WO2018086333A1 - 一种加密、解密的方法及设备 - Google Patents

一种加密、解密的方法及设备 Download PDF

Info

Publication number
WO2018086333A1
WO2018086333A1 PCT/CN2017/085783 CN2017085783W WO2018086333A1 WO 2018086333 A1 WO2018086333 A1 WO 2018086333A1 CN 2017085783 W CN2017085783 W CN 2017085783W WO 2018086333 A1 WO2018086333 A1 WO 2018086333A1
Authority
WO
WIPO (PCT)
Prior art keywords
byte
otn
ciphertext
unit
overhead
Prior art date
Application number
PCT/CN2017/085783
Other languages
English (en)
French (fr)
Inventor
苏长征
卢建松
肖新华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17870453.2A priority Critical patent/EP3531614A4/en
Publication of WO2018086333A1 publication Critical patent/WO2018086333A1/zh
Priority to US16/408,485 priority patent/US20190334710A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/70—Photonic quantum communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present invention relates to the field of quantum communication, and in particular, to a method and device for encrypting and decrypting.
  • QKD specifically uses the quantum state as the information unit, and uses some principles of quantum mechanics to transmit and protect information.
  • the two sides of the communication use the quantum state as the information carrier, and use the quantum mechanical principle to transmit through the quantum channel to establish between the two parties. Shared key. Its security is ensured by the "Heisenberg uncertainty relationship” and “single quantum non-reproducible theorem” in quantum mechanics or the quantum properties such as coherence and non-locality of entangled particles.
  • An Optical Transport Network (OTN) frame includes an Optical Channel Payload Unit (OPU) divided into a plurality of time slots, and the OTN frame is received at a transmitting end, and the time slots are grouped into multiple A time slot block, two or more time slot blocks are selected for encryption, and encryption/authentication is performed in parallel to generate an encrypted OTN frame, wherein only certain time slot blocks in the encrypted OTN frame are encrypted.
  • OTN Optical Transport Network
  • OPU Optical Channel Payload Unit
  • the ODU0 rate is 1.25 Gbps, because its data rate is very high and it is a continuous transmission service. It is higher than the speed of the key that can be generated by the existing quantum key distribution system. Therefore, the encryption of the optical channel payload unit can only select the traditional encryption method, and the unconditional security of the encrypted service data cannot be guaranteed. Encrypted processing of highly confidential business data.
  • the embodiment of the invention provides a method and a device for encrypting and decrypting, so as to solve the problem that the encryption process of the existing service data cannot guarantee the unconditional security of the encrypted service data, and the encryption process of the highly confidential service data cannot be realized. .
  • an apparatus for encryption including:
  • An interface unit configured to acquire a quantum key and service data to be encrypted
  • An encryption unit configured to encrypt the service data to be encrypted by using the quantum key to generate a ciphertext
  • An optical transport network OTN processor configured to insert the ciphertext into a set byte in an OTN overhead byte, and encapsulate the OTN frame that includes the ciphertext;
  • the electro-optical conversion module is configured to convert the OTN frame from an electrical signal to an optical signal and transmit the signal to the receiving device.
  • the ciphertext is inserted into the set byte in the OTN overhead byte, and encapsulated into The OTN frame containing the ciphertext is transmitted after electro-optical conversion, and the service data to be encrypted is encrypted by using the quantum key, thereby ensuring the security of the service data transmission. Further, the ciphertext is encapsulated in the OTN overhead word.
  • the set bytes in the section therefore, enable encrypted transmission of highly confidential services.
  • the encryption unit is specifically configured to: encrypt the service data to be encrypted by using a one-time encryption algorithm and the quantum key to generate a ciphertext.
  • the directly acquired quantum key encrypts the service data, and the scheme is simple and easy to implement under the premise of ensuring the security of the data transmission.
  • the encryption unit includes a one-time encryption unit and a key generation unit;
  • the key generating unit is configured to perform a code spreading process on the quantum key to generate a new key or reuse the quantum key to generate a new key;
  • the one-time-one-secret encryption unit is configured to encrypt the service data to be encrypted by using a one-time encryption algorithm and the new key to generate a ciphertext.
  • the method of spreading and reusing the acquired quantum key and encrypting the service data enables encryption of more business data.
  • the set byte in the OTN overhead byte is a set byte in an optical channel payload unit OPU overhead byte or a set byte in an optical channel data unit ODU overhead byte.
  • the set byte in the OTU overhead byte of the optical channel data unit is a set byte in an optical channel payload unit OPU overhead byte or a set byte in an optical channel data unit ODU overhead byte.
  • the set byte in the ODU overhead byte is a general communication channel byte in the ODU overhead byte; the set byte in the OTU overhead byte is in the OTU overhead byte. Universal communication channel byte.
  • the general communication channel byte used to convey general communication information in the OTN overhead is designed as the set byte in the ODU overhead byte or the set byte in the OTU overhead byte, because in the actual OTN In the device, usually these common communication channel bytes are reserved unused, and can ensure high-speed transmission of service data, which does not affect the function transmission of the original bytes in the OTN frame, and ensures the high speed and security of ciphertext transmission. Sex.
  • the set byte in the ODU overhead byte is GCC1 byte and GCC2 byte
  • the set byte in the OTU overhead byte is GCC0 byte.
  • the GCC1 byte is located in the 1st to 2nd columns of the 4th row in the OTN frame; the GCC2 byte is located in the 3rd to 4th columns of the 4th row in the OTN frame; the GCC0 byte Located in the 11th to 12th columns of the 1st line in the OTN frame.
  • the set byte in the OTN overhead byte is an OPU overhead byte or an ODU overhead byte or a reserved byte in an OTU overhead byte, and the reserved byte is a RES byte.
  • the reserved bytes in the OPU overhead byte or the ODU overhead byte or the OTU overhead byte are reserved for the reserved bytes. Since the reserved bytes in the OTN device also retain the unused overhead bytes, This design enables secure transmission of ciphertext.
  • the OTN processor includes an OTU processing unit, configured to insert the ciphertext into an OPU overhead byte or an ODU overhead byte or a set byte in an OTU overhead byte, and package the packet into an inclusion The OTN frame of the ciphertext.
  • the OTN processor includes an OTU processing unit and an ODU processing unit;
  • the ODU processing unit is configured to insert the ciphertext into a set byte in an ODU overhead byte or an OPU overhead byte, and output the obtained ODU unit to the OTU processing unit;
  • the OTU processing unit is configured to encapsulate the ODU unit into an OTN frame that includes the ciphertext.
  • the OTN processor includes an OTU processing unit, an ODU processing unit, and an OPU processing unit;
  • the OPU processing unit is configured to insert the ciphertext into a set byte in an OPU overhead byte, and output the obtained OPU unit to the ODU processing unit;
  • the ODU processing unit is configured to process the OPU unit to obtain an ODU unit, and output the ODU unit to the OTU processing unit;
  • the OTU processing unit is configured to encapsulate the ODU unit into an OTN frame that includes the ciphertext.
  • an embodiment of the present invention provides a method for encrypting, including:
  • the first optical transport network OTN device acquires a quantum key and service data to be encrypted
  • the OTN frame is converted from an electrical signal to an optical signal and transmitted to the second OTN device.
  • the encrypting the service data to be encrypted by using the quantum key to generate a ciphertext includes:
  • the set byte in the OTN overhead byte is a set byte in an optical channel payload unit OPU overhead byte or a set byte in an optical channel data unit ODU overhead byte.
  • the set byte in the OTU overhead byte of the optical channel data unit is a set byte in an optical channel payload unit OPU overhead byte or a set byte in an optical channel data unit ODU overhead byte.
  • the set byte in the ODU overhead byte is a general communication channel byte in the ODU overhead byte; the set byte in the OTU overhead byte is in the OTU overhead byte. Universal communication channel byte.
  • the set byte in the ODU overhead byte is GCC1 byte and GCC2 byte
  • the set byte in the OTU overhead byte is GCC0 byte.
  • the GCC1 byte is located in the 1st to 2nd columns of the 4th row in the OTN frame; the GCC2 byte is located in the 3rd to 4th columns of the 4th row in the OTN frame; the GCC0 byte Located in the 11th to 12th columns of the 1st line in the OTN frame.
  • the set byte in the OTN overhead byte is an OPU overhead byte or an ODU overhead byte or a reserved byte in an OTU overhead byte, and the reserved byte is a RES byte.
  • an embodiment of the present invention provides a method for decrypting, including:
  • the second optical transmission network OTN device receives the optical signal including the ciphertext sent by the first OTN device;
  • an apparatus for decrypting including:
  • An interface unit configured to receive an optical signal that includes a ciphertext sent by the sending device
  • a photoelectric conversion module configured to convert the optical signal into an electrical signal to obtain an optical transmission network OTN frame including ciphertext
  • An OTN processor configured to extract a ciphertext from a set byte in an OTN overhead byte in the OTN frame, and output the ciphertext to the decryption unit;
  • the decrypting unit is configured to perform decryption processing on the extracted ciphertext by using an encryption algorithm and a quantum key acquired by the sending device to obtain service data before the encryption process.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the first OTN device of the first aspect, which includes a program designed to perform the above aspects.
  • the device for encrypting can encrypt the service data to be encrypted by using the obtained quantum key to generate a ciphertext, and insert the ciphertext into a set byte in the OTN overhead byte, and package the package into
  • the ciphertext OTN frame is transmitted after electro-optical conversion, and the service data to be encrypted is encrypted by using the quantum key, thereby ensuring the security of the service data transmission, and further, the ciphertext is encapsulated in the OTN overhead byte.
  • the setting byte in the middle enables the encrypted transmission of highly confidential services.
  • FIG. 1 is a schematic diagram of a network architecture of an OTN secure transmission network
  • FIG. 2 is a schematic diagram of service processing logic functions of a general OTN device
  • FIG. 3 is a schematic diagram of a frame structure of an OTN frame
  • FIG. 4 is a schematic diagram showing the location of an OTN overhead byte in an OTN frame
  • FIG. 5A, FIG. 5B, FIG. 5C, and FIG. 5D are schematic diagrams showing the structure of an apparatus for encryption according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of an apparatus for decrypting according to an embodiment of the present invention.
  • FIG. 7A, FIG. 7B and FIG. 7C are process intentions of implementing encryption and decryption in a system for encryption and decryption according to an embodiment of the present invention
  • FIG. 8 is a flowchart of an encryption method according to an embodiment of the present invention.
  • FIG. 9 is a flowchart of a decryption method in an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a network architecture of an OTN secure transmission network.
  • the OTN secure transmission network includes multiple OTN devices, and each OTN device includes one or more encrypted optical transmission units (Optical Channel Transport). Unit, OTU), these OTU ports are connected by fiber optic and other optically functioning OTN devices.
  • OTU optical Channel Transport Unit
  • the main function of the OTN device is to photoelectrically convert the business data input by the customer and map it to different OPUs.
  • the OPU unit inserts the OPU overhead and the ODU overhead, performs OTU overhead processing, inserts into different optical transmission units, and finally transmits the optical fiber to another OTN device after being converted by electro-optical conversion.
  • Figure 2 shows the function of the service processing logic of a general OTN device.
  • the OPU processing unit, the ODU processing unit, and the OTU processing unit in Figure 2 are logical functional divisions. In the actual device, the three logical functional units are usually Integrated into a chip, such a chip is called an OTN processor.
  • the frame structure of the OTN frame defined in I TU-T G.709 is as shown in FIG. 3, and specifically includes the following three areas:
  • Optical channel payload unit capable of mapping client signals into a fixed frame structure (digital envelope), the frame structure of which includes but is not limited to synchronous transmission module n-level (Synchronous Transport Module) Level N, STM-N), Internet Protocol (IP) packet, Asynchronous Transfer Mode (ATM) cell, Ethernet frame, etc.
  • ODUk Optical channel data unit
  • Optical channel transmission unit which can provide Forward Error Correction (FEC), optical segment protection and monitoring functions. This layer is also called the field layer.
  • FEC Forward Error Correction
  • the OTN cost in the OTN frame includes the OTU cost, the OPU cost, and the ODU cost.
  • the specific overhead bytes are as shown in Figure 4, including:
  • FAS byte frame positioning unit byte, located in the first 1-6 column;
  • MFAS byte multiframe positioning unit byte, located in the sixth to eighth columns of the first row, supports up to 256 frames of multiframes;
  • SM byte segment monitor byte, located in the 8th to 10th byte of the first line;
  • GCC0/GCC1/GCC2 bytes Specialized general communication channel bytes provided for OTN;
  • TCM ACT byte Bytes for activation and deactivation of connection monitoring
  • TCM1-6 byte for the 6-layer connection monitoring byte
  • FTFL byte Byte for fault type and fault location
  • PM byte byte used for channel monitoring
  • EXP byte the trial byte
  • APS/PCC Byte Byte for automatic protection switching and protection of the communication channel
  • JC byte code rate adjustment control byte
  • PSI byte payload structure identification byte
  • NJO byte the byte used for positive code rate adjustment
  • PJO byte Byte for negative code rate adjustment.
  • the GCC0 to GCC2 bytes are dedicated bytes for transmitting general communication information in the OTN overhead. Generally, in actual OTN devices, these bytes are reserved and unused, and in addition, other reservations are included in the OTN. Unused overhead bytes, such as RES bytes. It can be seen from Figure 4 that the GCC1 byte is located in the 1st to 2nd columns of the 4th row in the OTN frame; the GCC2 byte is located in the 3rd row of the OTN frame. ⁇ 4 columns; GCC0 bytes are located in the 11th to 12th columns of the 1st line in the OTN frame. The RES byte exists in the OTU overhead byte, the ODU overhead byte, and the OPU overhead byte.
  • the OTN frame is received at the transmitting end when the encryption scheme is performed in the prior art, since the OTN frame includes an OPU divided into a plurality of slots, the slots are grouped into a plurality of slot blocks, and two are selected. One or more time slot blocks are used for encryption, and encryption/authentication is performed in parallel to generate an encrypted OTN frame, wherein only certain time slot blocks in the encrypted OTN frame are encrypted.
  • the ODU0 rate is 1.25 Gbps, which is far higher due to its very high data rate and continuous transmission service.
  • the ODU0 cannot be encrypted using the quantum key combined with the one-time encryption algorithm. Therefore, to encrypt the optical channel payload unit, only the traditional encryption method can be selected, and the unconditional security of the encrypted service data cannot be guaranteed, and the highly confidential service data encryption processing cannot be realized.
  • the present invention provides a new encryption scheme for encrypting service data to be encrypted using a quantum key to generate a ciphertext; inserting the ciphertext into a set byte in an OTN overhead byte, preferably, the setting The byte is GCC0 to GCC2 bytes; and is encapsulated into an OTN frame containing the ciphertext; the OTN frame is converted from an electrical signal to an optical signal and transmitted to other devices, so that the service data is performed by using a quantum key.
  • Once encrypted it can ensure the unconditional security of the key, so it can guarantee the unconditional security of the encrypted business data, and can realize the encryption processing of highly confidential business data.
  • the ciphertext is inserted into one or more bytes of GCC0 GCC2 bytes in the OTN overhead byte, GCC0
  • the GCC2 byte is used to transmit general communication information in the OTN overhead.
  • these bytes are reserved and unused, and the ciphertext transmission rate supported by the GCC0 to GCC2 bytes is the largest.
  • the maximum rate supported by an OTU2 service GCC0, GCC1, and GCC2 overhead is 1.3 Mbps, and the maximum rate supported by GCC0 to GCC2 bytes is 3.9 Mbps, which can satisfy confidential telephones, lower definition confidential videos, confidential files,
  • OTU4, OTUC2, OTUC4 or multiple OTU2 and OTU3 parallel modes can be used for high definition confidential video transmission to meet the transmission requirements.
  • FIG. 5A is a schematic structural diagram of an apparatus for encryption according to an embodiment of the present invention.
  • an apparatus 500 for encryption provided by an embodiment of the present invention includes:
  • the interface unit 501 is configured to acquire a quantum key and service data to be encrypted.
  • the encryption unit 502 is configured to encrypt the service data to be encrypted by using the quantum key to generate a ciphertext.
  • the OTN processor 503 is configured to insert the ciphertext into a set byte in the OTN overhead byte and encapsulate the OTN frame that includes the ciphertext.
  • the electro-optical conversion module 504 is configured to convert the OTN frame from an electrical signal to an optical signal and transmit the signal to the receiving device.
  • the encryption unit 502 is specifically configured to: encrypt the service data to be encrypted by using a one-time encryption algorithm and the quantum key to generate a ciphertext.
  • the encryption unit 502 includes a one-time encryption unit 5022 and a key generation unit 5021;
  • the key generating unit 5021 is configured to perform a code spreading process on the quantum key to generate a new key or perform a reusing process on the quantum key to generate a new key.
  • the one-time encryption unit 5022 is configured to encrypt the service data to be encrypted by using a one-time encryption algorithm and the new key to generate a ciphertext.
  • the set byte in the OTN overhead byte is a set byte in the OPU overhead byte or a set byte in the ODU overhead byte or a set byte in the OTU overhead byte.
  • the set byte in the ODU overhead byte is a general communication channel byte in the ODU overhead byte; the set byte in the OTU overhead byte is a general communication in the OTU overhead byte. Channel byte.
  • the set byte in the ODU overhead byte is GCC1 byte and GCC2 byte
  • the set byte in the OTU overhead byte is GCC0 byte.
  • the GCC1 byte is located in the first to second columns of the fourth row in the OTN frame; the GCC2 byte is located in the third to fourth columns of the fourth row in the OTN frame; and the GCC0 byte is located in the OTN frame.
  • the 11th to 12th columns of the 1st row; the GCC0 bytes are located in the 11th to 12th columns of the 1st row in the OTN frame.
  • the set byte is a reserved byte in an OPU overhead byte or an ODU overhead byte or an OTU overhead byte, and the reserved byte is a RES byte.
  • the interface unit 501 is specifically configured to receive a quantum key sent by another quantum key distribution device.
  • the device 500 further includes: a quantum key generation unit 505, configured to generate a quantum key, and send the same to the interface unit 501.
  • a quantum key generation unit 505 configured to generate a quantum key, and send the same to the interface unit 501.
  • the OTN processor 503 includes an OTU processing unit 5031, configured to insert the ciphertext into an OPU overhead byte or an ODU overhead byte or an ODU overhead byte.
  • the byte is set and encapsulated into an OTN frame containing the ciphertext.
  • the OTN processor 503 includes an OTU processing unit 5031 and an ODU processing unit 5032;
  • the ODU processing unit 5032 is configured to insert the ciphertext into a set byte in an ODU overhead byte or an OPU overhead byte, and output the obtained ODU unit to the OTU processing unit 5031;
  • the OTU processing unit 5031 is configured to encapsulate the ODU unit into an OTN frame that includes the ciphertext.
  • the OTN processor includes an OTU processing unit 5031, an ODU processing unit 5032, and an OPU processing unit 5033;
  • the OPU processing unit 5033 is configured to insert the ciphertext into a set byte in an OPU overhead byte, and output the obtained OPU unit to the ODU processing unit 5032;
  • the ODU processing unit 5032 is configured to process the OPU unit to obtain an ODU unit, and output the ODU unit to the OTU processing unit 5031;
  • the OTU processing unit 5031 is configured to encapsulate the OPU unit into an OTN frame that includes the ciphertext.
  • the service data to be encrypted is any combination of a confidential phone, a confidential video, a confidential file, a confidential control signaling, a key, or a password.
  • the device for encrypting can encrypt the service data to be encrypted by using the obtained quantum key to generate a ciphertext, and insert the ciphertext into the OTN overhead byte.
  • the fixed byte is encapsulated into an OTN frame containing the ciphertext, and is transmitted after electro-optical conversion. Since the service data to be encrypted is encrypted by using the quantum key, the security of the service data transmission is ensured, and further, due to the confidentiality
  • the text encapsulates the set bytes in the OTN overhead byte, thus enabling encrypted transmission of highly confidential services.
  • FIG. 6 is a schematic structural diagram of an apparatus for decryption according to an embodiment of the present invention.
  • an apparatus 600 for decryption provided by an embodiment of the present invention includes:
  • the interface unit 601 is configured to receive an optical signal that includes the ciphertext sent by the sending device.
  • the photoelectric conversion module 602 is configured to convert the optical signal into an electrical signal to obtain an optical transmission network OTN frame including ciphertext;
  • the OTN processor 603 is configured to extract the ciphertext from the set byte in the OTN overhead byte in the OTN frame, and output the ciphertext to the decryption unit.
  • the decrypting unit 604 is configured to perform decryption processing on the extracted ciphertext by using an encryption algorithm and a quantum key acquired by the sending device, to obtain service data before the encryption process.
  • an embodiment of the present invention provides a system for encryption and decryption, including a transmitting end and a receiving end.
  • the sending end is the device 500 for encryption
  • the receiving end is the device 600 for decrypting.
  • the encryption and decryption processing flow can be referred to FIG. 7A, FIG. 7B and FIG. 7C.
  • FIG. 7A It can be seen from FIG. 7A that the system can realize the encryption and decryption process of the general service, and more importantly, the encryption and decryption process of the highly confidential service.
  • the encryption process for the highly confidential service data is: the encryption unit 1 reads the highly confidential service data and the quantum key 1 through the interface unit, and encrypts the service data by using the quantum key 1 to output the ciphertext 1
  • the OTN processor inserts the encrypted ciphertext into the set overhead byte of the OTN frame and encapsulates it into a complete OTN frame.
  • the electro-optical conversion module converts the OTN frame output by the OTN processor into an optical signal, and transmits the optical signal to the receiving end through the optical fiber. . Output to the receiving end.
  • the encrypted ciphertext is inserted into the set overhead byte of the OTN frame in the following four manners:
  • Encryption method 1 The OTU processing unit in the OTN processor reads the ciphertext 1, inserts the OPU overhead byte or the ODU overhead byte or the set byte in the ODU overhead byte, and generates a complete OTN frame.
  • Encryption mode 2 The ODU processing unit in the OTN processor reads the ciphertext 1, inserts the set byte in the ODU overhead byte, and outputs the ODU unit to the OTU processing unit to continue the subsequent process.
  • Encryption mode 3 The ODU processing unit in the OTN processor reads the ciphertext 1, inserts the set byte in the OPU overhead byte, and outputs the obtained ODU unit to the OTU processing unit to continue the subsequent process.
  • Encryption method 4 The OPU processing unit in the OTN processor reads the ciphertext 1, inserts the set byte in the OPU overhead byte, and outputs the obtained OPU unit to the ODU processing unit to continue the subsequent process.
  • the general encryption service may be one of services such as Synchronous Digital Hierarchy (SDH), Synchronous Optical Network (SONET), Ethernet, OTN, Fiber Channel, and ATM from other devices.
  • SDH Synchronous Digital Hierarchy
  • SONET Synchronous Optical Network
  • Ethernet OTN
  • Fiber Channel and ATM from other devices.
  • the encryption unit 2 is used to implement encryption processing for general services.
  • the encryption processing procedure of the encryption unit 2 on the transmitting end for the general confidential service data is: usually, the encryption is performed by using a specific encryption algorithm, such as Advanced Encryption Standard (AES) and Data Encryption Standard (Data Encryption Standard). , DES), triple data encryption algorithm (Triple DES, 3DES) and other encryption algorithms; or the quantum key 2 as the key of the encryption algorithm, which can be encrypted in different service processing nodes in the OTN device, processed After that, the electro-optical conversion module converts the OTN frame outputted by the OTN processor into an optical signal, and transmits the optical signal to the receiving end through the optical fiber.
  • AES Advanced Encryption Standard
  • Data Encryption Standard Data Encryption Standard
  • Triple DES triple data encryption algorithm
  • the quantum key 2 as the key of the encryption algorithm
  • the service data is encrypted in different service processing nodes in the OTN device, including the following four situations:
  • Encryption Case 1 The original input service data is encrypted using the encryption unit 2a before being input to the OPU processing unit.
  • Encryption Case 2 After the OPU processing unit processes, the output OPU unit is encrypted using the encryption unit 2b.
  • Encryption Case 3 After the ODU processing unit processes, the output ODU unit is encrypted using the encryption unit 2c.
  • Encryption Case 4 After the OTU processing unit, the output OTU unit is encrypted using the encryption unit 2d.
  • the foregoing encryption units 2a to 2d are only for distinguishing different encryption positions. In practical applications, only one processing node is usually selected for encryption, that is, only one encryption situation is selected for encryption, preferably After the OPU processing unit, the output OPU unit is encrypted.
  • the photoelectric conversion module at the receiving end converts the input optical signal into an electrical signal, recovers the OTN frame, and outputs To the OTN processor, optionally, the OTN processor includes an OTU processing unit, an ODU processing unit, and an OPU processing unit.
  • the OTN processor inserts the encrypted ciphertext into the byte position of the set byte in the OTN overhead byte, and can extract the ciphertext 1 as follows:
  • the OTU processing unit in the OTN processor reads the OTN frame, and extracts the ciphertext 1 from the OPU overhead byte or the ODU overhead byte or the set byte in the ODU overhead byte, and outputs To the decryption unit.
  • Decryption method 2 For the above encryption method 2, the ODU processing unit in the OTN processor reads the ODU unit, extracts the ciphertext 1 from the set byte in the ODU overhead byte, and outputs it to the decryption unit.
  • Decryption method 3 For the above encryption method 3, the ODU processing unit in the OTN processor reads the ODU unit, extracts the ciphertext 1 from the set byte in the OPU overhead byte, and outputs it to the decryption unit.
  • Decryption method 4 for the above encryption method 4, the OPU processing unit in the OTN processor reads the OPU unit, extracts the ciphertext 1 from the set byte in the OPU overhead byte, and outputs it to the decryption unit.
  • the decryption unit reads the ciphertext 1 and the quantum key used in the encryption process, and after decrypting the ciphertext, outputs highly confidential service data.
  • the decryption unit 2 For the decryption of the general confidential service data, the decryption unit 2 needs to perform decryption processing with the inverse process of the corresponding encryption process, and the encryption algorithm used for decryption needs to be completely consistent with the key used for encryption.
  • the transmitting end performs encryption using the encryption unit 2a
  • the receiving end decrypts using the decryption unit 2a
  • the transmitting end uses the encryption unit 2b for encryption
  • the receiving end uses the decryption unit 2b for decryption
  • the transmitting end uses the encryption unit 2c
  • the transmitting end uses the encryption unit 2d
  • the receiving end decrypts using the decryption unit 2d, and details are not described herein.
  • FIG. 7B shows the process of encrypting and decrypting only the highly confidential service, and the process is completely consistent with the process of encrypting and decrypting the highly confidential service of FIG. 7A, and details are not described herein again.
  • FIG. 7C is a schematic diagram showing the encryption principle of the cryptographic unit using the quantum key for the acquired highly confidential service data.
  • the cryptographic unit includes a one-time cryptographic unit and a key generation unit.
  • the key generation unit performs a spread code or reuse process on the acquired quantum key to generate a new key transmission to the primary-one-one encryption unit, and the primary-one-one encryption unit encrypts the highly confidential service data by using the new key.
  • Ciphertext 1 in another possible implementation manner, the primary one-density encryption unit directly acquires a quantum key, and uses the quantum key to encrypt highly confidential service data to generate ciphertext 1, and at this time, key generation The unit may not exist.
  • FIG. 8 is a schematic flow chart showing an encryption method provided by an embodiment of the present invention.
  • the embodiment of the present invention provides an encryption method, which is implemented by a first OTN device, and the first OTN device may be the device or the sender for encryption, as shown in FIG.
  • Step 801 The first OTN device acquires a quantum key and service data to be encrypted.
  • Step 802 Encrypt the service data to be encrypted by using the quantum key to generate a ciphertext.
  • Step 803 Insert the ciphertext into a set byte in the OTN overhead byte, and encapsulate the OTN frame into the ciphertext.
  • Step 804 Convert the OTN frame from an electrical signal to an optical signal and then transmit it to the second OTN device.
  • the encrypting the service data to be encrypted by using the quantum key to generate a ciphertext includes the following three implementation manners:
  • the first implementation manner encrypting the service data to be encrypted by using a one-time encryption algorithm and the quantum key to generate a ciphertext.
  • a string of 1024-bit quantum keys combined with a one-time-one-density algorithm encrypts 1024-bit or shorter service data.
  • the second implementation manner is: performing a code-spreading process on the quantum key to generate a new key, and encrypting the service data to be encrypted by using a one-time encryption algorithm and the new key to generate a ciphertext.
  • a series of 256-bit quantum key is subjected to 4 times of spreading processing to generate a string of 1024-bit keys.
  • the 1024-bit or shorter service data can be encrypted by combining the one-time-one-density algorithm.
  • a third implementation manner is: performing re-use processing on the quantum key to generate a new key, and encrypting the service data to be encrypted by using a one-time encryption algorithm and the new key to generate a ciphertext.
  • a string of 256-bit quantum keys is reused 4 times, a string of 1024-bit keys can be generated.
  • 1024-bit or shorter service data can also be encrypted.
  • the set byte in the OTN overhead byte is a set byte in an optical channel payload unit OPU overhead byte or a set byte or optical channel in an optical channel data unit ODU overhead byte.
  • the set byte in the data unit OTU overhead byte is a set byte in an optical channel payload unit OPU overhead byte or a set byte or optical channel in an optical channel data unit ODU overhead byte.
  • the set byte in the ODU overhead byte is a general communication channel byte in the ODU overhead byte; the set byte in the OTU overhead byte is a general communication in the OTU overhead byte. Channel byte.
  • the set byte in the ODU overhead byte is GCC1 byte and GCC2 byte
  • the set byte in the OTU overhead byte is GCC0 byte.
  • the GCC1 byte is located in the first to second columns of the fourth row in the OTN frame; the GCC2 byte is located in the third to fourth columns of the fourth row in the OTN frame; and the GCC0 byte is located in the OTN frame. Columns 11 to 12 of the first row.
  • the set byte in the OTN overhead byte is an OPU overhead byte or an ODU overhead byte or a reserved byte in an OTU overhead byte, and the reserved byte is a RES byte.
  • the first OTN device acquires the quantum key
  • the following two methods are included:
  • the first way the first OTN device generates a quantum key.
  • the second mode the first OTN device receives the quantum key distributed by the other quantum key distribution device through the interface unit of the first OTN device.
  • the embodiment of the present invention provides a decryption method, which is implemented by a second OTN device, and the second OTN device may be the device or the receiving end for decryption, as shown in FIG.
  • Step 901 The second OTN device receives the optical signal including the ciphertext sent by the first OTN device.
  • Step 902 Convert the optical signal into an electrical signal to obtain an OTN frame containing ciphertext.
  • Step 903 Extract a ciphertext from a set byte in an OTN overhead byte in the OTN frame.
  • Step 904 Perform decryption processing on the extracted ciphertext by using the encryption algorithm and the quantum key acquired by the first OTN device to obtain service data before the encryption process.
  • the first OTN device acquires a quantum key and service data to be encrypted; and uses the quantum key to encrypt the service data to be encrypted to generate a ciphertext; Inserting the ciphertext into a set byte in the OTN overhead byte, encapsulating the OTN frame containing the ciphertext; converting the OTN frame from an electrical signal to an optical signal, and transmitting the OTN frame to the second OTN device, thereby enabling the second
  • the OTN device can extract the corresponding ciphertext according to the location of the ciphertext insertion into the OTN overhead byte. Since the quantum key is used to encrypt the service data to ensure the unconditional security of the service data transmission, the ciphertext is inserted into the OTN overhead word.
  • the set byte in the section enables encryption processing of highly confidential services.
  • embodiments of the present invention can be provided as a method, system, or computer program.
  • Product may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware.
  • the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Electromagnetism (AREA)
  • Computer Security & Cryptography (AREA)
  • Optics & Photonics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种加密、解密的方法及设备，以解决现有的业务数据的加密过程无法保证其被加密的业务数据的无条件安全性，不能实现高度机密的业务数据的加密处理的问题。本发明中用于加密的设备获取量子密钥和待加密的业务数据；利用所述量子密钥对所述待加密的业务数据进行加密生成密文；将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；将所述OTN帧从电信号转换为光信号后传输至第二OTN设备，由于采用量子密钥对业务数据进行加密，能够确保业务数据传输的无条件安全性，同时，将密文插入OTN开销字节中的设定字节，能够实现高度机密业务的加密处理。

Description

一种加密、解密的方法及设备
本申请要求在2016年11月11日提交中国专利局、申请号为201611001858.5、发明名称为“一种加密、解密的方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及量子通信领域，尤其涉及一种加密、解密的方法及设备。
背景技术
随着网络技术的快速发展，大量敏感信息需要通过网络传输，人们需要对敏感信息进行保护以免丢失或遭到攻击。加密是保障信息安全的重要手段之一，现有经典加密体系是建立在计算复杂度基础之上的，其存在被破译的可能。经典密码体制中，只有一次一密具有无条件安全性，而如何产生大量的随机数密钥一直是个难题，量子密钥分配(Quantum Key Distribution，QKD)技术的出现解决了这个难题。
QKD具体是以量子态作为信息单元，利用量子力学的一些原理来传输和保护信息，通常把通信双方以量子态为信息载体，利用量子力学原理，通过量子信道传输，在保密通信双方之间建立共享密钥。其安全性是由量子力学中的“海森堡测不准关系”及“单量子不可复制定理”或纠缠粒子的相干性和非局域性等量子特性来保证的。
2012年美国CISCO公司申请了光传送网络中的时隙加密专利，对应中国专利申请公开号为CN104718720A，该专利申请提供了如下加密方案：
光传送网络(Optical Transport Network，OTN)帧包括被划分为多个时隙的光通道净负荷单元(Optical Channel Payload Unit，OPU)，该OTN帧在发送端被接收，将时隙分组为多个时隙块，选择两个或更多个时隙块以进行加密，并且并行地执行加密/认证以生成经加密的OTN帧，其中，经加密的OTN帧中仅某些时隙块被加密。
由于光通道净负荷单元最小单位为ODU0，且OTN设备只能将该最小单元做为一个整体进行加密、解密处理，ODU0速率为1.25Gbps，由于其数据速率非常高且为连续传输业务，远远高于现有量子密钥分发系统能够生成的密钥的速度，因此，要对光通道净荷单元进行加密只能选择传统加密方法，无法保证其被加密的业务数据的无条件安全性，不能实现高度机密的业务数据的加密处理。
发明内容
本发明实施例提供一种加密、解密的方法及设备，以解决现有的业务数据的加密过程无法保证其被加密的业务数据的无条件安全性，不能实现高度机密的业务数据的加密处理的问题。
本发明实施例提供的具体技术方案如下：
第一方面，本发明实施例提供一种用于加密的设备，包括：
接口单元，用于获取量子密钥和待加密的业务数据；
加密单元，用于利用所述量子密钥对所述待加密的业务数据进行加密生成密文；
光传送网络OTN处理器，用于将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；
电光转换模块，用于将所述OTN帧从电信号转换为光信号后传输至接收设备。
这样，由于在对业务数据进行加密的过程中能够利用获取的量子密钥对待加密的业务数据进行加密生成密文，并将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧，进行电光转换后传输，由于采用量子密钥对待加密的业务数据进行加密，因此保证了业务数据传输的安全性，进一步的，由于将密文封装在OTN开销字节中的设定字节，因此，能够实现高度机密业务的加密传送。
一种可能的设计中，所述加密单元具体用于：利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文。
这种设计中，直接获取的量子密钥对业务数据进行加密，在保证数据传输安全性的前提下，方案简单，易于实现。
一种可能的设计中，所述加密单元包括一次一密加密单元和密钥生成单元；
所述密钥生成单元，用于对所述量子密钥进行扩码处理生成新的密钥或对所述量子密钥进行重用处理生成新的密钥；
所述一次一密加密单元，用于利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
这种设计中，针对获取的量子密钥进行扩码和重用的方法并对业务数据进行加密，从而能够对更多的业务数据做加密。
一种可能的设计中，所述OTN开销字节中的设定字节为光通道净荷单元OPU开销字节中的设定字节或光通道数据单元ODU开销字节中的设定字节或光通道数据单元OTU开销字节中的设定字节。
这种设计中，只要满足OTN开销字节中的设定字节为OPU开销字节中的设定字节或ODU开销字节中的设定字节或OTU开销字节中的设定字节这种需求，就能实现密文的加密传输，实现简单。
一种可能的设计中，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
这种设计中，将OTN开销中用于传递通用通信信息的通用通信通道字节设计为ODU开销字节中的设定字节或OTU开销字节中的设定字节，因为在实际的OTN设备中，通常这些通用通信通道字节都是保留未使用的，而且能够保证业务数据的高速传输，既不影响OTN帧中原有字节的功能传输，还能保证密文传输的高速性和安全性。
一种可能的设计中，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
一种可能的设计中，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列。
一种可能的设计中，所述OTN开销字节中的设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
这种设计中，将OPU开销字节或ODU开销字节或OTU开销字节中的保留字节设计保留字节，由于OTN设备中的保留字节也是保留未使用的开销字节，因此，采用这种设计能够实现密文的安全传输。
一种可能的设计中，所述OTN处理器包括OTU处理单元，用于将所述密文插入OPU开销字节或ODU开销字节或OTU开销字节中的设定字节，封装成包含所述密文的OTN帧。
一种可能的设计中，所述OTN处理器包括OTU处理单元和ODU处理单元；
所述ODU处理单元，用于将所述密文插入ODU开销字节或OPU开销字节中的设定字节，将得到的ODU单元输出至所述OTU处理单元；
所述OTU处理单元，用于将所述ODU单元封装成包含所述密文的OTN帧。
一种可能的设计中，所述OTN处理器包括OTU处理单元、ODU处理单元和OPU处理单元；
所述OPU处理单元，用于将所述密文插入OPU开销字节中的设定字节，将得到的OPU单元输出至所述ODU处理单元；
所述ODU处理单元，用于对所述OPU单元进行处理得到ODU单元，将所述ODU单元输出至所述OTU处理单元；
所述OTU处理单元，用于将所述ODU单元封装成包含所述密文的OTN帧。
第二方面，本发明实施例提供一种加密的方法，包括：
第一光传送网络OTN设备获取量子密钥和待加密的业务数据；
利用所述量子密钥对所述待加密的业务数据进行加密生成密文；
将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；
将所述OTN帧从电信号转换为光信号后传输至第二OTN设备。
一种可能的设计中，所述利用所述量子密钥对所述待加密的业务数据进行加密生成密文，包括：
利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文，或
对所述量子密钥进行扩码处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文；或
对所述量子密钥进行重用处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
一种可能的设计中，所述OTN开销字节中的设定字节为光通道净荷单元OPU开销字节中的设定字节或光通道数据单元ODU开销字节中的设定字节或光通道数据单元OTU开销字节中的设定字节。
一种可能的设计中，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
一种可能的设计中，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
一种可能的设计中，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列。
一种可能的设计中，所述OTN开销字节中的设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
第三方面，本发明实施例提供一种解密的方法，包括：
第二光传送网络OTN设备接收第一OTN设备发送的包含密文的光信号；
将所述光信号转换为电信号得到包含密文的OTN帧；
从所述OTN帧中的OTN开销字节中的设定字节中提取密文；
针对所述提取的密文利用所述第一OTN设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
第四方面，本发明实施例提供一种用于解密的设备，包括：
接口单元，用于接收发送设备发送的包含密文的光信号；
光电转换模块，用于将所述光信号转换为电信号得到包含密文的光传送网络OTN帧；
OTN处理器，用于从所述OTN帧中的OTN开销字节中的设定字节中提取密文，输出至解密单元；
所述解密单元，用于针对所述提取的密文利用所述发送设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
第五方面，本发明实施例提供一种计算机存储介质，用于储存为上述第一方面所述的第一OTN设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
本发明实施例中，用于加密的设备能够利用获取的量子密钥对待加密的业务数据进行加密生成密文，并将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧，进行电光转换后传输，由于采用量子密钥对待加密的业务数据进行加密，因此保证了业务数据传输的安全性，进一步的，由于将密文封装在OTN开销字节中的设定字节，因此，能够实现高度机密业务的加密传送。
附图说明
图1为OTN安全传输网络的网络架构示意图；
图2为通用OTN设备的业务处理逻辑功能示意图；
图3为OTN帧的帧结构示意图；
图4为OTN帧中的OTN开销字节位置示意图；
图5A、图5B、图5C和图5D为本发明实施例中的用于加密的设备结构示意图；
图6为本发明实施例中的用于解密的设备结构示意图；
图7A、图7B和图7C为本发明实施例中用于加解密的系统实现加解密的过程意图；
图8为本发明实施例中的加密方法流程图；
图9为本发明实施例中的解密方法流程图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，并不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1所示为，OTN安全传输网络的网络架构示意图，由图1可知，在OTN安全传输网络中包含多个OTN设备，每个OTN设备包含一个或多个加密的光传输单元(Optical Channel Transport Unit，OTU)，这些OTU的端口通过光纤和或其他光功能的OTN设备连接在一起。
OTN设备的主要功能是将客户输入的业务数据进行光电转换后，经OPU映射到不同的 OPU单元，插入OPU开销和ODU开销后，进行OTU开销处理，插入到不同的光传输单元，最后经电光转换后由光纤传输到另一OTN设备。图2给出了一个通用OTN设备的业务处理逻辑功能示意图，图2中的OPU处理单元、ODU处理单元、OTU处理单元是逻辑功能上的划分，实际设备中，这三个逻辑功能单元通常是集成到一个芯片中的，这样的芯片称为OTN处理器。
在I TU-T G.709中定义的OTN帧的帧结构如图3所示，具体包含以下三个区域：
1)光通道净荷单元(OPUk)，能够实现将客户信号映射进一个固定的帧结构(数字包封)的功能，所述信号的帧结构包括但不限于同步传输模块n级(Synchronous Transport Module level N，STM-N)，网络协议(Internet Protocol，I P)分组，异步传输模式(Asynchronous Transfer Mode，ATM)信元，以太网帧等各种格式。
2)光通道数据单元(ODUk)，能够提供与信号无关的连通性，连接保护和监控等功能，这一层也叫数据通道层。
3)光通道传输单元(OTUk)，能够提供前向纠错(Forward Error Correction，FEC)，光段保护和监控等功能，这一层也叫数字段层。
OTN帧中的OTN开销包括OTU开销、OPU开销和ODU开销三类，具体的开销字节如图4所示，包括:
FAS字节：帧定位单元字节，位于第一行的第1-6列；
MFAS字节：复帧定位单元字节,位于的第一行的第6～8列，最多支持由256个帧构成的复帧；
SM字节：段监视字节，位于第一行的第8-10字节；
GCC0/GCC1/GCC2字节：为OTN提供的专门的通用通信通道字节；
RES字节：预留字节；
TCM ACT字节：用于连接监视的激活和去激活的字节；
TCM1-6字节：用于6层的连接监视字节；
FTFL字节：用于故障类型和故障定位的字节；
PM字节：用于通道监视的字节；
EXP字节：试验用字节；
APS/PCC字节：用于自动保护倒换和保护通信信道的字节；
JC字节：码速调整控制字节；
PSI字节：载荷结构标识字节；
NJO字节：用于正码速调整的字节；
PJO字节：用于负码速调整的字节。
需要说明的是，GCC0～GCC2字节为OTN开销中用于传递通用通信信息的专用字节，在实际的OTN设备中，通常这些字节都是保留未使用，此外，OTN中还包括其它保留未使用的开销字节，如：RES字节，从图4中可以看出GCC1字节位于OTN帧中第4行的第1～2列；GCC2字节位于OTN帧中第4行的第3～4列；GCC0字节位于OTN帧中第1行的第11～12列。而RES字节在OTU开销字节、ODU开销字节和OPU开销字节中均存在。由于现有技术中加密方案在进行加密时，OTN帧在发送端被接收后，由于OTN帧包括被划分为多个时隙的OPU，因此，将时隙分组为多个时隙块，选择两个或更多个时隙块以进行加密，并且并行地执行加密/认证以生成经加密的OTN帧，其中，经加密的OTN帧中仅某些时隙块被加密。
由于OPU单元的最小单位为ODU0，且OTN设备只能将该最小单元做为一个整体进行加密、解密处理，ODU0的速率为1.25Gbps，由于其数据速率非常高且为连续传输业务，远远高于现有量子密钥分发系统能够生成的密钥的速度，无法使用量子密钥结合一次一密加密算法对ODU0进行加密。因此，要对光通道净荷单元进行加密只能选择传统的加密方法，无法保证其被加密的业务数据的无条件安全性，不能实现高度机密的业务数据的加密处理。因此，本发明提供一种新的加密方案，利用量子密钥对待加密的业务数据进行加密生成密文；将所述密文插入OTN开销字节中的设定字节，优选的，该设定字节为GCC0～GCC2字节；并封装成包含所述密文的OTN帧；将所述OTN帧从电信号转换为光信号后传输至其他设备，这样，由于采用量子密钥对业务数据进行一次一密加密，能够确保密钥的无条件安全性，因此能够保证其被加密的业务数据的无条件安全性，还能实现高度机密的业务数据的加密处理。
具体的，将加密后的密文插入OTN开销字节中的设定字节时，优选的，将密文插入OTN开销字节中的GCC0～GCC2字节中的一个或者多个字节，GCC0～GCC2字节为OTN开销中用于传递通用通信信息的，在实际的OTN设备中，通常这些字节都是保留未使用，而且采用GCC0～GCC2字节能够支持的密文传递速率最大，其中，对于一个OTU2业务GCC0、GCC1、GCC2开销支持的最大速率均为1.3Mbps，GCC0～GCC2字节开销支持的最大速率为3.9Mbps，完成能够满足机密电话、较低清晰度机密视频、机密文件、机密控制指令、其它密钥或密码的传送需求，对于高清晰度机密视频传送可以采用OTU4、OTUC2、OTUC4或多个OTU2、OTU3并联方式来满足传送需求。
图5A示例性示出了本发明实施例提供的一种用于加密的设备结构示意图。
基于上述网络架构以及相关论述，如图5A所示，本发明实施例提供的一种用于加密的设备500，包括：
接口单元501，用于获取量子密钥和待加密的业务数据.
加密单元502，用于利用所述量子密钥对所述待加密的业务数据进行加密生成密文。
OTN处理器503，用于将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧。
电光转换模块504，用于将所述OTN帧从电信号转换为光信号后传输至接收设备。
可选的，所述加密单元502具体用于：利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文。
可选的，所述加密单元502：包括一次一密加密单元5022和密钥生成单元5021；
所述密钥生成单元5021，用于对所述量子密钥进行扩码处理生成新的密钥或对所述量子密钥进行重用处理生成新的密钥；
所述一次一密加密单元5022，用于利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
可选的，所述OTN开销字节中的设定字节为OPU开销字节中的设定字节或ODU开销字节中的设定字节或OTU开销字节中的设定字节。
可选的，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
可选的，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
可选的，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列；所述GCC0字节位于OTN帧中第1行的第11～12列。
可选的，所述设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
可选的，所述接口单元501，具体用于接收其他的量子密钥分发设备发送的量子密钥。
可选的，所述设备500还包括：量子密钥生成单元505，用于生成量子密钥，并发送至所述接口单元501。
一种可能的实施方式中，参阅图5B所示，所述OTN处理器503包括OTU处理单元5031，用于将所述密文插入OPU开销字节或ODU开销字节或ODU开销字节中的设定字节，封装成包含所述密文的OTN帧。
一种可能的实施方式中，参阅图5C所示，所述OTN处理器503包括OTU处理单元5031和ODU处理单元5032；
所述ODU处理单元5032，用于将所述密文插入ODU开销字节或OPU开销字节中的设定字节，将得到的ODU单元输出至所述OTU处理单元5031；
所述OTU处理单元5031，用于将所述ODU单元封装成包含所述密文的OTN帧。
一种可能的实施方式中，参阅图5D所示，所述OTN处理器包括OTU处理单元5031、ODU处理单元5032和OPU处理单元5033；
所述OPU处理单元5033，用于将所述密文插入OPU开销字节中的设定字节，将得到的OPU单元输出至所述ODU处理单元5032；
所述ODU处理单元5032，用于对所述OPU单元进行处理得到ODU单元，将所述ODU单元输出至所述OTU处理单元5031；
所述OTU处理单元5031，用于将所述OPU单元封装成包含所述密文的OTN帧。
可选的，所述待加密的业务数据为机密电话、机密视频、机密文件、机密控制信令、密钥或密码中的任意种组合。
从上述内容可看出，本发明实施例中，用于加密的设备能够利用获取的量子密钥对待加密的业务数据进行加密生成密文，并将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧，进行电光转换后传输，由于采用量子密钥对待加密的业务数据进行加密，因此保证了业务数据传输的安全性，进一步的，由于将密文封装在OTN开销字节中的设定字节，因此，能够实现高度机密业务的加密传送。
图6示例性示出了本发明实施例提供的一种用于解密的设备的结构示意图。
如图6所示，本发明实施例提供的一种用于解密的设备600，包括：
接口单元601，用于接收发送设备发送的包含密文的光信号；
光电转换模块602，用于将所述光信号转换为电信号得到包含密文的光传送网络OTN帧；
OTN处理器603，用于从所述OTN帧中的OTN开销字节中的设定字节中提取密文，输出至解密单元；
所述解密单元604，用于针对所述提取的密文利用所述发送设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
基于上述实施例，本发明实施例提供一种用于加解密的系统，包括发送端和接收端， 所述发送端为上述用于加密的设备500，所述接收端为上述用于解密的设备600，具体的，加解密处理流程可参阅图7A、图7B和图7C所示。
从图7A中可以看出该系统既能实现一般业务的加解密过程，更重要的是还能实现高度机密业务的加解密过程。
发送端针对高度机密的业务数据的加密处理流程为：加密单元1通过接口单元读入高度机密的业务数据、量子密钥1，利用量子密钥1完成对业务数据的加密后，输出密文1，OTN处理器将加密后的密文插入OTN帧的设定开销字节，并封装成完整的OTN帧，电光转换模块将OTN处理器输出的OTN帧转换为光信号，经过光纤传输到接收端。输出至接收端。
具体的，将加密后的密文插入OTN帧的设定开销字节可采取如下四种方式：
加密方式一：OTN处理器中的OTU处理单元读入密文1，插入OPU开销字节或ODU开销字节或ODU开销字节中的设定字节中，并生成完整的OTN帧。
加密方式二：OTN处理器中的ODU处理单元读入密文1，插入ODU开销字节中的设定字节中，并把ODU单元输出给OTU处理单元，继续后续流程。
加密方式三：OTN处理器中的ODU处理单元读入密文1，插入OPU开销字节中的设定字节中，并把得到的ODU单元输出给OTU处理单元，继续后续流程。
加密方式四：OTN处理器中的OPU处理单元读入密文1，插入OPU开销字节中的设定字节中，并把得到的OPU单元输出给ODU处理单元，继续后续流程。
一般加密业务可为来自其他设备的同步数字体系(Synchronous Digital Hierarchy，SDH)、同步光纤网络(Synchronous Optical Network，SONET)、以太网、OTN、光线通道(Fiber Channel)、ATM等业务的一种或多种，这里，采用加密单元2实现对一般业务的加密处理。
具体的，发送端的加密单元2针对一般机密的业务数据的加密处理流程为：通常采用特定的加密算法对其进行加密，如高级加密标准(Advanced Encryption Standard，AES)、数据加密标准(Data Encryption Standard，DES)、三重数据加密算法(Triple DES，3DES)等加密算法；或将量子密钥2做为加密算法的密钥，在OTN设备内可以在不同的业务处理节点对其进行加密，经过处理后，电光转换模块将OTN处理器输出的OTN帧转换为光信号，经过光纤传输到接收端。
具体的，在OTN设备内在不同的业务处理节点对业务数据进行加密，包括以下四种情形：
加密情形一：在输入到OPU处理单元之前，使用加密单元2a对原始输入的业务数据进行加密。
加密情形二：在OPU处理单元处理之后，使用加密单元2b对输出的OPU单元进行加密。
加密情形三：在ODU处理单元处理之后，使用加密单元2c对输出的ODU单元进行加密。
加密情形四：在OTU处理单元之后，使用加密单元2d对输出的OTU单元进行加密。
需要说明的是，上述加密单元2a～2d只是为了区分不同的加密位置给出的区分，在实际应用中通常只会选择一个处理节点进行加密，即只会选择一种加密情形进行加密，优选地，在OPU处理单元之后，对输出的OPU单元进行加密。
相应的，接收端的光电转换模块将输入的光信号转换为电信号，恢复出OTN帧，输出 给OTN处理器，可选的，所述OTN处理器包括OTU处理单元、ODU处理单元和OPU处理单元。
针对高度机密的业务数据的解密，OTN处理器根据加密后的密文插入到OTN开销字节中设定字节的字节位置，可以采取如下方式提取密文1：
解密方式一，针对上述加密方式一，OTN处理器中的OTU处理单元读入OTN帧，从OPU开销字节或ODU开销字节或ODU开销字节中的设定字节提取密文1，输出到解密单元。
解密方式二，针对上述加密方式二，OTN处理器中的ODU处理单元读入ODU单元，从ODU开销字节中的设定字节提取密文1，输出到解密单元。
解密方式三，针对上述加密方式三，OTN处理器中的ODU处理单元读入ODU单元，从OPU开销字节中的设定字节提取密文1，输出到解密单元。
解密方式四，针对上述加密方式四，OTN处理器中的OPU处理单元读入OPU单元，从OPU开销字节中的设定字节提取密文1，输出到解密单元.
解密单元读取密文1和加密过程中使用的量子密钥，完成对密文的解密后，输出高度机密的业务数据。
针对一般机密的业务数据的解密，解密单元2需采取与对应的加密处理的逆过程进行解密处理，用于解密的加密算法需要和用于加密的密钥完全一致。
具体的，如果发送端使用加密单元2a进行加密，则接收端使用解密单元2a进行解密；如果发送端使用加密单元2b进行加密，则接收端使用解密单元2b进行解密；如果发送端使用加密单元2c进行加密，则接收端使用解密单元2c进行解密；如果发送端使用加密单元2d进行加密，则接收端使用解密单元2d进行解密，在此不再赘述。
图7B给出了仅对高度机密业务加解密过程，其过程和图7A的高度机密业务加解密过程完全一致，在此不再赘述。
图7C给出了加密单元针对获取的高度机密业务数据利用量子密钥的加密原理示意图，可选的，加密单元包括一次一密加密单元和密钥生成单元，一种可能的实施方式中，所述密钥生成单元对获取的量子密钥进行扩码或重用处理生成新的密钥传输至一次一密加密单元，所述一次一密加密单元利用新的密钥对高度机密业务数据进行加密生成密文1；另一种可能的实施方式中，所述一次一密加密单元直接获取量子密钥，利用所述量子密钥对高度机密业务数据进行加密生成密文1，此时，密钥生成单元可以不存在。
图8示例性示出了本发明实施例提供的一种加密方法的流程示意图。
基于相同构思，本发明实施例提供一种加密方法，由第一OTN设备实现，所述第一OTN设备可以为上述用于加密的设备或发送端，如图8所示，包括：
步骤801：第一OTN设备获取量子密钥和待加密的业务数据。
步骤802：利用所述量子密钥对所述待加密的业务数据进行加密生成密文。
步骤803：将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧。
步骤804：将所述OTN帧从电信号转换为光信号后传输至用于第二OTN设备。
具体的，所述利用所述量子密钥对所述待加密的业务数据进行加密生成密文，包括以下三种实现方式：
第一种实现方式：利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文。
例如，利用一串1024bit量子密钥结合一次一密算法对1024bit或更短的业务数据进行加密。
第二种实现方式：对所述量子密钥进行扩码处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
例如，对一串256bit量子密钥进行4倍扩码处理，可以产生一串1024bit密钥，此时，可以结合一次一密算法对1024bit或更短的业务数据进行加密。
第三种实现方式：对所述量子密钥进行重用处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
例如，对一串256bit的量子密钥重用4次，可以产生一串1024bit密钥，此时，也可以对1024bit或更短的业务数据进行加密。
可选的，所述OTN开销字节中的设定字节为光通道净荷单元OPU开销字节中的设定字节或光通道数据单元ODU开销字节中的设定字节或光通道数据单元OTU开销字节中的设定字节。
可选的，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
可选的，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
可选的，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列。
可选的，所述OTN开销字节中的设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
具体的，第一OTN设备获取量子密钥时，包括以下两种方式：
第一种方式：所述第一OTN设备生成量子密钥。
第二种方式：所述第一OTN设备通过所述第一OTN设备的接口单元接收其他量子密钥分发设备分发的量子密钥。
基于相同构思，本发明实施例提供一种解密方法，由第二OTN设备实现，所述第二OTN设备可以为上述用于解密的设备或接收端，如图9所示，包括：
步骤901：第二OTN设备接收第一OTN设备发送的包含密文的光信号。
步骤902：将所述光信号转换为电信号得到包含密文的OTN帧。
步骤903：从所述OTN帧中的OTN开销字节中的设定字节中提取密文。
步骤904：针对所述提取的密文利用所述第一OTN设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
从上述内容可以看出，本发明实施例中，第一OTN设备获取量子密钥和待加密的业务数据；利用所述量子密钥对所述待加密的业务数据进行加密生成密文；将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；将所述OTN帧从电信号转换为光信号后传输至第二OTN设备，从而使第二OTN设备能够根据密文插入OTN开销字节中的位置来提取相应的密文，由于，采用量子密钥对业务数据进行加密确保业务数据传输的无条件安全性，同时，将密文插入OTN开销字节中的设定字节，能够实现高度机密业务的加密处理。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产 品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (20)

  1. 一种用于加密的设备，其特征在于，包括：
    接口单元，用于获取量子密钥和待加密的业务数据；
    加密单元，用于利用所述量子密钥对所述待加密的业务数据进行加密生成密文；
    光传送网络OTN处理器，用于将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；
    电光转换模块，用于将所述OTN帧从电信号转换为光信号后传输至接收设备。
  2. 如权利要求1所述的设备，其特征在于，所述加密单元具体用于：
    利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文。
  3. 如权利要求1所述的设备，其特征在于，所述加密单元包括一次一密加密单元和密钥生成单元；
    所述密钥生成单元，用于对所述量子密钥进行扩码处理生成新的密钥或对所述量子密钥进行重用处理生成新的密钥；
    所述一次一密加密单元，用于利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
  4. 如权利要求1-3任一项所述的设备，其特征在于，所述OTN开销字节中的设定字节为光通道净荷单元OPU开销字节中的设定字节或光通道数据单元ODU开销字节中的设定字节或光通道数据单元OTU开销字节中的设定字节。
  5. 如权利要求4所述的设备，其特征在于，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
  6. 如权利要求4或5所述的设备，其特征在于，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
  7. 如权利要求6所述的设备，其特征在于，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列。
  8. 如权利要求4所述的设备，其特征在于，所述OTN开销字节中的设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
  9. 如权利要求4-8任一项所述的设备，其特征在于，所述OTN处理器包括OTU处理单元，用于将所述密文插入OPU开销字节或ODU开销字节或OTU开销字节中的设定字节，封装成包含所述密文的OTN帧。
  10. 如权利要求4-8任一项所述的设备，其特征在于，所述OTN处理器包括OTU处理单元和ODU处理单元；
    所述ODU处理单元，用于将所述密文插入ODU开销字节或OPU开销字节中的设定字节，将得到的ODU单元输出至所述OTU处理单元；
    所述OTU处理单元，用于将所述ODU单元封装成包含所述密文的OTN帧。
  11. 如权利要求4-8任一项所述的设备，其特征在于，所述OTN处理器包括OTU处理单元、ODU处理单元和OPU处理单元；
    所述OPU处理单元，用于将所述密文插入OPU开销字节中的设定字节，将得到的OPU 单元输出至所述ODU处理单元；
    所述ODU处理单元，用于对所述OPU单元进行处理得到ODU单元，将所述ODU单元输出至所述OTU处理单元；
    所述OTU处理单元，用于将所述ODU单元封装成包含所述密文的OTN帧。
  12. 一种加密的方法，其特征在于，包括：
    第一光传送网络OTN设备获取量子密钥和待加密的业务数据；
    利用所述量子密钥对所述待加密的业务数据进行加密生成密文；
    将所述密文插入OTN开销字节中的设定字节，封装成包含所述密文的OTN帧；
    将所述OTN帧从电信号转换为光信号后传输至第二OTN设备。
  13. 如权利要求12所述的方法，其特征在于，所述利用所述量子密钥对所述待加密的业务数据进行加密生成密文，包括：
    利用一次一密加密算法和所述量子密钥对所述待加密的业务数据进行加密生成密文，或
    对所述量子密钥进行扩码处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文；或
    对所述量子密钥进行重用处理生成新的密钥，利用一次一密加密算法和所述新的密钥对所述待加密的业务数据进行加密生成密文。
  14. 如权利要求12或13所述的方法，其特征在于，所述OTN开销字节中的设定字节为光通道净荷单元OPU开销字节中的设定字节或光通道数据单元ODU开销字节中的设定字节或光通道数据单元OTU开销字节中的设定字节。
  15. 如权利要求14所述的方法，其特征在于，所述ODU开销字节中的设定字节为ODU开销字节中的通用通信通道字节；所述OTU开销字节中的设定字节为OTU开销字节中的通用通信通道字节。
  16. 如权利要求14或15所述的方法，其特征在于，所述ODU开销字节中的设定字节为GCC1字节和GCC2字节，所述OTU开销字节中的设定字节为GCC0字节。
  17. 如权利要求16所述的方法，其特征在于，所述GCC1字节位于OTN帧中第4行的第1～2列；所述GCC2字节位于OTN帧中第4行的第3～4列；所述GCC0字节位于OTN帧中第1行的第11～12列。
  18. 如权利要求14所述的方法，其特征在于，所述OTN开销字节中的设定字节为OPU开销字节或ODU开销字节或OTU开销字节中的保留字节，所述保留字节为RES字节。
  19. 一种解密的方法，其特征在于，包括：
    第二光传送网络OTN设备接收第一OTN设备发送的包含密文的光信号；
    将所述光信号转换为电信号得到包含密文的OTN帧；
    从所述OTN帧中的OTN开销字节中的设定字节中提取密文；
    针对所述提取的密文利用所述第一OTN设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
  20. 一种用于解密的设备，其特征在于，包括：
    接口单元，用于接收发送设备发送的包含密文的光信号；
    光电转换模块，用于将所述光信号转换为电信号得到包含密文的光传送网络OTN帧；
    OTN处理器，用于从所述OTN帧中的OTN开销字节中的设定字节中提取密文，输出至 解密单元；
    所述解密单元，用于针对所述提取的密文利用所述发送设备获取的加密算法和量子密钥进行解密处理，得到加密处理之前的业务数据。
PCT/CN2017/085783 2016-11-11 2017-05-24 一种加密、解密的方法及设备 WO2018086333A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17870453.2A EP3531614A4 (en) 2016-11-11 2017-05-24 METHOD AND DEVICE FOR ENCRYPTION AND DECRYPTION
US16/408,485 US20190334710A1 (en) 2016-11-11 2019-05-10 Encryption method and device and decryption method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611001858.5 2016-11-11
CN201611001858.5A CN108075883A (zh) 2016-11-11 2016-11-11 一种加密、解密的方法及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/408,485 Continuation US20190334710A1 (en) 2016-11-11 2019-05-10 Encryption method and device and decryption method and device

Publications (1)

Publication Number Publication Date
WO2018086333A1 true WO2018086333A1 (zh) 2018-05-17

Family

ID=62110356

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/085783 WO2018086333A1 (zh) 2016-11-11 2017-05-24 一种加密、解密的方法及设备

Country Status (4)

Country Link
US (1) US20190334710A1 (zh)
EP (1) EP3531614A4 (zh)
CN (1) CN108075883A (zh)
WO (1) WO2018086333A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111314051A (zh) * 2018-12-11 2020-06-19 北京思源理想控股集团有限公司 一种加解密方法和装置
CN114449128A (zh) * 2022-01-23 2022-05-06 青岛理工大学 一种结合神经网络与量子随机行走的图像加密方法

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108964898A (zh) * 2018-06-28 2018-12-07 安徽继远软件有限公司 一种基于量子保密通信技术的配用电加密通信系统及方法
CN113194066A (zh) * 2021-03-25 2021-07-30 四川久远银海软件股份有限公司 一种基于安全级别的混合加密方法
CN115225296B (zh) * 2021-04-16 2024-04-12 华为技术有限公司 一种加密数据的传输方法及相关设备
CN113612612A (zh) * 2021-09-30 2021-11-05 阿里云计算有限公司 一种数据加密传输方法、系统、设备及存储介质
CN115001686B (zh) * 2022-08-02 2022-11-04 矩阵时光数字科技有限公司 一种全域量子安全设备及系统
WO2024027602A1 (zh) * 2022-08-02 2024-02-08 矩阵时光数字科技有限公司 全域量子安全设备、数据发送方法和数据接收方法
CN117040846A (zh) * 2023-08-10 2023-11-10 广东九博科技股份有限公司 一种接入型otn设备及其数据传输加密和解密方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070133798A1 (en) * 2005-12-14 2007-06-14 Elliott Brig B Quantum cryptography on a multi-drop optical network
US7697693B1 (en) * 2004-03-09 2010-04-13 Bbn Technologies Corp. Quantum cryptography with multi-party randomness
CN103118308A (zh) * 2013-01-24 2013-05-22 浙江工业大学 一种支持量子通信的光接入无源网络
CN203251308U (zh) * 2012-12-07 2013-10-23 安徽问天量子科技股份有限公司 无源光网络
CN104718720A (zh) 2012-10-17 2015-06-17 思科技术公司 光传送网络中的时隙加密
CN106102025A (zh) * 2016-05-24 2016-11-09 中国科学院信息工程研究所 一种基于Android的加密短信编码方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1409500A (zh) * 2001-09-20 2003-04-09 深圳市中兴通讯股份有限公司上海第二研究所 基于同步传输体系的传送多种类型公务信息的方法和装置
CN101098192A (zh) * 2006-06-27 2008-01-02 中兴通讯股份有限公司 一种基于光传输系统的监控信息传送装置和方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7697693B1 (en) * 2004-03-09 2010-04-13 Bbn Technologies Corp. Quantum cryptography with multi-party randomness
US20070133798A1 (en) * 2005-12-14 2007-06-14 Elliott Brig B Quantum cryptography on a multi-drop optical network
CN104718720A (zh) 2012-10-17 2015-06-17 思科技术公司 光传送网络中的时隙加密
CN203251308U (zh) * 2012-12-07 2013-10-23 安徽问天量子科技股份有限公司 无源光网络
CN103118308A (zh) * 2013-01-24 2013-05-22 浙江工业大学 一种支持量子通信的光接入无源网络
CN106102025A (zh) * 2016-05-24 2016-11-09 中国科学院信息工程研究所 一种基于Android的加密短信编码方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3531614A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111314051A (zh) * 2018-12-11 2020-06-19 北京思源理想控股集团有限公司 一种加解密方法和装置
CN111314051B (zh) * 2018-12-11 2023-09-12 北京思源理想控股集团有限公司 一种加解密方法和装置
CN114449128A (zh) * 2022-01-23 2022-05-06 青岛理工大学 一种结合神经网络与量子随机行走的图像加密方法
CN114449128B (zh) * 2022-01-23 2023-09-26 青岛理工大学 一种结合神经网络与量子随机行走的图像加密方法

Also Published As

Publication number Publication date
EP3531614A4 (en) 2019-11-13
EP3531614A1 (en) 2019-08-28
CN108075883A (zh) 2018-05-25
US20190334710A1 (en) 2019-10-31

Similar Documents

Publication Publication Date Title
WO2018086333A1 (zh) 一种加密、解密的方法及设备
US10567352B2 (en) Flexible ethernet encryption systems and methods
US10193688B2 (en) Flexible Ethernet encryption systems and methods
US8942379B2 (en) Timeslot encryption in an optical transport network
WO2016184240A1 (zh) 一种实现数据传输的方法及光通道传输设备
US8897448B2 (en) Controlling session keys through in-band signaling
JP2010541509A (ja) クライアント信号を送信及び受信する方法、装置、及びシステム
WO2018228420A1 (zh) 一种传输网络系统、数据交换和传输方法、装置及设备
CN105409157A (zh) 用于光网络的自适应业务加密
US10985847B2 (en) Security over optical transport network beyond 100G
WO2023273712A1 (zh) 加密传输方法及装置
Pérez-Resa et al. Chaotic encryption for 10-Gb Ethernet optical links
WO2022161369A1 (zh) 一种光传送网的安全管理信息处理方法及装置
US20050117585A1 (en) Techniques to map and de-map signals
CN108667526B (zh) 一种光传送网中多业务的安全传送方法、装置及设备
CN101635727B (zh) 一种用于伪线网络的数据安全发送接收方法、装置及系统
WO2021218721A1 (zh) 业务处理的方法和装置
JP6660841B2 (ja) 伝送装置及び伝送方法
JP5945244B2 (ja) 多重伝送システム及び多重伝送方法
WO2016074484A1 (zh) 分组业务信号发送方法、装置及接收方法、装置
EP3054645B1 (en) Apparatuses, system, methods and computer programs suitable for transmitting or receiving encrypted output data packets in an optical data transmission network
EP2854327A1 (en) Authentication for optical networks
JP5963817B2 (ja) フレーム再マッピング方法
KR20110127077A (ko) 광 전달 망에서 패킷 전송 방법 및 장치
CN118233041A (zh) 一种基于高级加密标准实现的光业务单元净荷加密方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17870453

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017870453

Country of ref document: EP

Effective date: 20190521