the size of which is related to the encryption payload frame size and implementation parameters including hardware architecture, cipher block size and key length, encryption mode, authentication mode, etc. The complexity of L1 layer for end-to-end management of secure transmissions is similar to L2 layer and significantly lower than L3 layer. Therefore, the invention concerns a compatible encryption method of the military and civil fused OTN on the L1 layer.

For the purpose of facilitating an understanding of the method of the present invention, the principle of the method of the present invention is described below.

When the traditional civil OTN is encrypted, the overhead is kept unchanged, and only the payload of the OPU is encrypted and combined. The frame structure of the existing military OTN is constructed as an OSU-based frame structure.

The encryption overhead of the OTN is borne by overhead idle bytes. The traditional OTN encryption overhead is the overhead byte of OPU/ODU/OUT, and the encryption overhead of the slice OTN is the overhead byte of OSU.

The encryption overhead of the OTN performs flow control on the encryption method, and may be configured by a network management center.

The network management center of the military OTN and the network management center of the civil OTN carry out necessary cooperative operation.

The OTN has inherent low delay characteristic, and the payload encryption algorithm of the OTN is specifically a classic AES algorithm. Delays below 180ns can be achieved for all OPUk frame sizes using AES-256 block ciphers, with delay increments of this size in common services enabling sufficient margin for the available end-to-end budget.

The L1 data encryption is carried out in the OTN integrated by military and civilian, the data security transmission can be effectively, efficiently and flexibly protected, the method is attractive to network operators and the JS field, and the service performance or the optical fiber transmission efficiency cannot be influenced.

Referring to fig. 1, the present invention is a slice-based carrier payload compatible encryption system for a civil-military fusion optical transport network, including a military OTN module, a civil OTN module, and a civil-military fusion OTN compatible encryption module; the system is characterized in that the army and civil fusion OTN compatible encryption module comprises a civil-to-military service decapsulation module, a compatible change-over switch, an encryption module, a civil-to-military service encapsulation module, a compatible change-over switch, a civil-to-military service decapsulation module, a decryption module and a control module;

the civil army transfer service decapsulation module respectively carries out OPU (optical fiber unit), ODU (optical data Unit) and OTU overhead and payload part processing on civil 100G standard OTN layer by layer;

the civil-to-military service encapsulation module is used for carrying out standard military service adaptation:

the control module is used for encrypted overhead processing and key generation and negotiation;

the military service-to-civil service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer;

the encryption module is an encryption process carried out in a payload part of the OSU under the overhead control of the OSU;

the military-to-civilian service encapsulation module is used for carrying out standard civil service adaptation;

the decryption module is used for reversely decrypting to the encrypted parts of the OPU, the ODU and the OTU layer by layer;

military OTN module and civilian OTN module realize compatible encryption through army and civilian integration module, and wherein civilian specific process of changing to military is:

the civil army service decapsulation module carries out OPU, ODU and OTU overhead and payload part processing on the civil 100G standard OTN layer by layer, and then the obtained OPU, ODU and OTU overhead parts are controlled through the control module; the compatible switch determines whether the payload parts of the OPU, the ODU and the OTU need to be encrypted or not; if the payload part of the OPU/ODU/OTU does not need to be encrypted, standard service adaptation is directly carried out through a civil army service encapsulation module; if encryption is needed, the encryption module encrypts payload parts of the OPU, the ODU and the OTU and then performs service adaptation;

the specific process of converting military use into civil use is as follows:

the military service-to-civilian service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer, the obtained OSU overhead part controls the compatible change-over switch through the control module to determine whether OSU payload decryption processing is needed or not, and if not, civil service adaptation is directly carried out; if necessary, the data is reversely decrypted to the OPU, ODU and OTU encryption parts layer by layer through a decryption module, and standard civil service adaptation is carried out.

Referring to fig. 2, the slicing-based 100GOTN frame architecture of the present invention includes an OTN source node and a destination node for military and civil fusion. Specifically, the transport frame architecture of the conventional OTN includes a positioning pointer, an optical path transport unit (OTU), an OPUk and an overhead portion of the ODUk, a payload portion of the OPU and a forward error correction coding (FEC) portion of the OTUk. The novel military and civil integration OTN comprises an overhead part of the OSUk, a payload part of the OSUk and a forward error correction coding (FEC) part of the OTUk, wherein after encryption and authentication processes, a receiving end receives encrypted or non-encrypted data frames in the payload part of the OSUk, and then recalculates the FEC part of the OTUk. The encryption based on the OSUk payload described in the present invention comprises an encrypted part and an unencrypted part. The rearranged packets include a header and a trailer that encapsulate a secure header protocol (ESP). The ESP is responsible for performing the encryption of the packets. Wherein the header of the ESP includes a 4-byte security parameter factor (SPI) field, a 4-byte Sequence (SEQ), an 8-byte authentication value (IV), and a trailer of the ESP including a 16-byte Integrity Check Value (ICV). Where the SPI tells the receiving OTN to use the key to encrypt this packet.

Referring to fig. 3, the slicing-based 100GOTN flowchart of the present invention first receives an OTN frame. Judging whether the frame is a standard OTN frame or an OSU-based OTN frame, if so, carrying out payload processing according to the standard OTN; if the latter, the OSU payload units of the frame are divided into slots of a fixed bandwidth and the slots are grouped into blocks of slots. And then selecting 2 or more time slot blocks for AES encryption, and finally generating an encrypted OTN frame by the encrypted and authenticated 2 or more time slot blocks.

In summary, the present invention realizes a payload encryption compatibility method based on a military and civil convergence optical transport network, which transparently performs node-to-node traversal for encrypted OTN services through the existing OTN-based transmission network, and performs a decryption process opposite to the encryption of the military OTN network at a destination node, that is, first adapts the OSU overhead of the OTN. Secondly, corresponding decryption operation is carried out through switch control, and then the service is adaptive and restored to the carried service. The general scheme of the army and civil fusion OTN compatible encryption security has backward compatibility with the traditional 100GOTN, thereby being seamlessly fused with the civil OTN network.

To sum up, the OTN security scheme for the J-min convergence only needs encryption/decryption at the source and destination nodes in the J-min convergence network. In addition, before the OTN layer service encryption is multiplexed into a higher-speed 100GOTN signal, the services from 1.25Gbps to 100Gbps can be encrypted, and the inherent expandability and flexibility of the G.709 standard are embodied. This level of configurability enables network operators to use new "pay-as-you-go" or "sub-wavelength" encrypted transport services, with traffic protection subdivided in the granularity of customer services, allowing users to rent secure lines starting from low traffic, which traffic grows over time, minimizing the obstacles to adopting new high-value secure transport services.

The optical transport layer security is guaranteed by conventional OTN to slice-based OTN encryption performed end-to-end at the optical layer. The general scheme of the slice-based military and civil fusion optical transport network compatible encryption comprises an encryption part, a decryption part and a control unit, wherein the encrypted OTN service can transparently pass through from node to node through the existing OTN, and is encrypted or decrypted at a source node and a destination node in the network; the method specifically comprises the following steps:

firstly, receiving an OTN frame, judging whether the OTN frame is a standard OTN frame or an OSU-based OTN frame, and if the OTN frame is the standard OTN frame, carrying out payload processing according to the standard OTN; if the time slot is the same as the time slot, dividing the OSU payload unit of the OTN frame into a time slot with fixed bandwidth, grouping the time slot into time slot blocks, and then selecting 2 or more time slot blocks to encrypt the AES encryption algorithm;

the control part mainly comprises overhead processing of AES encryption and key generation and negotiation.

Encrypting in a payload part of the OSU, wherein the overhead in the encryption process comprises the overhead before AES encryption and the negotiated overhead after the AES encryption; the encryption overhead of the OTN is borne by overhead idle bytes. The traditional OTN encryption overhead is the overhead byte of OPU/ODU/OUT, and the encryption overhead of the slice OTN is the overhead byte of OSU;

the encryption overhead of the OTN performs flow control on the encryption method, and may be configured by a network management center. The network management center of the military OTN and the network management center of the civil OTN carry out necessary cooperative control;

the OTN has inherent low delay characteristic, and the payload encryption algorithm of the OTN is specifically a classic AES algorithm. The encrypted and authenticated 2 or more time slot blocks finally generate an encrypted OTN frame; and it contains the traditional OTN source node and destination node;

further, the AES encryption process: firstly, adding a key to a plaintext at a source end, grouping the key into sub-bytes, performing line shift transformation and mixing data columns to add the key, performing key counting and multiplexing and final counting after adding the key, finally generating a ciphertext, transmitting the ciphertext to a destination end, and performing ciphertext decoding opposite to the source end.

The above description is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention.

Claims (3)

1. A payload compatible encryption system of a military and civil integration optical transport network based on slices comprises a military OTN module, a civil OTN module and a military and civil integration OTN compatible encryption module; the system is characterized in that the army and civil fusion OTN compatible encryption module comprises a civil-to-military service decapsulation module, a compatible change-over switch, a compatible encryption module, a civil-to-military service encapsulation module, a compatible change-over switch, a civil-to-military service decapsulation module, a compatible decryption module and a control module;

the civil army service decapsulation module respectively carries out OPU, ODU and OTU overhead and payload part processing on civil 100G standard OTN layer by layer;

the civil-to-military service encapsulation module is used for carrying out standard military service adaptation:

the control module is used for encrypted overhead processing and key generation and negotiation;

the military service-to-civil service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer;

the compatible encryption module is an encryption process carried out in a payload part of the OSU under the overhead control of the OSU;

the military-to-civilian service encapsulation module is used for carrying out standard civil service adaptation;

the compatible decryption module is used for reversely decrypting to the encryption parts of the OPU, the ODU and the OTU layer by layer;

for military use OTN module and civilian OTN module realize compatible the encryption through army and civilian integration module, and wherein civilian specific process that changes for military use is:

the civil army service decapsulation module performs OPU, ODU and OTU overhead and payload part processing on a civil 100G standard OTN layer by layer, and then the obtained OPU, ODU and OTU overhead part is controlled through a control module; the compatible switch determines whether the payload parts of the OPU, the ODU and the OTU need to be encrypted or not; if the payload part of the OPU/ODU/OTU does not need to be encrypted, standard service adaptation is directly carried out through a civil army service encapsulation module; if encryption is needed, the encryption module encrypts payload parts of the OPU, the ODU and the OTU and then performs service adaptation;

the specific process of converting military use into civil use is as follows:

the military service-to-civilian service decapsulation module respectively carries out OSU overhead and payload part processing on the military 100G slice OTN layer by layer, the obtained OSU overhead part controls the compatible change-over switch through the control module to determine whether OSU payload decryption processing is needed or not, and if not, civil service adaptation is directly carried out; and if necessary, reversely decrypting to the encryption parts of the OPU, the ODU and the OTU layer by layer through a decryption module, and then carrying out standard civil service adaptation.

2. The payload compatible encryption system for the slice-based civil-military-convergence optical transport network of claim 1, wherein the frame architecture of the 100G OTN comprises a civil-military-convergence OTN source node and a destination node,

the OTN source node of the military and civil fusion comprises an overhead part of an OSUk, a payload part of the OSUk and a forward error correction coding part of the OTUk; after the encryption and authentication processes, the receiving end receives the encrypted or unencrypted data frame in the payload part of the OSUk, and then recalculates the FEC part of the OTUk;

OSUk payload encryption comprises an encrypted part and an unencrypted part; the rearranged packet comprises a head part and a tail part which encapsulate a safe packet header protocol; the ESP is responsible for executing the encryption action of the packet; wherein the header of the ESP includes a 4-byte security parameter factor field, a 4-byte sequence), an 8-byte authentication value, and a trailer of the ESP including a 16-byte integrity check value; where the SPI tells the receiving OTN to use the key to encrypt this packet.

3. The system for encrypting the payload compatibility of the civil-military-convergence optical transport network based on the slice as claimed in claim 2, wherein the specific process of the slice encryption of the 100G OTN is as follows:

step 1, receiving an OTN frame;

step 2, judging whether the received OTN frame is a standard OTN frame or an OTN frame based on an OSU; if the OTN frame is a standard OTN frame, performing the step 3, and if the OTN frame is an OSU-based OTN frame, performing the step 4;

step 3, payload processing is carried out according to the standard OTN;

step 4, dividing OSU payload units of OTN frames based on OSUs into time slots with fixed bandwidth, and grouping the time slots into time slot blocks; and then selecting 2 or more time slot blocks for AES encryption, and finally generating an encrypted OTN frame by the encrypted and authenticated 2 or more time slot blocks.

Images