WO2016184238A1 - 一种基于光传输网otn的密钥更新的方法、装置和系统 - Google Patents

一种基于光传输网otn的密钥更新的方法、装置和系统 Download PDF

Info

Publication number
WO2016184238A1
WO2016184238A1 PCT/CN2016/076501 CN2016076501W WO2016184238A1 WO 2016184238 A1 WO2016184238 A1 WO 2016184238A1 CN 2016076501 W CN2016076501 W CN 2016076501W WO 2016184238 A1 WO2016184238 A1 WO 2016184238A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
preset
information
decryption
encryption
Prior art date
Application number
PCT/CN2016/076501
Other languages
English (en)
French (fr)
Inventor
潘磊
王春光
杜凯
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016184238A1 publication Critical patent/WO2016184238A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present invention relates to, but is not limited to, an information security technology of an Optical Transport Network (OTN), and more particularly to a method, apparatus and system for key update based on an optical transport network OTN.
  • OTN Optical Transport Network
  • the OTN encrypted transmission system usually consists of two parts: an encryption module and a key management system.
  • the cryptographic module generally adopts the standard Advanced Encryption Standard (AES) encryption algorithm;
  • the key management system mainly consists of public key parameter configuration management, private key generation, public key operation processing module, and shared key negotiation acquisition module. And key lossless switching and other functional modules.
  • Key update is an essential function module in the key management system. To complete the key update in the OTN transmission system, two difficulties must be solved. The first is how to ensure the encryption end and the decryption end. Key consistency, the second is how to ensure that no service flash occurs during the replacement of new and old keys. But so far, the current key update technology can not solve the above two difficulties at the same time
  • the embodiment of the invention provides a method, a device and a system for key update based on an optical transport network OTN, which ensure that the key consistency between the encryption end and the decryption end is ensured, and the new and old key replacement process does not appear.
  • the service is flashed, and the service of the OTN device itself is not affected.
  • An embodiment of the present invention provides a method for updating a key based on an optical transport network OTN, where the method is applied to a single-board logic device of an encryption end, and the method includes:
  • the local key update information is sent to the decryption end through the preset transmission overhead channel;
  • the key update information of the local end includes key status information updated by the encryption end and an update preparation flag of the encryption end; the key status information updated by the encryption end is used to indicate that the encryption end is updated. After the different keys, different key status information corresponds to different keys;
  • the local configuration information is used to indicate that the card information of the encryption end has the key information and key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the board logic sent to the local end is used to indicate that the card information of the encryption end has the key information and key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the preset period has a length of a preset number of multiframes; and the preset condition is a start position of the first multiframe of the preset period.
  • the key status information updated by the encryption end is key configuration status information in the encryption end key configuration update message.
  • the transmission overhead channel preset by the encryption end is the same as the reception overhead channel of the decryption end; the preset reception overhead channel of the encryption end is the same as the transmission overhead channel of the decryption end.
  • the method is applied to a single board logic device at the decryption end, and the method includes:
  • the decryption terminal ready information is sent to the encryption end through the preset transmission overhead channel;
  • the encrypted end key update information transmitted by the encryption end is detected by a preset receiving channel in a preset period after the decryption terminal ready information is sent;
  • the decryption end determines, by the large number decision method, that the key state information updated by the encryption terminal and the key state information of the decryption end are consistent, and the next preset period satisfies the When the condition is preset, the updated key pair is sent by the encrypted end to the solution The confidential business information is decrypted.
  • the encryption end key update information includes key status information updated by the encryption end and an update preparation flag of the encryption end; the key status information updated by the encryption end is used to indicate different after the encrypted end is updated. Key, different key state information corresponding to different keys;
  • the local configuration information is used to indicate that the card software of the decryption end has configured the key information and the key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the board logic sent to the local end is used to indicate that the card software of the decryption end has configured the key information and the key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the preset period has a length of a preset number of multiframes; and the preset condition is a start position of the first multiframe of the preset period.
  • the receiving overhead channel preset by the decryption end is the same as the sending overhead channel of the encryption end; the preset transmission overhead channel of the decryption end is the same as the receiving overhead channel of the encryption end.
  • the determining, by the large number decision method, that the key state information updated by the encryption end is consistent with the key state information of the local end of the decryption end including:
  • the key state information updated by the encryption end and the key state information of the decryption end are detected in each of the preset periods The preset number of times;
  • Determining the encryption end update when the detection result of the preset ratio above the preset number of times indicates that the key state information updated by the encryption terminal is consistent with the key state information of the decryption end local
  • the key state information is consistent with the local key state information of the decryption end
  • An embodiment of the present invention provides a board logic device of an encryption end, where the apparatus includes: a detecting unit, a sending unit, and an encryption unit, where
  • the detecting unit is configured to detect, when a local configuration information is valid, detecting validity of the decryption terminal ready information received through the preset receiving overhead channel within a preset time period;
  • the sending unit is configured to, after determining that the decryption terminal ready information is valid within a preset period of time by the detecting unit, to the decryption end through a preset transmission overhead channel when the next preset period meets the preset condition Send the local key update information;
  • the encryption unit is configured to pass the updated key pair when the next preset period after the sending unit sends the key update information to the decryption end meets the preset condition
  • the service information sent to the decryption end is encrypted.
  • the embodiment of the present invention provides a single-board logic device of a decryption end, where the device includes: a detecting unit, a sending unit, a determining unit, and a decrypting unit, where
  • the detecting unit is configured to detect validity of the local configuration information; and detect, by the preset receiving channel, the transmission by the encrypted terminal in a preset period after the sending unit sends the decryption terminal ready information Encryption end key update information;
  • the sending unit is configured to: when the detecting unit detects that the local configuration information is valid, send the decryption terminal ready information to the encryption end by using a preset sending overhead channel;
  • the determining unit is configured to determine, by using a large number decision method, that the key state information updated by the encryption end is consistent with the local key state information of the decryption end when the preset period satisfies the preset condition;
  • the decrypting unit is configured to determine, by the determining unit, that the key state information updated by the encryption end and the key state information of the local end of the decryption end are consistent by the large number decision method, and the preset condition is satisfied in the next preset period. And decrypting, by the updated key, the service information sent by the encryption end to the decryption end.
  • the preset period has a length of a preset number of multiframes; and the preset condition is a start position of the first multiframe of the preset period.
  • the determining unit is configured to:
  • the key state information updated by the encryption end and the key state information of the decryption end are detected in each of the preset periods The preset number of times;
  • Determining the encryption end update when the detection result of the preset ratio above the preset number of times indicates that the key state information updated by the encryption terminal is consistent with the key state information of the decryption end local
  • the key state information is consistent with the local key state information of the decryption end
  • the embodiment of the present invention provides a system for key update based on an optical transport network OTN, where the system includes: a single board logic device of the encryption end and a single board logic device of the decryption end, where
  • the single board logic device of the encryption end is set to:
  • the local key update information is sent to the decryption end through the preset transmission overhead channel;
  • the key update information of the local end includes the key state information updated by the encrypted end and the update preparation flag of the encrypted end; the key state information updated by the encrypted end is used to indicate different secrets after the encrypted end is updated. Key, different key state information corresponds to different keys; and,
  • the board logic device of the decryption end is configured to send the decryption terminal ready information to the encryption end by using a preset transmission overhead channel when detecting that the local configuration information is valid;
  • the encrypted end key update information transmitted by the encryption end is detected through a preset receiving channel;
  • the preset period meets the preset condition, after determining that the key state information updated by the encryption end and the key state information of the decryption end are consistent by the large number decision method, the preset is satisfied in the next preset period. In the condition, the service information sent by the encrypted end to the decryption end is decrypted by the updated key.
  • the embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the above method.
  • the embodiment of the invention provides a method, a device and a system for key update based on an optical transport network OTN, which ensure that the key consistency between the encryption end and the decryption end is ensured, and the new and old key replacement process does not appear.
  • the service is flashed, and the service of the OTN device itself is not affected.
  • FIG. 1 is a schematic flowchart of a method for updating an OTN based key according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of another method for updating an OTN based key according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a logic device of a single board according to an embodiment of the present disclosure
  • FIG. 4 is a schematic structural diagram of a logic device of a single board at a decryption end according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a system for key update based on OTN according to an embodiment of the present invention.
  • an OTN-based key update method is provided.
  • the method may be applied to a single-board logic device on an encryption end.
  • the method may include:
  • the local configuration information local_cfg_rdy is used to indicate that the board software of the encryption end is connected.
  • the key information key_reg and the key configuration status information key_cfg_status in the key configuration update message are sent to the board logic of the local end;
  • the key information key_reg may be a 256-bit signal
  • the board logic provides two sets of internal registers key1 and key2 for the board software to configure the received key information into the two groups.
  • the internal register, and key1 and key2 can be alternately used as the current working key;
  • the key configuration information key_cfg_status can be a 2-bit signal indicating the internal register identifier of the key to be encrypted, which can be configured as: 2'b00 Indicates no encryption, 2'b10 indicates encryption using key1, 2'b11 indicates encryption using key2, and 2'b01 reservation.
  • the encryption side board logic detects that local_cfg_rdy is valid
  • the local state machine of the encryption end enters the Chg_Start state.
  • the counter starts counting. If the decryption terminal ready information rx_lp_cfg_rdy is valid within the preset time period, the local state machine of the encryption end enters the update preparation state Chg_Ready, at this time, the state machine will clear the current count value, and at the same time
  • the flag information chg_ready of the update preparation state is pulled high; if the decryption terminal ready information rx_lp_cfg_rdy is not valid within the preset time period, the local state machine of the encryption end enters the update failure state Chg_Fail, and at this time, the state opportunity cancels the current secret.
  • the key is updated, and the current count value is cleared, and the flag information chg_fail of the update failure status is reported to the encryption side board software, so that the board software
  • the key update information of the local end includes the key state information next_work_status updated by the encrypted end and the update preparation flag chg_ready of the encrypted end; the key state information next_work_status updated by the encrypted end is used to indicate the updated key of the encrypted end;
  • the data interaction between the encryption end and the decryption end needs to be implemented by the overhead channel reserved by the optical channel data unit (ODUk, Optical channel Data Unit k), which can achieve the effect of simple information and high real-time requirements.
  • the transmission overhead channel preset by the encryption end is the same as the preset reception overhead channel of the decryption end, and can be set as the byte row 4 column 13 of the ODUk overhead channel; the preset reception overhead channel of the encryption terminal and The default transmission overhead of the decryption terminal The same channel can be set to byte row 4 column 14 of the ODUk overhead channel.
  • the specific setting of the overhead channel of the ODUk is not limited in the embodiment of the present invention.
  • the length of the preset period is a preset number of multiframes; when designing the preset period length, because the G.709 of the International Telecommunication Union (ITU)
  • the protocol stipulates that the ODUk can provide a multiframe of 256 frames. Therefore, the length of the preset period should consider the integer that can be divisible by 256, and consider the influence of the length of the cycle on the service. Combining the above two points, the length of the preset period is selected to be 8 multiframes.
  • the preset condition is a start position of the first multiframe of the preset period.
  • a start position of the first multiframe of the eight multiframes may be represented as an ODUk frame.
  • the notification status Chg_Inform, at this time, the key status next_work_status of the encrypted end update and the update preparation flag chg_ready of the encrypted end can be sent to the decryption end.
  • mfas[2:0] indicates a preset period
  • the length of time is 8 multiframes
  • the combined meaning means the starting position of the first multiframe in every 8 multiframes, which is the preset condition mentioned in this article.
  • the key state information next_work_status updated by the encryption terminal is used to indicate the updated key
  • the key state information next_work_status updated by the encryption terminal is also the key configuration state information key_cfg_status of the encryption terminal.
  • the encryption end encrypts the service information sent to the decryption end by using the updated key when the next preset period after the key update information is sent to the decryption end meets the preset condition.
  • the local state machine of the encryption end enters the execution state of the update key Chg_do, that is, the board logic of the encryption end performs an update key to encrypt, and reports the flag information chg_success of the update success status to the board software of the encryption end, Indicates that this update was successful;
  • the embodiment provides an OTN-based key update method applied to a single-board logic device of an encryption end, and performs a key update state interaction between a preset overhead channel and a decryption end, thereby ensuring an encryption end and While the key consistency of the decryption end is also ensured, no service flash occurs during the replacement of the old and new keys, and the service of the OTN device itself is not affected.
  • the embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the above method.
  • the method may be applied to a single-board logic device at a decryption end, and the method may include:
  • the local configuration information local_cfg_rdy is used to indicate that the card information of the decryption end has received the key configuration update message sent by the network management system, and has key information key_reg and key configuration status in the key configuration update message.
  • the information key_cfg_status is sent to the card logic of the local end.
  • the specific description of the key information key_reg and the key configuration status information key_cfg_status is consistent with the description of the encryption end in the above embodiment, and the present embodiment does not describe too much. .
  • the decryption board logic when the decryption board logic detects that local_cfg_rdy is valid, the counter starts counting, and the decryption terminal ready information rx_lp_cfg_rdy starts to be valid and remains valid. It should be noted that when the decryption end local state machine When the Chg_Update state is entered within the specified time, or the state machine local to the decryption terminal cannot enter the Chg_Update state within the specified time, the decryption terminal ready information rx_lp_cfg_rdy begins to be invalid.
  • the encryption end key update information includes the key status information next_work_status updated by the encryption end and the update preparation flag chg_ready of the encryption end; the key status information next_work_status updated by the encryption end is used to indicate the updated key of the encryption end;
  • the receiving overhead channel preset by the decryption end and the transmission overhead preset by the encryption end are The same channel can be set to byte row 4 column 13 of the ODUk overhead channel; the default transmission overhead channel of the decryption terminal is the same as the receiving overhead channel preset by the encryption terminal, and can be set to byte row 4 column 14 of the ODUk overhead channel.
  • the specific setting of the overhead channel of the ODUk is not limited in the embodiment of the present invention.
  • the preset period has a length of 8 multiframes.
  • the enable period is enabled at the beginning of the preset period, and the enable is invalid when the preset period ends; when the detection of the preset period is enabled, the local state machine of the decryption end enters the Chg_Start state, where At the same time, the encryption terminal key update information transmitted by the encryption terminal is started, and the related flag information is cleared, wherein the encryption terminal key update information includes the key state information next_work_status updated by the encryption terminal and the update preparation flag chg_ready of the encryption terminal; The updated key state information next_work_status is used to indicate the encrypted key of the encrypted end.
  • the specific process may include:
  • the state machine enters the decision state Chg_Judge. At this time, the decision is made using the large number decision method.
  • the preset number of times is detected in each cycle, that is, 8 times, if the preset number of times is satisfied.
  • the preset ratio in this embodiment, that is, the ratio of 3/4 or more of the 8 times is satisfied, that is, the detection result of 6 times or more indicates that the key state information updated with the encryption end and the local density of the decryption end are dense.
  • the decision result is true, and it is determined that the key state information updated by the encryption end and the key state information of the decryption end are consistent, and the state machine of the decryption end enters the Chg_Update state;
  • the result of the decision is false, and the key state information updated by the encryption end and the key state information of the decryption end are inconsistent, and the state machine of the decryption end enters the update failure state Chg_Fail, and Report update failure status
  • the flag information chg_fail is given to the board software on the decryption end, indicating that the key update failed.
  • the state machine After the state machine enters the update failure state Chg_Update, it stops sending the decryption terminal ready information rx_lp_cfg_rdy to the encryption end, and the decryption end does not correspondingly execute the new key for decryption from the next predefined period, but keeps the old The key is decrypted.
  • the decryption end passes the updated key when the preset condition is met in the next preset period.
  • Decrypting the information sent by the encryption terminal may include:
  • the local state machine enters the execution state Chg_Perform of the update key.
  • the flag information chg_success flag information of the update success status is reported to the board software of the decryption end, indicating that the key update is successful, and the key state information updated by the encryption terminal is used as the decryption.
  • the current working state of the board logic is executed, and the update key is decrypted.
  • the local state opportunity of the decryption end continues to enter the decision Chg_Judge, and the next round of detection is started for the encrypted end, and the detection time is also a cycle, and the loop detection is continued.
  • the local state machine of the decryption end After the local state machine of the decryption end enters the Chg_Perform state, and before the next round of local configuration information local_cfg_rdy is updated, the local state machine of the decryption end is also in the loop working state.
  • the embodiment provides an OTN-based key update method applied to a single-board logic device of a decryption end, and performs key update state interaction between a preset overhead channel and a decryption end, thereby ensuring an encryption end and While the key consistency of the decryption end is also ensured, no service flash occurs during the replacement of the old and new keys, and the service of the OTN device itself is not affected.
  • the embodiment of the invention further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the above method.
  • the device 30 may include: a detecting unit 301, a sending unit 302, and an encrypting unit 303. ,among them,
  • the detecting unit 301 is configured to, when detecting that the local configuration information is valid, in a preset time period Internally detecting the validity of the decryption terminal ready information received through the preset receiving overhead channel;
  • the sending unit 302 is configured to: after determining that the decryption terminal ready information is valid within the preset time period of the detecting unit 301, send the local key update to the decryption end through the preset sending overhead channel when the next preset period meets the preset condition
  • the key update information of the local end includes the key state information of the encrypted end update and the update preparation flag of the encrypted end; the key state information updated by the encrypted end is used to indicate the updated key of the encrypted end;
  • the encryption unit 303 is configured to encrypt the service information sent to the decryption end by using the updated key when the next preset period after the sending unit 302 sends the key update information to the decryption end satisfies the preset condition.
  • the local configuration information is used to indicate that the card information of the encryption configuration is configured to update the key information and the key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the board logic sent to the local end is used to indicate that the card information of the encryption configuration is configured to update the key information and the key configuration status in the key configuration update message after receiving the key configuration update message sent by the network management system.
  • the length of the preset period is a preset number of multiframes; the preset condition is a starting position of the first multiframe of the preset period, for example, the preset period is 8 multiframes;
  • the key state information updated by the encryption terminal is the key configuration state information in the encryption terminal key configuration update message.
  • the transmission overhead channel preset by the encryption end is the same as the reception overhead channel of the decryption end; the preset reception overhead channel of the encryption end is the same as the transmission overhead channel of the decryption end.
  • the embodiment provides a single-board logic device 30 of the encryption end, and performs key update state interaction between the preset overhead channel and the decryption end, so as to ensure the key consistency between the encryption end and the decryption end, It is ensured that no service flash occurs during the replacement of the old and new keys, and the services of the OTN device itself are not affected.
  • the device 40 may include: a detecting unit 401, a sending unit 402, and a determining unit 403. And decryption unit 404, wherein
  • the detecting unit 401 is configured to detect validity of local configuration information
  • the sending unit 402 is configured to: when the detecting unit 401 detects that the local configuration information is valid, Passing the preset transmission overhead channel to send the decryption terminal ready information to the encryption end;
  • the detecting unit 401 is further configured to detect, by using a preset receiving channel, the encrypted end key update information transmitted by the encrypted end in a preset period after the sending unit 402 sends the decryption terminal ready information, where the encryption end key
  • the update information includes key status information of the encrypted end update and an update preparation flag of the encrypted end; the key status information of the encrypted end update is used to indicate the updated key of the encrypted end;
  • the determining unit 403 is configured to determine, by using a large number decision method, that the key state information updated by the encryption end is consistent with the local key state information of the decryption end when the preset period satisfies the preset condition;
  • the decryption unit 404 is configured to determine, by the large number decision method, that the key state information updated by the encryption terminal and the key state information of the local end of the decryption end are consistent, and after the preset condition is met in the next preset period, the updated The key pair decrypts the service information sent by the encryption end to the decryption end.
  • the local configuration information is used to indicate that the card information of the decryption end has received the key configuration update message sent by the network management system, and the key information and key configuration status in the key configuration update message have been The board logic sent to the local end.
  • the length of the preset period is a preset number of multiframes; the preset condition is a starting position of the first multiframe of the preset period, for example, the preset period is 8 multiframes;
  • the receiving overhead channel preset by the decryption end is the same as the transmission overhead channel of the encryption end; the preset transmission overhead channel of the decryption end is the same as the receiving overhead channel of the encryption end.
  • the determining unit 403 is set to:
  • the preset ratio of the preset number of times in this embodiment, that is, the ratio of 3/4 or more of the 8 times is satisfied, that is, the detection result of 6 times or more indicates that the encrypted end is updated.
  • the key state information is consistent with the local key state information of the decryption end, it is determined that the key state information updated by the encryption end is consistent with the local key state information of the decryption end;
  • the key status information and the decryption end of the encrypted end update are determined.
  • the key state information of the ground is inconsistent.
  • the embodiment provides a single-board logic device 40 on the decryption end, and performs key update state interaction between the preset overhead channel and the decryption end, so as to ensure the key consistency between the encryption end and the decryption end, It is ensured that no service flash occurs during the replacement of the old and new keys, and the services of the OTN device itself are not affected.
  • an OTN-based key update system 50 is provided in the embodiment of the present invention.
  • the system 50 may include: a single-board logic device 30 of the encryption end and decryption. a single board logic device 40, wherein
  • the board logic device 30 of the encryption end is set to:
  • the local key update information is sent to the decryption end through the preset transmission overhead channel when the next preset period meets the preset condition; wherein, the local key update is performed.
  • the information includes key status information of the encrypted end update and an update preparation flag of the encrypted end; the key status information of the encrypted end is used to indicate different keys after the encrypted end is updated, and different key status information corresponds to different keys; as well as,
  • the service information sent to the decryption end is encrypted by the updated key
  • the board logic device 40 of the decryption end is configured to send the decryption terminal ready information to the encryption end through a preset transmission overhead channel when detecting that the local configuration information is valid;
  • the encrypted end key update information transmitted by the encrypted end is detected through a preset receiving channel within a preset period after the decryption terminal ready information is sent;
  • the key pair decrypts the service information sent by the encryption end to the decryption end.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • the invention is not limited to any specific form of combination of hardware and software.
  • the above technical solution ensures that the key consistency of the encryption end and the decryption end is ensured, and the service flashing does not occur during the replacement of the old and new keys, and the service of the OTN device itself is not affected.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
  • Telephonic Communication Services (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种基于光传输网OTN的密钥更新的方法、装置和系统，包括：当加密端检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；在预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；加密端在向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密。通过上述技术方案，在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。

Description

一种基于光传输网OTN的密钥更新的方法、装置和系统 技术领域
本文涉及但不限于光传输网(OTN，Optical Transport Network)的信息安全技术，尤指一种基于光传输网OTN的密钥更新的方法、装置和系统。
背景技术
OTN加密传输系统通常是由加密模块和密钥管理系统两部分组成。其中，加密模块一般采用标准的高级加密标准(AES，Advanced Encryption Standard)加密算法；密钥管理系统主要由公共密钥参数配置管理、私钥产生、公钥运算处理模块、共享密钥协商获取模块、密钥无损切换等功能模块组成。密钥更新是密钥管理系统中必不可少的一项基本功能模块，想要在OTN传输系统中完成密钥的更新，就必须要解决两个难点，第一是如何保证加密端和解密端的密钥一致性，第二是如何保证在新旧密钥替换过程中不出现业务闪断。但是到目前为止，当前的密钥更新技术无法同时解决以上两个难点
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供了一种基于光传输网OTN的密钥更新的方法、装置和系统，在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
本发明实施例提供了一种基于光传输网OTN的密钥更新的方法，所述方法应用于加密端的单板逻辑装置，所述方法包括：
当加密端检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；
在预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；
加密端在向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密。
可选的，所述本端的密钥更新信息包括所述加密端更新的密钥状态信息和所述加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；
所述本地配置信息用于表示所述加密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将所述密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
可选的，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
可选的，所述加密端更新的密钥状态信息为所述加密端密钥配置更新消息中的密钥配置状态信息。
可选的，所述加密端预设的发送开销通道与解密端的接收开销通道相同；加密端预设的接收开销通道与解密端的发送开销通道相同。
可选的，所述方法应用于解密端的单板逻辑装置，所述方法包括：
当解密端检测到本地配置信息有效时，通过预设的发送开销通道将解密端就绪信息发送至加密端；
在将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；
在所述预设周期满足预设条件时，解密端通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解 密端的业务信息进行解密。
可选的，所述加密端密钥更新信息包括加密端更新的密钥状态信息和加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；
所述本地配置信息用于表示所述解密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将所述密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
可选的，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
可选的，所述解密端预设的接收开销通道与加密端的发送开销通道相同；所述解密端预设的发送开销通道与加密端的接收开销通道相同。
可选的，所述通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致，包括：
在所述预设周期的第一个复帧的起始位置时，在每个所述预设周期内对所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息检测所述预设数量的次数；
当满足所述预设数量的次数的预设比例以上的检测结果表明所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息是一致的时候，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的；
当检测结果为其他状态时，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是不一致的。
本发明实施例提供了一种加密端的单板逻辑装置，所述装置包括：检测单元，发送单元和加密单元，其中，
所述检测单元，设置为当检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；
所述发送单元，设置为在所述检测单元预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；
所述加密单元，设置为在所述发送单元向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密。
本发明实施例提供了一种解密端的单板逻辑装置，所述装置包括：检测单元、发送单元、确定单元和解密单元，其中，
所述检测单元，设置为检测本地配置信息的有效性；在所述发送单元将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；
所述发送单元，设置为当所述检测单元检测到本地配置信息有效时，通过预设的发送开销通道将解密端就绪信息发送至加密端；
所述确定单元，设置为在所述预设周期满足预设条件时，通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致；
所述解密单元，设置为所述确定单元通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解密端的业务信息进行解密。
可选的，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
可选的，所述确定单元，是设置为：
在所述预设周期的第一个复帧的起始位置时，在每个所述预设周期内对所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息检测所述预设数量的次数；
当满足所述预设数量的次数的预设比例以上的检测结果表明所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息是一致的时候，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的；
当检测结果为其他状态时，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是不一致的。
本发明实施例提供了一种基于光传输网OTN的密钥更新的系统，所述系统包括：加密端的单板逻辑装置和解密端的单板逻辑装置，其中，
所述加密端的单板逻辑装置，设置为：
当检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；以及，
在预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；其中，所述本端的密钥更新信息包括所述加密端更新的密钥状态信息和所述加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；以及，
加密端在向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密；
所述解密端的单板逻辑装置，设置为当检测到本地配置信息有效时，通过预设的发送开销通道将所述解密端就绪信息发送至所述加密端；以及，
在将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；以及，
在所述预设周期满足预设条件时，通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解密端的业务信息进行解密。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行上述的方法。
本发明实施例提供了一种基于光传输网OTN的密钥更新的方法、装置和系统，在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例提供的一种基于OTN的密钥更新的方法流程示意图；
图2为本发明实施例提供的另一种基于OTN的密钥更新的方法流程示意图；
图3为本发明实施例提供的一种加密端的单板逻辑装置结构示意图；
图4为本发明实施例提供的一种解密端的单板逻辑装置结构示意图；
图5为本发明实施例提供的一种基于OTN的密钥更新的系统结构示意图。
本发明的实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
参见图1，其示出了本发明实施例提供的一种基于OTN的密钥更新的方法，该方法可以应用于加密端的单板逻辑装置，该方法可以包括：
S101：当加密端检测到本地配置信息local_cfg_rdy有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息rx_lp_cfg_rdy的有效性；
示例性地，本地配置信息local_cfg_rdy用于表示加密端的单板软件在接 收到网络管理系统下发的密钥配置更新消息后，已将密钥配置更新消息中的密钥信息key_reg和密钥配置状态信息key_cfg_status下发给本端的单板逻辑；
可选地，在本实施例中，密钥信息key_reg可以是一个256bit的信号，单板逻辑会提供两组内部寄存器key1和key2以供单板软件将接收到的密钥信息配置到这两组内部寄存器中，而且key1和key2可交替作为当前工作密钥；密钥配置信息key_cfg_status可以是一个2bit的信号，用于表示进行加密的密钥所在的内部寄存器标识，具体可以配置为：2’b00表示不加密、2’b10表示使用key1进行加密、2’b11表示使用key2进行加密、2’b01保留。
可选地，在本实施例中，当加密端单板逻辑检测到local_cfg_rdy有效时，加密端本地的状态机进入Chg_Start状态。此时计数器开始计数，如果在预设的时间段内采集到解密端就绪信息rx_lp_cfg_rdy有效时，加密端本地的状态机进入更新准备状态Chg_Ready，此时，状态机会将当前计数值清零，同时将更新准备状态的标志信息chg_ready拉高；如果在预设的时间段内采集不到解密端就绪信息rx_lp_cfg_rdy有效时，加密端本地的状态机进入更新失败状态Chg_Fail，此时，状态机会取消本次密钥更新，并将当前计数值清零，同时上报更新失败状态的标志信息chg_fail给加密端单板软件，以便加密端的单板软件重新启用密钥更新的进程。
S102：在预设的时间段内确定解密端就绪信息rx_lp_cfg_rdy有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向解密端发送本端的密钥更新信息；
其中，本端的密钥更新信息包括加密端更新的密钥状态信息next_work_status和加密端的更新准备标志chg_ready；加密端更新的密钥状态信息next_work_status用于指示加密端更新后的密钥；
需要说明的是，加密端和解密端之间的数据交互需要通过光通道数据单元(ODUk，Optical channel Data Unit k)保留的开销通道来进行实现，能够达到信息简单、实时性要求高的效果，并且，在本实施例中，加密端预设的发送开销通道与解密端预设的接收开销通道相同，可以设置为ODUk开销通道的字节行4列13；加密端预设的接收开销通道与解密端预设的发送开销通 道相同，可以设置为ODUk开销通道的字节行4列14。本发明实施例对于ODUk的开销通道的具体设置不做限定。
可选地，在本发明实施例中，所述预设周期的长度为预设数量的复帧；在设计预设周期长度的时候，因为国际电信联盟(ITU，International Telecommunication Union)的G.709协议规定ODUk可以提供256帧的复帧。因此，预设周期的长度既要考虑能被256整除的整数，又要考虑周期时间长短对于业务的影响，结合以上两点，最终选择预设周期的长度为8个复帧。
可选地，预设条件为预设周期的第一个复帧的起始位置，在本实施例中，8个复帧中的第一个复帧的起始位置可以表示为ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1，在下个预设周期的mfas[2:0]＝3’d0且tfp＝1’b1时，加密端本地的状态机可以进入更新通知状态Chg_Inform，此时，可以将加密端更新的密钥状态next_work_status和加密端的更新准备标志chg_ready发送到解密端。其中，mfas[2:0]指示一个预设的周期，时间长度是8个复帧，tfp表示复帧帧头的意思，因此，mfas[2:0]＝3’d0且tfp＝1’b1综合起来的含义是表示每8个复帧中的第一个复帧的起始位置，也就是本文所提到的预设条件。
并且，由于加密端更新的密钥状态信息next_work_status用于指示更新后的密钥，因此，加密端更新的密钥状态信息next_work_status也就是加密端的密钥配置状态信息key_cfg_status。
S103：加密端在向解密端发送密钥更新信息后的下个预设周期满足预设条件时，通过更新后的密钥对发送至解密端的业务信息进行加密。
可选地，在本实施例中，在向解密端发送密钥更新信息后的下个预设周期的预设条件仍旧为ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1，此时，加密端本地的状态机进入更新密钥的执行状态Chg_do，即加密端的单板逻辑将执行更新key进行加密，并上报更新成功状态的标志信息chg_success给加密端的单板软件，表示本次更新成功；
需要说明的是，当加密端本地的状态机进入更新密钥的执行状态Chg_do后，并且在下一轮本地配置信息local_cfg_rdy有效之前，加密端本地的状态机一直维持在工作状态working。
本实施例提供了一种应用于加密端的单板逻辑装置的基于OTN的密钥更新的方法，通过预设的开销通道和解密端之间进行密钥更新状态的交互，从而在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行上述的方法。
参见图2，其示出了本发明实施例提供的一种基于OTN的密钥更新的方法，该方法可以应用于解密端的单板逻辑装置，该方法可以包括：
S201：当解密端检测到本地配置信息local_cfg_rdy有效时，通过预设的发送开销通道将解密端就绪信息rx_lp_cfg_rdy发送至加密端；
示例性地，本地配置信息local_cfg_rdy用于表示解密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将密钥配置更新消息中的密钥信息key_reg和密钥配置状态信息key_cfg_status下发给本端的单板逻辑；而对于解密端来说，密钥信息key_reg和密钥配置状态信息key_cfg_status的具体说明与上述实施例中加密端的说明一致，本实施例不做过多赘述。
可选地，在本实施例中，当解密端单板逻辑检测到local_cfg_rdy有效时，计数器开始计数，解密端就绪信息rx_lp_cfg_rdy开始有效且一直保持有效，需要说明的是，当解密端本地的状态机在规定时间内进入到Chg_Update状态，或者解密端本地的状态机在规定时间内不能进入到Chg_Update状态时，解密端就绪信息rx_lp_cfg_rdy开始失效。
S202：在将解密端就绪信息rx_lp_cfg_rdy发送之后的预设周期内，通过预设的接收通道检测由加密端传送过来的加密端密钥更新信息；
其中，加密端密钥更新信息包括加密端更新的密钥状态信息next_work_status和加密端的更新准备标志chg_ready；加密端更新的密钥状态信息next_work_status用于指示加密端更新后的密钥；
在本实施例中，解密端预设的接收开销通道与加密端预设的发送开销通 道相同，可以设置为ODUk开销通道的字节行4列13；解密端预设的发送开销通道与加密端预设的接收开销通道相同，可以设置为ODUk开销通道的字节行4列14。本发明实施例对于ODUk的开销通道的具体设置不做限定。与前述实施例相同的理由，本实施例中，预设周期的长度为8个复帧。
可选地，在本实施例中，预设周期开始时使能有效，预设周期结束时使能无效；在预设周期的检测使能有效时，解密端本地的状态机进入Chg_Start状态，此时，开始检测由加密端传送过来的加密端密钥更新信息，并且清除相关标志信息，其中，加密端密钥更新信息包括加密端更新的密钥状态信息next_work_status和加密端的更新准备标志chg_ready；加密端更新的密钥状态信息next_work_status用于指示加密端更新后的密钥。
S203：在预设周期满足预设条件时，通过大数判决法确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足预设条件时，通过更新后的密钥对由加密端发送到解密端的业务信息进行解密。
可选地，在本实施例中，预设周期满足预设条件时，通过大数判决法确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致，具体过程可以包括：
预设条件为预设周期的第一个复帧的起始位置，即ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1。在预设周期的mfas[2:0]＝3’d0且tfp＝1’b1时，如果检测到的加密端更新的密钥状态信息与解密端本地的密钥状态信息相等时，解密端本地的状态机进入判决状态Chg_Judge，此时，开始采用大数判决法进行判决，可选地，每个周期内检测预设数量的次数，也就是8次，如果满足所述预设数量的次数的预设比例，在本实施例中，也就是满足8次当中的3/4以上的比例，即6次及6次以上的检测结果表明与加密端更新的密钥状态信息与解密端本地的密钥状态信息是一致的时候，那么判决结果为真，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的，解密端本地的状态机进入Chg_Update状态；其它情况下，判决结果为假，定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是不一致的，解密端本地的状态机进入更新失败状态Chg_Fail，并上报更新失败状态 标志信息chg_fail给解密端的单板软件，表示密钥更新失败。同时，状态机进入更新失败状态Chg_Update后，就会停止给加密端发送解密端就绪信息rx_lp_cfg_rdy，解密端也相应的不会从下一个预定义周期开始执行新的密钥进行解密，而是保持旧的密钥进行解密。
可选地，在本实施例中，确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足预设条件时，解密端通过更新后的密钥对由加密端发送的信息进行解密，可以包括：
在下一个预设周期的预设条件仍旧为预设周期的第一个复帧的起始位置，即ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1时，解密端本地的状态机进入更新密钥的执行状态Chg_Perform，此时上报更新成功状态的标志信息chg_success标志信息给解密端的单板软件，表示密钥更新成功，且使用加密端更新的密钥状态信息作为解密端的单板逻辑当前工作状态，执行更新密钥进行解密。与此同时，解密端本地的状态机会继续进入判定Chg_Judge，并对加密端开始下一轮检测，检测时间同样也是一个周期，并持续循环检测。
需要说明的是，解密端本地的状态机进入Chg_Perform状态后，并且在下一轮本地配置信息local_cfg_rdy更新之前，解密端本地的状态机也同样一直处于循环working状态。
本实施例提供了一种应用于解密端的单板逻辑装置的基于OTN的密钥更新的方法，通过预设的开销通道和解密端之间进行密钥更新状态的交互，从而在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行上述的方法。
基于前述实施例相同的技术构思，参见图3，其示出了本发明实施例提供的一种加密端的单板逻辑装置30，该装置30可以包括：检测单元301，发送单元302和加密单元303，其中，
检测单元301，设置为当检测到本地配置信息有效时，在预设的时间段 内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；
发送单元302，设置为在检测单元301预设的时间段内确定解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向解密端发送本端的密钥更新信息；其中，本端的密钥更新信息包括加密端更新的密钥状态信息和加密端的更新准备标志；加密端更新的密钥状态信息用于指示加密端更新后的密钥；
加密单元303，设置为在发送单元302向解密端发送密钥更新信息后的下个预设周期满足预设条件时，通过更新后的密钥对发送到解密端的业务信息进行加密。
在上述实施例中，本地配置信息用于表示加密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
在上述实施例中，预设周期的长度为预设数量的复帧；预设条件为所述预设周期的第一个复帧的起始位置，比如：预设周期为8个复帧；预设条件为ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1。
在上述实施例中，加密端更新的密钥状态信息为加密端密钥配置更新消息中的密钥配置状态信息。
在上述实施例中，加密端预设的发送开销通道与解密端的接收开销通道相同；加密端预设的接收开销通道与解密端的发送开销通道相同。
本实施例提供了一种加密端的单板逻辑装置30，通过预设的开销通道和解密端之间进行密钥更新状态的交互，从而在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
基于前述实施例相同的技术构思，参见图4，其示出了本发明实施例提供的一种解密端的单板逻辑装置40，该装置40可以包括：检测单元401、发送单元402、确定单元403和解密单元404，其中，
检测单元401，设置为检测本地配置信息的有效性；
发送单元402，设置为当检测单元401检测到本地配置信息有效时，通 过预设的发送开销通道将解密端就绪信息发送至加密端；
检测单元401，还设置为在发送单元402将解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由加密端传送过来的加密端密钥更新信息，其中，加密端密钥更新信息包括加密端更新的密钥状态信息和加密端的更新准备标志；加密端更新的密钥状态信息用于指示加密端更新后的密钥；
确定单元403，设置为在预设周期满足预设条件时，通过大数判决法确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致；
解密单元404，设置为确定单元403通过大数判决法确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足预设条件时，通过更新后的密钥对由加密端发送到解密端的业务信息进行解密。
在上述实施例中，本地配置信息用于表示解密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
在上述实施例中，预设周期的长度为预设数量的复帧；预设条件为所述预设周期的第一个复帧的起始位置，比如：预设周期为8个复帧；预设条件为ODUk帧中的mfas[2:0]＝3’d0且tfp＝1’b1。
在上述实施例中，解密端预设的接收开销通道与加密端的发送开销通道相同；解密端预设的发送开销通道与加密端的接收开销通道相同。
在上述实施例中，确定单元403，是设置为：
在预设周期的第一个复帧的起始位置，即mfas[2:0]＝3’d0且tfp＝1’b1时，在每个预设周期内对加密端更新的密钥状态信息与解密端本地的密钥状态信息检测预设数量的次数，比如8次；
当满足所述预设数量的次数的预设比例，在本实施例中，也就是满足8次当中的3/4以上的比例，即有6次及6次以上的检测结果表明加密端更新的密钥状态信息与解密端本地的密钥状态信息是一致的时候，确定加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的；
当检测结果为其他状态时，确定加密端更新的密钥状态信息和解密端本 地的密钥状态信息是不一致的。
本实施例提供了一种解密端的单板逻辑装置40，通过预设的开销通道和解密端之间进行密钥更新状态的交互，从而在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。
基于前述实施例相同的技术构思，参见图5，其示出了本发明实施例提供的一种基于OTN的密钥更新的系统50，该系统50可以包括：加密端的单板逻辑装置30和解密端的单板逻辑装置40，其中，
加密端的单板逻辑装置30，设置为：
当检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；以及，
在预设的时间段内确定解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向解密端发送本端的密钥更新信息；其中，本端的密钥更新信息包括加密端更新的密钥状态信息和加密端的更新准备标志；加密端更新的密钥状态信息用于指示加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；以及，
在向解密端发送密钥更新信息后的下个预设周期满足预设条件时，通过更新后的密钥对发送到解密端的业务信息进行加密；
解密端的单板逻辑装置40，设置为当检测到本地配置信息有效时，通过预设的发送开销通道将解密端就绪信息发送至加密端；以及，
在将解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由加密端传送过来的加密端密钥更新信息；以及，
在预设周期满足预设条件时，通过大数判决法确定加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足预设条件时，通过更新后的密钥对由加密端发送到解密端的业务信息进行解密。
本实施例用于实现上述各方法实施例，本实施例中各个单元的工作流程和工作原理参见上述各方法实施例中的描述，在此不再赘述。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本发明不限制于任何特定形式的硬件和软件的结合。
虽然本发明所揭露的实施方式如上，但所述的内容仅为便于理解本发明而采用的实施方式，并非用以限定本发明。任何本发明所属领域内的技术人员，在不脱离本发明所揭露的精神和范围的前提下，可以在实施的形式及细节上进行任何的修改与变化，但本发明的专利保护范围，仍须以所附的权利要求书所界定的范围为准。
工业实用性
上述技术方案在保证加密端和解密端的密钥一致性的同时，还保证了在新旧密钥替换过程中不出现业务闪断，OTN设备本身的业务不受影响。

Claims (15)

  1. 一种基于光传输网OTN的密钥更新的方法，所述方法应用于加密端的单板逻辑装置，所述方法包括：
    当加密端检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；
    在预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；
    加密端在向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密。
  2. 根据权利要求1所述的方法，其中，所述本端的密钥更新信息包括所述加密端更新的密钥状态信息和所述加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；
    所述本地配置信息用于表示所述加密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将所述密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
  3. 根据权利要求1所述的方法，其中，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
  4. 根据权利要求2所述的方法，其中，所述加密端更新的密钥状态信息为所述加密端密钥配置更新消息中的密钥配置状态信息。
  5. 根据权利要求2所述的方法，其中，所述加密端预设的发送开销通道与解密端的接收开销通道相同；加密端预设的接收开销通道与解密端的发送开销通道相同。
  6. 一种基于光传输网OTN的密钥更新的方法，所述方法应用于解密端的单板逻辑装置，所述方法包括：
    当解密端检测到本地配置信息有效时，通过预设的发送开销通道将解密端就绪信息发送至加密端；
    在将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；
    在所述预设周期满足预设条件时，解密端通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解密端的业务信息进行解密。
  7. 根据权利要求6所述的方法，其中，所述加密端密钥更新信息包括加密端更新的密钥状态信息和加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；
    所述本地配置信息用于表示所述解密端的单板软件在接收到网络管理系统下发的密钥配置更新消息后，已将所述密钥配置更新消息中的密钥信息和密钥配置状态信息下发给本端的单板逻辑。
  8. 根据权利要求6所述的方法，其中，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
  9. 根据权利要求7所述的方法，其中，所述解密端预设的接收开销通道与加密端的发送开销通道相同；所述解密端预设的发送开销通道与加密端的接收开销通道相同。
  10. 根据权利要求8所述的方法，其中，所述通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致，包括：
    在所述预设周期的第一个复帧的起始位置时，在每个所述预设周期内对所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息检测所述预设数量的次数；
    当满足所述预设数量的次数的预设比例以上的检测结果表明所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息是一致的时候，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的；
    当检测结果为其他状态时，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是不一致的。
  11. 一种加密端的单板逻辑装置，所述装置包括：
    检测单元，设置为当检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；
    发送单元，设置为在所述检测单元预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；
    加密单元，设置为在所述发送单元向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密。
  12. 一种解密端的单板逻辑装置，所述装置包括：
    检测单元，设置为检测本地配置信息的有效性；在所述发送单元将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；
    发送单元，设置为当所述检测单元检测到本地配置信息有效时，通过预设的发送开销通道将解密端就绪信息发送至加密端；
    确定单元，设置为在所述预设周期满足预设条件时，通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致；
    解密单元，设置为所述确定单元通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解密端的业务信息进行解密。
  13. 根据权利要求12所述的装置，其中，所述预设周期的长度为预设数量的复帧；所述预设条件为所述预设周期的第一个复帧的起始位置。
  14. 根据权利要求13所述的装置，其中，
    所述确定单元，是设置为在所述预设周期的第一个复帧的起始位置时，在每个所述预设周期内对所述加密端更新的密钥状态信息与所述解密端本地 的密钥状态信息检测所述预设数量的次数；
    当满足所述预设数量的次数的预设比例以上的检测结果表明所述加密端更新的密钥状态信息与所述解密端本地的密钥状态信息是一致的时候，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是一致的；
    当检测结果为其他状态时，确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息是不一致的。
  15. 一种基于光传输网OTN的密钥更新的系统，所述系统包括：
    加密端的单板逻辑装置，设置为当检测到本地配置信息有效时，在预设的时间段内检测通过预设的接收开销通道所接收的解密端就绪信息的有效性；以及，
    在预设的时间段内确定所述解密端就绪信息有效后，在下个预设周期满足预设条件时通过预设的发送开销通道向所述解密端发送本端的密钥更新信息；其中，所述本端的密钥更新信息包括所述加密端更新的密钥状态信息和所述加密端的更新准备标志；所述加密端更新的密钥状态信息用于指示所述加密端更新后的不同的密钥，不同的密钥状态信息对应不同的密钥；以及，
    加密端在向所述解密端发送所述密钥更新信息后的下个所述预设周期满足所述预设条件时，通过所述更新后的密钥对发送至所述解密端的业务信息进行加密；
    所述解密端的单板逻辑装置，设置为当检测到本地配置信息有效时，通过预设的发送开销通道将所述解密端就绪信息发送至所述加密端；以及，
    在将所述解密端就绪信息发送之后的预设周期内，通过预设的接收通道检测由所述加密端传送过来的加密端密钥更新信息；以及，
    在所述预设周期满足预设条件时，通过大数判决法确定所述加密端更新的密钥状态信息和解密端本地的密钥状态信息一致后，在下一个预设周期满足所述预设条件时，通过所述更新后的密钥对由所述加密端发送到解密端的业务信息进行解密。
PCT/CN2016/076501 2015-05-18 2016-03-16 一种基于光传输网otn的密钥更新的方法、装置和系统 WO2016184238A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510254352.4 2015-05-18
CN201510254352.4A CN106301768B (zh) 2015-05-18 2015-05-18 一种基于光传输网otn的密钥更新的方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2016184238A1 true WO2016184238A1 (zh) 2016-11-24

Family

ID=57319417

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076501 WO2016184238A1 (zh) 2015-05-18 2016-03-16 一种基于光传输网otn的密钥更新的方法、装置和系统

Country Status (2)

Country Link
CN (1) CN106301768B (zh)
WO (1) WO2016184238A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111385276A (zh) * 2018-12-29 2020-07-07 中兴通讯股份有限公司 数据传输方法、数据传输系统及其发送装置与接收装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115065472B (zh) * 2022-08-18 2022-11-08 广州万协通信息技术有限公司 基于多密钥加密解密的安全芯片加密解密方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101247220A (zh) * 2008-03-14 2008-08-20 中兴通讯股份有限公司 一种无源光网络系统密钥交换的方法
CN101388765A (zh) * 2007-09-14 2009-03-18 中兴通讯股份有限公司 一种吉比特无源光纤网络系统的加密模式切换方法
CN103746814A (zh) * 2014-01-27 2014-04-23 华为技术有限公司 一种加密、解密的方法及设备
US20140359297A1 (en) * 2013-06-04 2014-12-04 Altera Corporation Systems and Methods for Intermediate Message Authentication in a Switched-Path Network

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1567812A (zh) * 2003-06-19 2005-01-19 华为技术有限公司 一种实现共享密钥更新的方法
KR100523357B1 (ko) * 2003-07-09 2005-10-25 한국전자통신연구원 이더넷 기반 수동형 광네트워크의 보안서비스 제공을 위한키관리 장치 및 방법
CN1897500A (zh) * 2006-05-11 2007-01-17 中国电信股份有限公司 一种应用于以太网无源光网络系统的搅动密钥更新与同步机制
CN101047494A (zh) * 2006-05-14 2007-10-03 华为技术有限公司 一种pon系统中密钥协商的方法和系统
CN101102152B (zh) * 2006-07-03 2011-05-11 华为技术有限公司 无源光网络中保证数据安全的方法
CN101183934A (zh) * 2007-10-23 2008-05-21 中兴通讯股份有限公司 无源光网络中密钥更新方法
CN101197663B (zh) * 2008-01-03 2010-12-29 中兴通讯股份有限公司 一种吉比特无源光网络加密业务的保护方法
CN103166758A (zh) * 2011-12-19 2013-06-19 中兴通讯股份有限公司 Gpon上行aes加密的密钥更新方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101388765A (zh) * 2007-09-14 2009-03-18 中兴通讯股份有限公司 一种吉比特无源光纤网络系统的加密模式切换方法
CN101247220A (zh) * 2008-03-14 2008-08-20 中兴通讯股份有限公司 一种无源光网络系统密钥交换的方法
US20140359297A1 (en) * 2013-06-04 2014-12-04 Altera Corporation Systems and Methods for Intermediate Message Authentication in a Switched-Path Network
CN103746814A (zh) * 2014-01-27 2014-04-23 华为技术有限公司 一种加密、解密的方法及设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111385276A (zh) * 2018-12-29 2020-07-07 中兴通讯股份有限公司 数据传输方法、数据传输系统及其发送装置与接收装置
CN111385276B (zh) * 2018-12-29 2022-11-01 中兴通讯股份有限公司 数据传输方法、数据传输系统及其发送装置与接收装置

Also Published As

Publication number Publication date
CN106301768B (zh) 2020-04-28
CN106301768A (zh) 2017-01-04

Similar Documents

Publication Publication Date Title
US10104047B2 (en) Method and system for encrypting/decrypting payload content of an OTN frame
EP3742696A1 (en) Identity management method, equipment, communication network, and storage medium
RU2736870C1 (ru) Комплекс для защищенной передачи данных в цифровой сети передачи данных с использованием однопроходной системы квантового распределения ключей и способ согласования ключей при работе комплекса
US9509414B2 (en) Encryption and decryption method and device
US11050751B2 (en) Onboarding and accounting of devices into an HPC fabric
US8892882B2 (en) Content transmission security protection device system and method
CN106161416A (zh) 一种实现数据传输的方法及光通道传输设备
WO2021244489A1 (zh) 光传送网中加密控制开销传输方法及装置
EP3813298A1 (en) Method and apparatus for establishing trusted channel between user and trusted computing cluster
US11290436B2 (en) Mechanism for encryption key distribution in computer networks
WO2017092465A1 (zh) 广播报文加密方法、olt、onu及计算机存储介质
US20220417015A1 (en) Key update method and related apparatus
WO2023160420A1 (zh) 群组消息加密方法、装置、设备和存储介质
WO2023273712A1 (zh) 加密传输方法及装置
WO2016184238A1 (zh) 一种基于光传输网otn的密钥更新的方法、装置和系统
WO2018040605A1 (zh) 数据处理方法、装置及计算机存储介质
CN115174188A (zh) 一种消息传输方法、装置、电子设备和存储介质
WO2018028359A1 (zh) 业务处理方法、装置、存储介质及电子装置
CN104349360B (zh) 解密失败的恢复方法、装置、用户终端及网络设备
WO2020063350A1 (zh) 量子密钥分发方法及设备
CN107483883B (zh) 一种智能数据交互的方法及装置
CN108076021B (zh) 业务处理方法和装置
CN113709069B (zh) 一种数据传输的无损切换方法及装置
CN113055284B (zh) 一种路径选择的方法、装置和系统
CN103138918A (zh) 避免gpon系统加密使能瞬间丢包的方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16795725

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16795725

Country of ref document: EP

Kind code of ref document: A1