WO2022148230A1 - 一种状态通知方法、光模块、网络设备以及网络系统 - Google Patents

一种状态通知方法、光模块、网络设备以及网络系统 Download PDF

Info

Publication number
WO2022148230A1
WO2022148230A1 PCT/CN2021/139424 CN2021139424W WO2022148230A1 WO 2022148230 A1 WO2022148230 A1 WO 2022148230A1 CN 2021139424 W CN2021139424 W CN 2021139424W WO 2022148230 A1 WO2022148230 A1 WO 2022148230A1
Authority
WO
WIPO (PCT)
Prior art keywords
optical module
notification information
locked
logical channels
logical channel
Prior art date
Application number
PCT/CN2021/139424
Other languages
English (en)
French (fr)
Inventor
丁力
王建兵
孙德胜
毕红军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21917270.7A priority Critical patent/EP4262093A4/en
Publication of WO2022148230A1 publication Critical patent/WO2022148230A1/zh
Priority to US18/349,645 priority patent/US20230353255A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04Q—SELECTING
    • H04Q11/00—Selecting arrangements for multiplex systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/80—Optical aspects relating to the use of optical transmission for specific applications, not provided for in groups H04B10/03 - H04B10/70, e.g. optical power feeding or optical transmission through water
    • H04B10/85—Protection from unauthorised access, e.g. eavesdrop protection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04Q—SELECTING
    • H04Q11/00—Selecting arrangements for multiplex systems
    • H04Q11/0001—Selecting arrangements for multiplex systems using optical switching
    • H04Q11/0062—Network aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/25—Arrangements specific to fibre transmission
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority

Definitions

  • the present application relates to network communication technologies, and in particular, to a state notification method, an optical module, a network device, and a network system.
  • the present application provides a state notification method, an optical module, a network device, and a network system, so as to realize the reliability of physical layer data encryption.
  • a first aspect of the present application provides a state notification method, the method includes: determining a lock state of a logical channel in a first optical module, where the first optical module belongs to a first network device, and the lock state includes locked or unlocked Locked; when the lock state indicates that the logical channel in the first optical module is locked, the first network device or the first optical module sends uplink notification information, and the uplink notification information is used for the second optical module to determine The logical channel in the first optical module is locked, the second optical module belongs to the second network device, and the first optical module is connected to the second optical module.
  • the logical channel in the first optical module is generated by bit multiplexing the physical channel of the optical module.
  • the second optical module when it is determined that the logical channel in the first optical module is locked, uplink notification information is sent, so that the second optical module of the communication opposite end determines that the logical channel in the first optical module is locked.
  • the second optical module can perform operations such as encryption on the data that needs to be sent to the first optical module, or perform operations such as decryption on the data received from the first optical module after the logical channel in the first optical module is locked. Improve the reliability of physical layer data encryption.
  • the method further includes: acquiring downlink notification information, where the downlink notification information is used to enable the first optical module to determine that the logical channel in the second optical module is locked.
  • the first optical module when the logical channel in the first optical module is locked and the logical channel in the second optical module is locked, the first optical module encrypts data sent to the second optical module; or , the first optical module decrypts the data received from the second optical module.
  • the first optical module can perform operations such as encryption on the data to be sent to the second optical module, or perform decryption on the data received from the first optical module only after the logical channel in the second optical module is locked.
  • Such operations combined with the operations of the second optical module, can further improve the reliability of physical layer data encryption/decryption.
  • the lock state of the logical channel in the first optical module may be determined by the first optical module, or the first optical module may be obtained by the processing component of the first network device from the first optical module.
  • the lock status of the logical channel within the module may be determined by the first optical module, or the first optical module may be obtained by the processing component of the first network device from the first optical module.
  • the first optical module or the processing component of the first network device to which the first optical module belongs can determine the lock state of the logical channel in the first optical module, which improves the flexibility of the above method of the present application.
  • the logical channel in the first optical module includes M sending logical channels and M receiving logical channels, where M is greater than or equal to 1, and the determining the lock state of the logical channel in the first optical module includes: determining all the logical channels. determining the status of each sending logical channel in the M sending logical channels; and/or determining the status of each receiving logical channel in the M receiving logical channels.
  • the present application can determine the state of each sending logical channel or receiving logical channel in the first optical module, so that the acquired state of the logical channel in the first optical module is more accurate.
  • the logical channel locking in the first optical module includes: all the M sending logical channels are locked, and/or all the M receiving logical channels are locked.
  • the first optical module transmits M pieces of first uplink notification information to the second optical module through the M transmission logical channels, and each of the M pieces of first uplink notification information
  • the first uplink notification information indicates that the sending logical channel for sending the first uplink notification information is locked, and/or indicates that the receiving logical channel corresponding to the sending logical channel of the first uplink notification information is locked; or, the first network device
  • the processing unit sends second uplink notification information to the processing unit of the second network device, and the second uplink notification information indicates the M sending logical channels and/or the M receiving logical channels of the first optical module All logical channels are locked.
  • the uplink notification information in this application may be sent by the first optical module, or may be sent by the first network device.
  • the first optical module sends a first uplink notification information to each of the M sending logical channels
  • the second optical module can receive a total of M
  • the second optical module can know that all the logical channels in the first optical module are locked according to the M first uplink notification information (according to the setting, it may be that the sending logical channels and/or the receiving logical channels are all locked) .
  • the first network device may only send one piece of second uplink channel information, and the second uplink channel information includes all the sending logical channels and/or receiving logical channels indicating the first optical module Locked information, which can be a flag, or a tunnel identifier of all sending logical channels and/or receiving logical channels.
  • the uplink notification information is sent by the first optical module or the first network device, and the implementation is more flexible.
  • the logical channel locking in the first optical module includes one or more of the following: one of the M transmitting logical channels is locked; and one of the M receiving logical channels is locked; One receiving logical channel is locked; and, one sending logical channel among the M sending logical channels is locked with the corresponding receiving logical channel.
  • the first optical module sends the first uplink notification information to the second optical module through j transmission logical channels, and the first uplink notification information indicates that the j transmission logical channels are locked, or the The receiving logical channels corresponding to the j sending logical channels are locked, or the j sending logical channels are locked with the corresponding receiving logical channels, and j is greater than 1 and less than M.
  • each The sending logical channel corresponds to one first uplink notification information; or the processing component of the first network device sends third uplink notification information to the processing component of the second network device, and the third uplink notification information indicates that j pieces of uplink notification information are sent
  • the logical channel is locked, or the receiving logical channel corresponding to the j sending logical channels is locked, or the j sending logical channels are locked with the corresponding receiving logical channel, and j is greater than 1 and less than M.
  • the uplink notification information is sent by the first optical module or the first network device
  • the first uplink notification information sent by the first optical module may be carried in the physical layer bit stream
  • the third uplink notification information can be carried in a Layer 2 Ethernet frame or an IP data packet, and the implementation is more flexible.
  • each first uplink notification information (first uplink notification information sent by any one of the M sending logical channels) includes the identifier of the sending logical channel that transmits the first uplink notification information, and lock marks.
  • the first uplink notification information is an alignment identifier.
  • the alignment identifier may be, for example, a standard alignment identifier corresponding to 200G/400G, or an alignment identifier in other formats, and the alignment identifier can be used to determine whether the logical channel is locked.
  • the lock flag is obtained by modifying a specified field in the alignment identifier.
  • the specified field is the UP x field in the 200G/400G alignment identifier.
  • the lock identification appears repeatedly in the UP x field. That is, multiple lock identifiers are carried in the UP x field. In this way, bit errors occurring in the transmission process can be avoided, and it is ensured that the second optical module can accurately acquire the state of the first optical module.
  • the first optical module receives M pieces of first downlink notification information through the M receiving logical channels, and the M pieces of first downlink notification information indicate the The logical channel is locked; or the processing unit of the first network device receives the second downlink notification information sent by the processing unit of the second network device, and sends the second downlink notification information to the first optical module,
  • the second downlink notification information indicates that the logical channel in the second optical module is locked.
  • the first optical module receives first downlink notification information through p receiving logical channels of the M receiving logical channels, and the first downlink notification information indicates the p receiving logical channels
  • the sending logical channel of the second optical module corresponding to the channel is locked with the receiving logical channel, and p is greater than 1 and less than M.
  • the p receiving logical channels include multiple receiving logical channels, each receiving logical channel corresponds to a first logical channel.
  • the processing unit of the first network device receives the third downlink notification information sent by the processing unit of the second network device, and sends the third downlink notification information to the first optical module , the third downlink notification information indicates that the sending logical channel of the second optical module corresponding to the p receiving logical channels is locked with the receiving logical channel, and p is greater than 1 and less than M.
  • the first optical module can also obtain the status of the logical channel in the second optical module, and the specific method can be that the first optical module directly receives the first downlink notification information, or the first optical module passes the first network device's
  • the processing module receives the second downlink notification information or the third downlink notification information.
  • the transmission manner of the first downlink notification information may refer to the above-mentioned first uplink notification information
  • the transmission manner of the second downlink notification information and the third downlink notification information may refer to the above-mentioned second uplink notification information and the third uplink notification information.
  • the first optical module and the second optical module in this application can obtain the lock state of the logical channel of the opposite end, and perform corresponding processing when the lock state satisfies the preset rules, which can improve the data processing (including encryption and decryption) efficiency. reliability.
  • the present application can independently judge the state of each logical channel, and does not need to consider the interference caused by the states of other logical channels, thereby reducing processing overhead.
  • the present application transmits the first uplink notification information and the downlink notification information by using the alignment identifier specified in the standard, the network bandwidth is not increased, and the waste of bandwidth resources can be avoided.
  • a second aspect of the present application provides an optical module, where the optical module is the first optical module of the above-mentioned first aspect, which includes a state determination unit and a notification unit.
  • the state determination unit is configured to determine the lock state of the logical channel in the first optical module, the first optical module belongs to the first network device, and the lock state includes locked or unlocked; the notification unit, When the lock state indicates that the logical channel in the first optical module is locked, send uplink notification information, and the uplink notification information is used to enable the second optical module to determine that the logical channel in the first optical module is locked , the second optical module belongs to the second network device, and the first optical module is connected to the second optical module.
  • the state determination unit is further configured to acquire downlink notification information, where the downlink notification information is used to enable the state determination unit to determine that the logical channel in the second optical module is locked.
  • the first optical module further includes an encryption/decryption unit, which is used for encrypting and sending the data to the destination when the logical channel in the first optical module is locked and the logical channel in the second optical module is locked. data from the second optical module, or decrypt data received from the second optical module.
  • an encryption/decryption unit which is used for encrypting and sending the data to the destination when the logical channel in the first optical module is locked and the logical channel in the second optical module is locked. data from the second optical module, or decrypt data received from the second optical module.
  • the logical channels in the first optical module include M transmission logical channels and M reception logical channels
  • the state determination unit is configured to: determine the state of each transmission logical channel in the M transmission logical channels, and/or, determining the status of each sending logical channel in the M sending logical channels.
  • the logic channel locking in the first optical module includes locking all the M sending logic channels, and/or locking all the M receiving logic channels.
  • the notification unit is configured to: send M pieces of first uplink notification information to the second optical module respectively through the M pieces of sending logical channels, and each of the M pieces of first uplink notification information
  • the first uplink notification information indicates that the sending logical channel for sending the first uplink notification information is locked, and/or indicates that the receiving logical channel corresponding to the sending logical channel of the first uplink notification information is locked; or, to the first uplink notification information
  • the processing component of the network device sends the second uplink notification information, so that the processing component of the first network device sends the second uplink notification information to the processing component of the second network device, and the second uplink notification information indicates All the M sending logical channels and/or the M receiving logical channels of the first optical module are locked.
  • the logical channel locking in the first optical module includes one or more of the following: one of the M transmitting logical channels is locked; one receiving logic channel in the M receiving logical channels is locked; channel locking; and one of the M sending logical channels is locked with the corresponding receiving logical channel.
  • the notification unit is configured to: send first uplink notification information to the second optical module through j sending logical channels, where the first uplink notification information indicates that the j sending logical channels are locked, or The receiving logical channels corresponding to the j sending logical channels are locked, or the j sending logical channels are locked with the corresponding receiving logical channels, and j is greater than 1 and less than M, when the j sending logical channels include multiple sending logical channels , each sending logical channel corresponds to a first uplink notification message; or, send a third uplink notification message to the processing component of the first network device, so that the processing component of the first network device sends the second network device
  • the processing unit of the device sends the third uplink notification information, and the third uplink notification information indicates that the j sending logical channels are locked, or the receiving logical channels corresponding to the j sending logical channels are locked, or the j sending logical channels and the corresponding receiving logical channels are locked.
  • Logical channel lock, j is greater than 1 and less than M
  • the notification unit when the notification unit sends the first uplink notification information, the first uplink notification information includes an identifier of a sending logical channel for transmitting the first uplink notification information, and a lock flag.
  • the first uplink notification information is an alignment identifier
  • the lock flag is obtained by modifying a value of a specified field in the alignment identifier.
  • the first optical module is a 200G or higher rate optical module
  • the specified field is the UPx field in the 200G/400G alignment identifier
  • the lock identifier appears repeatedly in the UPx field .
  • the state determination unit when acquiring downlink notification information, is configured to: receive M pieces of first downlink notification information through the M receiving logical channels, where the M pieces of first downlink notification information indicate the The logical channel in the second optical module is locked; or, receiving second downlink notification information sent by the processing unit of the first network device, the second downlink notification information indicates that the logical channel in the second optical module is locked.
  • the state determination unit when acquiring downlink notification information, is configured to: receive first downlink notification information through p receiving logical channels of the M receiving logical channels, the first downlink notification information indicating The sending logical channel of the second optical module corresponding to the p receiving logical channels is locked with the receiving logical channel, and p is greater than 1 and less than M; or, receiving the third downlink notification information sent by the processing unit of the first network device , the third downlink notification information indicates that the sending logical channel of the second optical module corresponding to the p receiving logical channels is locked with the receiving logical channel, and p is greater than 1 and less than M.
  • the state determination unit, the notification unit and the encryption/decryption unit may be independent components, or may be integrated into one component.
  • the above-mentioned optical module further includes an N:M bit multiplexing unit and an M:K bit multiplexing unit.
  • the N:M bit multiplexing unit is used for converting N physical channel signals into M logical channel signals
  • the M:K bit multiplexing unit is used for converting M logical channel signals into K logical channel signals.
  • An encryption/decryption unit is included between the N:M-bit multiplexing unit and an M:K-bit multiplexing unit, and the encryption/decryption unit includes the above-mentioned state determination unit, a notification unit, and an encryption/decryption unit.
  • the process of the optical module performing the method of the first aspect of the present application can be invisible to the outside, and the process of the existing equipment can be invisible. Minor changes.
  • the above state determination unit, notification unit and encryption/decryption unit of the present application may be implemented by software or by hardware.
  • a third aspect of the present application provides a network device, the network device includes a processing component and a first optical module, where the first optical module is the optical module described in the second aspect and its implementations, and the processing Parts are used for:
  • uplink notification information is sent to the second network device, where the uplink notification information is used to indicate that the logical channel in the first optical module is locked.
  • the uplink notification information is the second uplink notification information in the above-mentioned first aspect, and the second uplink notification information indicates all M sending logical channels and/or M receiving logical channels of the first optical module. locked; or
  • the uplink notification information is the third uplink notification information in the second aspect, and the third uplink notification information indicates that the j sending logical channels of the first optical module are locked, or the receiving logical channels corresponding to the j sending logical channels Locked, or the j sending logical channels are locked with the corresponding receiving logical channels, and j is greater than 1 and less than M.
  • the processing component is further configured to receive downlink notification information sent by the second network device, and send the downlink notification information to the first optical module.
  • the downlink notification information is the second downlink notification information in the above-mentioned first aspect
  • the second downlink notification information indicates that the logical channel in the second optical module is locked (may be M receiving logical channels and M receiving logical channels. All sending logical channels are locked); or, the third downlink notification information in the first aspect of the downlink notification information, the third downlink notification information indicates that the sending logical channel of the second optical module corresponding to the p receiving logical channels is the same as the Receive logical channel lock, p is greater than 1 and less than M.
  • the second optical module belongs to the second network device, and the second optical module is connected to the first optical module.
  • a fourth aspect of the present application provides a network system, including a first network device and a second network device, the first network device is the network device according to the third aspect and any implementation manner thereof, the first network device The network device is configured to implement the relevant steps in the method of the first aspect above.
  • the second network device has the same function as the first network device.
  • a fifth aspect of the present application provides a logic circuit.
  • the logic circuit When the logic circuit operates, it can realize the functions implemented by the first optical module in the above-mentioned first aspect of the present application and its various implementation modes.
  • the logic circuit can be integrated in the present application.
  • the optical module in the second aspect of the application and its various embodiments In the optical module in the second aspect of the application and its various embodiments.
  • a sixth aspect of the present application provides a chip, and the chip may include the logic circuit provided in the fifth aspect.
  • 1A is a schematic diagram of an Ethernet protocol structure
  • FIG. 1B is a schematic diagram of the corresponding relationship of each layer in the Ethernet protocol OSI reference model
  • FIG. 2A is a schematic structural diagram of an optical module of the present application.
  • 2B is a schematic diagram of a working circuit of an optical digital signal processing chip
  • FIG. 3 is a schematic diagram of a bit multiplexing process
  • Figure 4 shows the structure of the alignment identifier used by the 200G/400G channel
  • Fig. 5 is the structure of the alignment identifier of each logical channel of 400G channel
  • FIG. 6 is a schematic diagram of an architecture for implementing the MACsec function provided by the present application.
  • Fig. 7 is a kind of optical module encryption scheme provided by this application.
  • FIG. 8 is a schematic structural diagram of an optical module provided by the application.
  • FIG. 9 is a schematic diagram of an application scenario of the state notification method provided by the present application.
  • FIG. 10 is a schematic structural diagram of a network system provided by this application.
  • FIG. 11 is a schematic flowchart of a status notification method provided by the present application.
  • FIG. 13 is a schematic diagram of another data transmission process provided by this application.
  • the present application provides an encryption method to improve the reliability of physical layer encryption.
  • the present application can be applied to the physical layer of Ethernet.
  • the Ethernet protocol will be introduced below with reference to FIG. 1A and FIG. 1B .
  • Ethernet includes a physical layer (Physical Layer) and a media access control (Media Access Control, MAC) layer.
  • the physical layer includes a transmission module and a physical layer entity (Physical Layer entity, PHY)
  • the transmission module includes a transmission medium
  • the transmission medium is used for transmitting data.
  • the transmission medium can be, for example, a cable or an optical module for connecting the optical fibers.
  • the above-mentioned PHY includes a physical medium dependent (PMD), a physical medium attachment (PMA), and a physical coding sublayer.
  • the MAC layer of Ethernet mainly includes MAC control sublayer (MAC control) and coordination sublayer (reconciliation sublayer, RS).
  • FIG. 1B shows the correspondence between the layers of the Open Systems Interconnection Reference Model and the MAC layer and the PHY layer in Ethernet.
  • the data link layer of the OSI reference model corresponds to the functions above the coordination sublayer in the MAC layer
  • the physical layer of the OSI reference model corresponds to the PHY layer and the coordination sublayer in the MAC layer.
  • the MAC/PHY architecture can support data transmission at multiple rates, and different transmission rates require different transmission media and media independent interfaces (media independent interfaces, MII).
  • FIG. 2A it is a schematic structural diagram of an optical module.
  • the optical module includes an optoelectronic transceiver (TX/RX for short), a controller, and a processing unit.
  • the controller is used to control the optoelectronic transceiver and the processing unit to perform various operations.
  • the controller may be a micro-controller unit (MCU).
  • the processing unit can be used for encoding and decoding digital/analog signals, and for compensating for many costs in the transmission chain, such as dispersion compensation for long-distance transmission.
  • the processing unit may also include a bit multiplexer/demultiplexer (referred to herein as BitMux) for mapping signals received through the N physical channels to internal processing channels in the processing unit.
  • BitMux bit multiplexer/demultiplexer
  • the processing unit may be, for example, an optical digital signal processing chip (optical digital signal processor, oDSP).
  • oDSP optical digital signal processor
  • FIG. 2B it is a schematic diagram of the working circuit of the oDSP. In the sending direction, after the digital signal is processed by oDSP, it is converted into an analog modulated electrical signal through a modulation algorithm, and the modulation algorithm can be cross quadrature amplitude modulation (XQAM).
  • XQAM cross quadrature amplitude modulation
  • the analog modulated electrical signal is converted into a modulated optical signal after being processed by the optical transmitter TX, and the modulated optical signal is transmitted.
  • the optical signal is converted into an analog modulated electrical signal after being processed by the optical receiver, and the analog modulated electrical signal is converted into a digital signal after being processed by the oDSP.
  • the network device when the network device acts as the sender, the network device receives data, and the MAC layer of the network device composes the received data stream into an Ethernet frame, and then sends the Ethernet frame to the PCS, and the PCS encodes the data.
  • the PMD sublayer After the data of this one or more physical channels is processed by the PMD sublayer, it becomes an analog signal and is sent to the transmission medium through a medium dependent interface (MDI).
  • MDI medium dependent interface
  • logical lanes may also be referred to as virtual lanes (virtual lanes), which in this application refers to PCS lanes or forward error correction (FEC) lanes (FEC lanes in the 100G standard and FEC lanes in the 200G/400G standards) PCS lane).
  • FEC forward error correction
  • These channels are generally distributed within the implementation unit of the PCS.
  • the number of PCS or FEC channels specified by 200G Ethernet is 8
  • the number of logical channels specified by 400G Ethernet is 16
  • the number of logical channels specified by 100G Ethernet is 4.
  • the above physical channel refers to the PMA lane.
  • a physical channel can carry data from one or more logical channels. In 100G/200G/400G high-speed Ethernet, the number of physical channels varies depending on the implementation.
  • the above bit multiplexing is a function that applies to all input/output channel counts and transmissions in each direction, and can interleave the data streams/data bits received by m input channels by bit interleaving
  • FIG. 3 is a schematic diagram of a bit multiplexing process. In Figure 3, the signal streams of the 4 input channels are sent to the 2 output channels after bit multiplexing in the PMA sublayer.
  • the IEEE 802.3 standard designs an alignment identifier. (alignment marker, AM).
  • AM alignment marker
  • the PCS at the sending end distributes a serial stream to multiple PCS lanes, it will periodically insert AM into the data stream of each PCS lane, and the receiving end implements AM locking according to the AM of each channel (that is, locks the channel corresponding to the AM). , in order to combine multiple signals into one serial signal.
  • the format of the alignment identifier corresponding to different transmission rates may be different.
  • CM 0 , CM 1 , CM 2 , CM 3 , CM 4 , and CM 5 are the common identifiers of all logical channels, and UM 0 , UM 1 , UM 2 , UM 3 , UM 4 , and UM 5 are used to uniquely identify a logical channel, that is, different logical channels have different combinations of “UM 0 , UM 1 , UM 2 , UM 3 , UM 4 , UM 5 ”.
  • UP 0 , UP 1 , and UP 2 are user-editable fields.
  • the AM length of 200G and 400G is 120 bits (bits), and the position is 0 to 119. Then ⁇ CM 0 , CM 1 , CM 2 ⁇ , ⁇ CM 3 , CM 4 , CM 5 ⁇ , ⁇ UM 0 , UM 1 , UM 2 ⁇ , ⁇ UM 3 , UM 4 , UM 5 ⁇ each occupy 24 bits, and ⁇ UP 0 ⁇ , ⁇ UP 1 ⁇ and ⁇ UP 2 ⁇ each occupy 8 bits.
  • IEEE802.3 stipulates that 200G corresponds to 8 logical channels, and 400G corresponds to 16 logical channels. Taking the 400G channel as an example, the coding structure of the alignment identifier of each logical channel is shown in Figure 5.
  • CM 0 -CM 5 Divide CM 0 -CM 5 into 12 symbols, each symbol occupies 4 bits (ie nibble, nibble), the receiving end compares CM 0 -CM 5 in the received AM with CM 0 -CM 5 in Figure 5 , when there are less than or equal to 3 nibble in the received AM that do not match CM 0 -CM 5 in Figure 5, a logical channel can be locked, and the number of the logical channel can be correctly identified.
  • MACsec In order to ensure the communication security of the Ethernet, an encryption protocol MACsec is proposed in the art, which runs at the MAC layer and can realize the integrity and confidentiality of connectionless data based on a medium access independent protocol.
  • MACsec applies symmetric key encryption to packets using the Advanced Encryption Standard (AES) to generate encrypted data.
  • AES Advanced Encryption Standard
  • Grouping means dividing the plaintext into different groups, each of the same length, encrypting a group of data at a time until the entire plaintext is encrypted.
  • the packet length can be 128 bits, 192 bits, 256 bits, etc.
  • MACsec When encrypting a group of data, MACsec first divides the packet data into frames, and then encrypts each frame to obtain an encrypted frame.
  • Each encrypted frame carries a 16-byte Integrity Check Value (ICV). , and an initialization vector (Initialization Vector, IV) of 12 bytes.
  • ICV Integrity Check Value
  • IV Initialization Vector
  • MACsec implements data encryption and decryption based on the Ethernet data link layer (layer 2)
  • layer 2 Ethernet data link layer
  • the power consumption cost of implementing MACsec function based on high-speed and large-capacity chips is increasing;
  • the impact of delay under new services is becoming more and more obvious.
  • a physical chip supporting the MACsec function is often set outside the switching chip of the network device.
  • the MACsec function may also be implemented by a switch chip.
  • the switch chip can be deployed on a single board (also called a line card).
  • the present application proposes a scheme for encrypting an optical module. Since optical modules can exist independently of single boards, users only need to purchase optical modules that support encryption to meet new encryption requirements.
  • the scheme in Figure 7 utilizes AM's modifiable fields to carry encryption parameters without adding extra bandwidth.
  • the above-mentioned modifiable fields may be, for example, one or more of the UP 0 , UP 1 and UP2 fields in the AM of 200G or 400G (collectively referred to as UPx fields in this application).
  • the encryption parameters can also be carried by inserting padding in a specific position of the data stream.
  • AM locking refers to when two consecutive AMs are found from the data stream of a logical channel that match the AM of the channel (that is, the two consecutive AMs are the same as the AM of the channel or the comparison results with the AM of the channel satisfy Matching rules), the channel is considered to be locked, and after the channel is locked, operations on the data stream in the channel can be performed (for example, insert encryption parameters, align each channel, etc.). Alignment is used to compensate for the deviation caused by transmission between different channels, so that the receiver can only perform corresponding processing after receiving a complete data block from each channel.
  • the present application also provides an optical module.
  • the optical module includes a controller, a processing unit and a TX/RX. Further, the optical module further includes a BitMux for performing a bit multiplexing function.
  • the BitMux can be deployed on or outside the processing unit.
  • the BitMux also includes encryption/decryption components.
  • the optical module receives N physical channel data streams transmitted by PMD (or other electrical chips) in the physical layer;
  • N:M BitMux converts the N physical channel data streams input into the optical module It is M-channel logical channel data stream;
  • the encryption/decryption component identifies the AM of each logical channel from the M-channel logical channel data stream, adds encryption parameters to the AM of each logical channel, and encrypts data packets to obtain encrypted
  • M:K BitMux multiplexes the encrypted M-way logical channel data streams to K-way physical channels of the processing unit to form K-way data streams, and the processing unit implements the K-way data streams.
  • Algorithm processing (such as dispersion compensation preprocessing, optional), and then, the processed K-channel data streams are converted into optical signals by Tx and sent to other optical modules.
  • the optical module receives optical signals from other optical modules, the optical signals carry encrypted data streams, the optical signals are converted into electrical signals via Rx, and the processing unit performs algorithm processing (such as chromatic dispersion) on the electrical signals compensation, etc.) to obtain a digital signal, and send the digital signal to M:K BitMux through K physical channels;
  • M:K BitMux converts the K physical channel data streams into M logical channel data streams, and the encryption/decryption components identify
  • the AM in the M-channel logical channel data stream after obtaining the encryption parameters, decrypts the M-channel logical channel data stream to obtain the decrypted M-channel data stream, and passes the decrypted M-channel data stream through the M logic channels
  • the channel is sent to the N:M BitMux, and the N:M BitMux converts the received M
  • the present application provides a state notification method and related apparatuses, which are used to enable network devices (that is, devices located at either end of the channel, which may be encryption-side devices or decryption-side devices) to obtain the AM lock state of the channel, and to obtain the AM lock state of the channel according to the channel.
  • the AM lock status determines whether encryption/decryption operations can be performed.
  • the AM lock state of a channel may be the AM lock state of all channels between devices at both ends, or the AM lock state of one channel. When the device at one end of the channel is the end, the device at the other end of the channel is the opposite end.
  • the AM lock status of the channel includes: the AM of the local end is unlocked, and the AM of the opposite end is not locked; the AM of the local end is unlocked and the AM of the opposite end is unlocked; The AM of the opposite end is locked; the AM of the local end is locked, and the AM of the opposite end is not locked; and the AM of the local end is locked, and the AM of the opposite end is locked.
  • the state notification method provided by this application can be applied to the scenario shown in FIG. 9 .
  • edge node A connects edge node D through intermediate node B and intermediate node C.
  • the connection between edge node A and intermediate node B, between intermediate node B and intermediate node C, and between intermediate node C and edge node D is based on Ethernet.
  • the state notification method of the present application can be applied between any two directly connected nodes.
  • FIG. 10 takes two directly connected network devices as an example to introduce the network system provided by this application.
  • the network system includes a first network device 100 and a second network device 200 .
  • the first network device 100 and the second network device 200 may be any two nodes in FIG. 9 .
  • the first network device 100 includes a first optical module 1010
  • the second network device includes a second optical module 2010 .
  • the first optical module 1010 of the first network device 100 is connected to the second optical module 2010 of the second network device 200 .
  • the encryption/decryption component of the first optical module 1010 further includes a state determination unit 1011, a notification unit 1012, an encryption/decryption unit 1013, M logical channels in the sending direction (referred to in this application as sending logical channels), and in the receiving direction M logical channels on (referred to in this application as receive logical channels).
  • the second optical module 2010 has a similar structure and function to the first optical module 1010 .
  • this application only shows a schematic structural diagram of the encryption/decryption component in the first optical module 1010 .
  • the implementations of the state determination unit 1011 , the notification unit 1012 and the encryption/decryption unit 1013 are not limited in this application.
  • the first optical module 1010 determines the lock state of the logical channel of the first optical module 1010, and after the logical channel of the first optical module 1010 is locked, sends the first uplink notification information (
  • the direction from the first network device 100 to the second network device 200 is called the uplink direction
  • the direction from the second network device 200 to the first network device 100 is called the downlink direction.
  • the The notification information sent from the first network device 100 to the second network device 200 is uplink notification information
  • the notification information sent from the second network device 200 to the first network device 100 is called downlink notification information
  • the processing unit 1020 of the network device 100 (deployed outside the optical module 1010 ) sends the second uplink notification information or the third uplink notification information to the second network device, the first uplink notification information or the second uplink notification information Or the third uplink notification information is used to enable the second optical module 2010 to determine that the logical channel of the first optical module 1010 is locked.
  • the first optical module 1010 or the second optical module 2010 performs the corresponding encryption/decryption operation only after it is determined that the logical channels of the local end and the opposite end are locked.
  • the second network device acts as the decryption side device, and vice versa.
  • the following describes the state notification method of this application in detail with reference to FIG. 10 and FIG. 11 , taking the first network device as the sender (device on the encryption side) and the second network device as the receiver (device on the decryption side) as an example .
  • FIG. 11 it is a schematic flowchart of the state notification method shown in this application, including steps S101-S104. The method is performed by the first optical module 1010 or the first network device 100 shown in FIG. 10 .
  • step S101 the locked state of the logical channel in the first optical module is determined.
  • the first optical module 1010 receives N physical channel signals through the N physical channels in FIG. 10 , and converts the N physical channel signals through N:M BitMux into N physical channel signals transmitted through M sending logical channels respectively.
  • the first optical module receives K physical channel signals through the K physical channels in FIG. 10, and converts the K physical channel signals into M logical channel signals respectively transmitted through the M receiving logical channels through M:K BitMux, Each logical channel signal includes an alignment identifier inserted by the PCS layer of the second network device.
  • determining the lock state of the logical channels in the first optical module includes: determining each sending logical channel in the M sending logical channels state; or determine the state of each logical channel in the M sending logical channels and the M receiving logical channels.
  • the status of each logical channel includes locked or unlocked.
  • Logical channel locking refers to the alignment identifier that conforms to the matching rule on the logical channel, so that the position of the alignment identifier can be accurately identified.
  • Step S101 may be specifically performed by the state determination unit 1011 of the first optical module 1010 .
  • the state determination unit 1011 in the first optical module S1010 determines the state of each transmission logical channel in the M transmission logical channels in the following manner:
  • the state determining unit 1011 determines the state of the sending logical channel i according to the first alignment identifier, where the state of the sending logical channel i includes locked or unlocked.
  • the state determining unit 1011 in the first optical module S1010 determines the state of each receiving logical channel in the M receiving logical channels in the following manner:
  • the format of the identifier is the same, that is, the second alignment identifier and the first alignment identifier have the same format;
  • the state determining unit 1011 determines the state of the receiving logical channel q according to the second alignment identifier, where the state of the receiving logical channel q includes locked or unlocked.
  • the method used to determine the state of the sending logical channel i according to the first alignment identifier is the same as the method used to determine the state of the receiving logical channel q according to the second alignment identifier. How to determine the state of a logical channel.
  • the sending logical channel i When the first alignment identifier matches the reference alignment identifier of the transmit logical lane i, or the first alignment identifier matches the reference alignment identifier of the transmit logical lane i and enters the transmit logical lane
  • the number of alignment identifiers of i that matches the reference alignment identifier of the sending logical channel i reaches a set number, and the sending logical channel i is locked; when the first alignment identifier matches the sending logical channel i does not match the reference alignment identifier of the transmit logical channel i, or the first alignment identifier does not match the reference alignment identifier of the transmit logical channel i, and the reference alignment identifier entering the transmit logical channel i is aligned with the reference alignment identifier of the transmit logical channel i
  • the sending logical channel i is unlocked.
  • a corresponding reference alignment identifier is set for each sending logical channel.
  • the reference alignment identifier may be an alignment identifier specified in the IEEE 802.3 standard, or an alignment identifier in other formats used to determine whether the logical channel is locked. symbol.
  • the reference alignment identifier of each logical channel can be as shown in Figure 5.
  • the first alignment identifier matches the reference alignment identifier of the sending logical channel i, and the first alignment identifier may be the same as the reference alignment identifier, or the first alignment identifier may be the same as the reference alignment identifier.
  • the number of inconsistent bits of the reference alignment identifier is less than or equal to a set threshold (for example, the value of 2 bits of the first alignment identifier is allowed to be different from the value of the corresponding bits of the reference identifier), or is that the first alignment identifier has the same number of bits as the reference alignment identifier to a set ratio (for example, the value of bits greater than or equal to 98% in the first alignment identifier is aligned with the reference The corresponding bits in the identifier have the same value).
  • the first optical module 1010 (eg, the state determining unit 1011 therein) can determine the lock state of each of the M sending logical channels and the M receiving logical channels inside the first optical module 1010. Further, the first network device 100 (specifically, for example, the processing component of the first network device 100 ) may also acquire the lock status of each logical channel in the first optical module 1010 from the first optical module 1010 .
  • the state determining unit 1011 of the first optical module 1010 can send the lock state of each logical channel to the first network device 100 in real time, and the state determining unit 1011 of the first optical module 1010 can also send all M sending logical channels and The locking status of the M receiving logical channels is sent to the first network device 100 at one time, and the first network device 100 may also poll each logical channel of the first optical module 1010 to obtain the locking status of each logical channel in real time.
  • the present application does not limit the manner in which the first network device 100 acquires the lock state of the logical channel in the first optical module 1010 .
  • step S102 when the lock state indicates that the logical channel in the first optical module is locked, uplink notification information is sent.
  • the uplink notification information is used to enable the second optical module to determine that the logical channel in the first optical module is locked, the second optical module belongs to the second network device, and the first optical module is connected to the second optical module .
  • the uplink notification information may be the first uplink communication information, the second uplink notification information or the third uplink notification information, which will be described in detail below.
  • the first optical module 1010 or the first network device 100 After the first optical module 1010 or the first network device 100 obtains the lock state of each logical channel in the first optical module 1010, the first optical module 1010 or the first network device 100 determines the first optical module 1010 or the first network device 100 according to a preset rule. Whether the logical channel in the optical module is locked (step S1011 ), if not, proceed to step S101 , if locked, proceed to step S102 .
  • the preset rule is used to determine whether the logical channel in the first optical module is locked, that is, when the preset rule is satisfied, the logical channel in the first optical module is locked, and when the preset rule is not satisfied, the first optical module is locked.
  • the logical channel within the module is not locked.
  • the preset rules include any one or more of the following:
  • All M sending logical channels are locked and/or all M sending logical channels are locked; one of the M sending logical channels is locked;
  • One of the M receive logical channels is locked
  • One of the M sending logical channels is locked with the corresponding receiving logical channel.
  • a mapping relationship needs to be configured on the first optical module 1010 or on the first network device 100, and the mapping relationship records the corresponding relationship between the sending logical channel and the receiving logical channel on the first optical module 1010, and the mapping relationship may further include the second optical module.
  • the corresponding relationship between the sending logical channel and the receiving logical channel on the module 2010 A represents the logical channel on the first optical module, B represents the logical channel on the second optical module, T represents the sending logical channel, R represents the receiving logical channel, and numbers represent the number of the logical channel.
  • the mapping relationship can be As shown in Table 1.
  • step S102 includes the following various implementations:
  • Mode 1 If the preset rule is that all the M sending logical channels are locked, and/or all the M receiving logical channels are locked, then when the preset rule is satisfied, the first optical module 1010 passes the The M sending logical channels send M pieces of first uplink notification information to the second optical module 2010, that is, each sending logical channel sends one first uplink notification information respectively, and each first uplink notification information indicates to send the first uplink notification information The sending logical channel of the information is locked, and/or, indicating that the receiving logical channel corresponding to the sending logical channel of the first uplink notification information is locked.
  • Mode 2 If the preset rule is that all the M sending logical channels are locked, and/or all the M sending and M receiving logical channels are locked, then when the preset rule is satisfied, the first The processing unit 1020 of the network device sends second uplink notification information to the processing unit 2020 of the second network device, and the second uplink notification information indicates that the M sending logical channels of the first optical module are all locked and/or all The M receiving logical channels are all locked.
  • Mode 3 If the preset rule is that one of the M sending logical channels is locked, one of the M receiving logical channels is locked, or one of the M sending logical channels is locked If the sending logical channel is locked with the corresponding receiving logical channel, when the preset rule is satisfied, it is assumed that j sending logical channels among the M sending logical channels are locked, and the receiving channels corresponding to the j sending logical channels are locked, or The j sending logical channels are locked with the corresponding receiving logical channels, and the first optical module 1010 sends first uplink notification information to the second optical module through the j sending logical channels, and the first uplink notification information indicates the The j sending logical channels are locked, or the receiving logical channels corresponding to the j sending logical channels are locked, or the j sending logical channels are locked with the corresponding receiving logical channels, and j is greater than 1 and less than M, when the j sending logical channels are locked When the channel includes multiple sending logical channels, each sending logical channel corresponds to a first uplink notification
  • Mode 4 If the preset rule is that one or more sending logical channels in the M sending logical channels are locked, one or more receiving logical channels in the M receiving logical channels are locked, or the M receiving logical channels are locked One or more sending logical channels in the sending logical channel are locked with the corresponding receiving logical channel, and when the preset rule is satisfied, it is assumed that j sending logical channels in the M sending logical channels are locked, and the j sending logical channels are locked.
  • the receiving channel corresponding to the logical channel is locked, or the j sending logical channels are locked with the corresponding receiving logical channel
  • the processing unit 1020 of the first network device 100 sends the third uplink notification information to the processing unit 2020 of the second network device 200
  • the third uplink notification information indicates that the j sending logical channels are locked, the receiving channel corresponding to the sending logic j is locked, or the j sending logical channels and the corresponding receiving logical channels are locked, and j is greater than 1 and less than M.
  • the first uplink notification information, the second uplink notification information or the third uplink information may indicate the locking of logical channels in different scenarios, and the locking in which scenario is specifically indicated can be determined as required. set up.
  • the first uplink notification information in the first manner and the first uplink notification information in the third manner have the same format.
  • Each first uplink notification information includes an identifier of a sending logical channel for transmitting the first uplink notification information, and a lock flag, where the lock flag is used to indicate that the sending logical channel of the first uplink notification information is locked.
  • the first uplink notification information transmitted in different sending logical channels includes different channel identifiers.
  • the first uplink notification information transmitted in different sending logical channels may include the same lock flag.
  • the lock flag is obtained by modifying a specified field in the alignment identifier.
  • the lock identification may appear once or repeatedly.
  • the above-mentioned first uplink notification information may be obtained by modifying the alignment identifier shown in FIG. 4 or FIG. 5 , or may be obtained by modifying a specified field in the alignment identifier in other formats.
  • the first optical module is a 200G/400G optical module
  • the modified ⁇ UP 0 , UP 1 , UP 2 ⁇ as lock flags to indicate that one transmit logical channel is locked, M transmit logical channels are all locked, or M transmit logical channels and M receive logical channels All channels are locked.
  • the M pieces of first uplink communication information respectively transmitted in the M sending logical channels have the same locking flag.
  • the second uplink notification information in the second manner and the third uplink notification information in the fourth manner may have the same format or different formats.
  • the above-mentioned second uplink notification information and third uplink notification information may be carried in a Layer 2 Ethernet frame or an IP data packet.
  • the first network device 100 can notify that all the sending logical channels are locked and/or all the receiving logical channels are locked through one second uplink notification message.
  • the first network device 100 may send the third uplink notification information when it is determined that one or more sending logical channels are locked, one or more receiving logical channels are locked, or that one sending logical channel is locked with the corresponding receiving logical channel .
  • the first optical module 1010 or the first network device 100 can make the second optical module 2010 know the lock status of each logical channel in the first optical module 1010 .
  • the state determination unit 1011 may determine whether the lock status of the logical channel in the first optical module 1010 satisfies the preset rule, and in the first When the locked state of the logical channel in an optical module 1010 satisfies a preset rule, the notification unit 1012 is triggered to send the first uplink notification information, or the notification unit 1012 can determine the first optical module detected by the unit 1011 according to the state
  • the lock state of the logic channel in 1010 is used to determine whether the lock state of the logic channel in the first optical module 1010 satisfies the preset rule.
  • step S103 the first network device or the first optical module acquires downlink notification information, where the downlink notification information is used to enable the first optical module to determine that the logical channel in the second optical module is locked.
  • the downlink notification information is sent by the second network device 200 or the second optical module 2010, and the generation conditions and transmission methods of the downlink notification information are similar to the above-mentioned uplink notification information.
  • the downlink notification information is sent by the second network device 200 or the second optical module 2010, and the generation conditions and transmission methods of the downlink notification information are similar to the above-mentioned uplink notification information.
  • the first optical module 1010 receives M pieces of first downlink notification information through the M receiving logical channels, and the M pieces of first downlink notification information indicate that the logical channel in the second optical module 2010 is locked,
  • the logical channel locking in the second optical module 2010 includes M receiving logical channel locking and M transmitting logical channel locking of the second optical module 2010 .
  • the processing unit 1020 of the first network device 100 receives the second downlink notification information sent by the processing unit 2020 of the second network device 200, and sends the second downlink notification information to the first optical fiber Module 1010, the second downlink notification information indicates that the logical channel in the second optical module 2010 is locked, and the logical channel in the second optical module 2010 is locked including M receiving logical channels of the second optical module 2010 Lock and M-send logical channel lock.
  • the first optical module 1010 receives first downlink notification information through p receiving logical channels of the M receiving logical channels, and the first downlink notification information indicates the second receiving logical channel corresponding to the p receiving logical channels
  • the sending logical channel of the optical module 2010 is locked with the receiving logical channel, and p is greater than 1 and less than M.
  • the p receiving logical channels include multiple receiving logical channels, each receiving logical channel corresponds to a first downlink notification message.
  • the processing unit 1020 of the first network device 100 receives the third downlink notification information sent by the processing unit 2020 of the second network device 200, and sends the third downlink notification information to the first optical module 1010 , the second downlink notification information indicates that the sending logical channel of the second optical module 2010 corresponding to the p receiving logical channels is locked with the receiving logical channel, and p is greater than 1 and less than M.
  • the second optical module 2010 can return data to the first optical module 1010, indicating that the receiving logic channel of the second optical module must be locked. Therefore, in the first and second scenarios, the M first downlink notification information and the second downlink notification information indicate that the M receiving logical channels and the M transmitting logical channels of the second optical module 2010 are all locked; In the fourth scenario, the first downlink notification and the third downlink notification indicate that the sending logical channel and the receiving logical channel of the second optical module 2010 corresponding to the p receiving logical channels are locked.
  • the first downlink notification information in the above scenarios 1 and 3 may be received by the state determination unit 1012 in the first optical module 1010 .
  • the second downlink notification information in the above scenario 2 and the third downlink notification information in the scenario 4 can be received by the processing unit 1020 in the first network device 100 and sent to the state determination unit 1012 in the first optical module 1010 .
  • the processing unit 1020 may convert the second downlink notification information and the fourth downlink notification information into the first optical module 1010 state determination unit 1012 and send it in an identified format.
  • the above-mentioned second downlink notification information and third downlink notification information may be carried in a Layer 2 Ethernet frame or an IP data packet.
  • the first optical module processes data. Specifically, the first optical module encrypts data sent to the second optical module, or the first optical module decrypts data received from the second optical module. Wherein, the processing may further include inserting handshake information and the like into the data.
  • Step S104 may be performed by the encryption/decryption unit 1013 in the first optical module 1010, and the operation of encrypting data or decrypting data in step S104 is only a way of processing data.
  • the first optical module 1010 may further include other processing units, and accordingly, step S104 may also be replaced by other data processing operations.
  • the following describes the application of the state notification method provided by the embodiment of the present application with reference to the format of the alignment identifier in FIG. 4 and FIG. 5 and the schematic diagram of the data transmission process in FIG. 12 .
  • the PCS of the first network device 100 When the first network device 100 transmits data to the second network device 200 , as shown in FIG. 12 , the PCS of the first network device 100 periodically inserts AMs into the data stream, and the AMs inserted by the PCS are all shown in FIG. 4 or FIG. 5 . the standard AM.
  • the state determination unit of the first optical module 1010 detects the state of each transmitting logical channel and each receiving logical channel of the first optical module in real time.
  • the first optical module 1010 transmits the data stream to the M transmit logical channels, and identifies the transmit logical channel and/or the receive logical channel for each transmit logical channel and/or receive logical channel. /or the AM in the data stream transmitted in the receiving logical channel, according to the AM and the reference AM of the sending logical channel and/or the receiving logical channel (the reference AM is the AM listed in FIG. Whether the logical channel of the optical module is locked, and determine whether the logical channel in the second optical module is locked (for various implementations of whether the logical channel in the first optical module 1010 and the second optical module 2010 is locked, refer to the description of the above embodiments) .
  • the first optical module When the logical channel in the first optical module 1010 is unlocked, the first optical module transmits the standard AM inserted in the PCS layer (that is, the first optical module directly transmits the AM without modifying the AM).
  • the first optical module modifies the acquired AM so that the AM carries a lock mark.
  • the AM is the AM shown in FIG. 5
  • the lock flag is obtained by modifying the UP x field in the AM shown in FIG. 5
  • the UP x field can be one or more of UP 0 , UP 1 and UP 2 .
  • the lock flag may occupy one or more bits, and the value of the lock flag may be predetermined, for example, the lock flag may be "01" or "0011” and so on.
  • the lock mark may be repeatedly transmitted (that is, repeated in the AM). For example, in Figure 12, the lock flag is "01", then the values of UP 0 , UP 1 and UP 2 are all "01010101", so that the lock flag can be transmitted 12 times through one AM, then the lock flag is wrong. The probability will be very small.
  • the bit sequence has been in error for about 10,000 years, and the reliability is extremely high.
  • the first optical module 101 modifies the first AM corresponding to the logical channel acquired after the logical channel is locked, Make the AM include a multi-frame marker, which indicates that the data transmitted after the AM is processed data, the multi-frame marker may occupy one or more bits, and the multi-frame marker is different from the lock marker. Frame markers can also be repeated in AM to improve transmission reliability. As shown in Fig. 12, the multiframe is marked as "10", then the values of UP 0 , UP 1 and UP 2 are all "01010101".
  • the AM after the AM including the multi-frame mark may include encryption information such as a key and an IV, so that the second optical module 2010 can decrypt the data stream according to the key and the IV after receiving the data stream.
  • FIG. 13 another schematic diagram of a data transmission process provided by an embodiment of the present application.
  • the difference from FIG. 12 is that FIG. 13 does not include the multi-frame identifier.
  • the first optical module 1010 modifies the logical
  • the AM includes an encryption mark
  • the encryption mark indicates that the data stream behind the AM is an encrypted data stream.
  • the second optical module 2010 decrypts the data stream.
  • multi-frame flags and encryption flags in FIGS. 12 and 13 can also be replaced with other information, so that the optical module can realize more operations.
  • the encryption/decryption component in the first optical module 1011 in this application may be implemented by software or by hardware. When implemented by hardware, it can be implemented by an independent chip, or it can be implemented by a logic circuit, and the chip or the logic circuit can be integrated in the optical module.
  • the multiple involved in the embodiments of the present application refers to two or more.
  • "And/or" which describes the association relationship of the associated objects, means that there can be three kinds of relationships, for example, A and/or B, which can mean that A exists alone, A and B exist at the same time, and B exists alone.
  • the character "/" generally indicates that the associated objects are an "or" relationship.
  • the naming or numbering of the steps in this application does not mean that the steps in the method flow must be executed in the time/logical sequence indicated by the naming or numbering, and the named or numbered process steps can be implemented according to the The technical purpose is to change the execution order, as long as the same or similar technical effects can be achieved.
  • the division of units in this application is a logical division. In practical applications, there may be other division methods. For example, multiple units may be combined or integrated into another system, or some features may be ignored. , or not implemented, in addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, and the indirect coupling or communication connection between units may be electrical or other similar forms. There are no restrictions in the application.
  • units or sub-units described as separate components may or may not be physically separated, may or may not be physical units, or may be distributed into multiple circuit units, and some or all of them may be selected according to actual needs. unit to achieve the purpose of the scheme of this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请提供了一种状态通知方法、光模块、网络设备以及网络系统。该方法包括：确定第一光模块内的逻辑通道的锁定状态，所述第一光模块属于第一网络设备，所述锁定状态包括锁定或未锁定；当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，发送上行通知信息，所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。本申请的光模块能够确定对端光模块的逻辑通道是否锁定，并在对端光模块的逻辑通道锁定后才执行后续操作，可以提高后续操作的可靠性。

Description

一种状态通知方法、光模块、网络设备以及网络系统
本申请要求于2021年1月8日提交中国国家知识产权局、申请号为202110021317.3的中国专利申请，以及2021年4月2日提交中国国家知识产权局、申请号为202110363540.6的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信技术，尤其涉及一种状态通知方法、光模块、网络设备以及网络系统。
背景技术
随着移动智能终端、个人电脑的普及，互联网络已成为人们工作、生活的一部分。而一般情况下，大部分数据在局域网络中都是以明文形式传输的，这样就会存在许多安全隐患，比如：银行帐户的信息被窃取、篡改，遭受恶意网络攻击等，由此保证网络数据传输的安全性已日益成为企业和个人客户的基本要求。而在目前广泛使用的网络安全技术中，数据加密技术就是一种保障网络安全的重要手段。数据加密技术可以应用于开放系统互连模型(Open System Interconnection)的应用层，传输层，网络层，数据链路层或者物理层。
在数据加密技术领域，如何在物理层实现数据加密的可靠性是本领域技术人员关心的技术问题。
发明内容
本申请提供了一种状态通知方法、光模块、网络设备以及网络系统，以实现物理层数据加密的可靠性。
本申请第一方面提供了一种状态通知方法，该方法包括：确定第一光模块内的逻辑通道的锁定状态，所述第一光模块属于第一网络设备，所述锁定状态包括锁定或未锁定；当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，所述第一网络设备或第一光模块发送上行通知信息，所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。所述第一光模块内的逻辑通道是通过对该光模块的物理通道经过比特复用生成的。
本申请中上述方法中，当确定第一光模块内的逻辑通道锁定时，发送上行通知信息，使通信对端的第二光模块确定所述第一光模块内的逻辑通道锁定。这样，第二光模块可以在第一光模块内的逻辑通道锁定后才对需要发往第一光模块的数据执行加密等操作，或对从第一光模块接收的数据执行解密等操作，可以提高物理层数据加密的可靠性。
可选地，该方法还包括：获取下行通知信息，所述下行通知信息用于使所述第一光模块确定所述第二光模块内的逻辑通道锁定。
可选地，当所述第一光模块内的逻辑通道锁定，且所述第二光模块内的逻辑通道锁定后，所述第一光模块加密发往所述第二光模块的数据；或，所述第一光模块解密从所述第二光模块接收的数据。
通过执行上述方法，第一光模块可以在第二光模块内的逻辑通道锁定后，才对需要发往第二光模块的数据执行加密等操作，或对从第一光模块接收的数据执行解密等操作，结合第二光模块的操作，可以进一步提高物理层数据加密/解密的可靠性。
可选地，可以由第一光模块确定所述第一光模块内的逻辑通道的锁定状态，也可以由所述第一网络设备的处理部件从所述第一光模块获取所述第一光模块内的逻辑通道的锁定状态。
本申请可以由第一光模块或由第一光模块所属的第一网络设备的处理部件确定所述第一光模块内的逻辑通道的锁定状态，提高了本申请上述方法的灵活性。
可选地，所述第一光模块内的逻辑通道包括M条发送逻辑通道和M条接收逻辑通道，M大于等于1，所述确定第一光模块内的逻辑通道的锁定状态包括：确定所述M条发送逻辑通道中每条发送逻辑通道的状态；和/或确定所述M条接收逻辑通道中每条接收逻辑通道的状态。
本申请可以确定第一光模块内的每条发送逻辑通道或接收逻辑通道的状态，使得获取的第一光模块内的逻辑通道的状态更加准确。
在一个实施方式中，所述第一光模块内的逻辑通道锁定包括：所述M条发送逻辑通道全部锁定，和/或，所述M条接收逻辑通道全部锁定。在这种情况下，所述第一光模块分别通过所述M条发送逻辑通道向所述第二光模块发送M个第一上行通知信息，所述M个第一上行通知信息中的每个第一上行通知信息指示发送所述第一上行通知信息的发送逻辑通道锁定，和/或指示所述第一上行通知信息的发送逻辑通道对应的接收逻辑通道锁定；或，所述第一网络设备的处理部件向所述第二网络设备的处理部件发送第二上行通知信息，所述第二上行通知信息指示所述第一光模块的所述M条发送逻辑通道和/或所述M条接收逻辑通道全部锁定。
本申请中的上行通知信息可以由第一光模块发送，也可以由第一网络设备发送。当上行通知信息由第一光模块发送时，第一光模块向该M条发送逻辑通道中的每个发送逻辑通道发送一个第一上行通知信息，这个第二光模块共可以接收到M个第一上行通知信息，第二光模块根据该M个第一上行通知信息即可知道该第一光模块内的逻辑通道全部锁定(根据设置，可以是发送逻辑通道和/或接收逻辑通道全部锁定)。当上行通知信息由第一网络设备发送时，第一网络设备可以只发送一条第二上行通道信息，该第二上行通道信息包括指示该第一光模块的发送逻辑通道和/或接收逻辑通道全部锁定的信息，该信息可以是标记，或者是所有发送逻辑通道和/或接收逻辑通道的隧道标识。
本申请中由第一光模块或第一网络设备发送上行通知信息，实现方式更加灵活。
在另一个实施方式中，所述第一光模块内的逻辑通道锁定包括以下一项或多项：所述M条发送逻辑通道中的一条发送逻辑通道锁定；所述M条接收逻辑通道 中的一条接收逻辑通道锁定；和，所述M条发送逻辑通道中的一条发送逻辑通道与对应的接收逻辑通道锁定。
在这种情况下，第一光模块通过j条发送逻辑通道向所述第二光模块发送第一上行通知信息，所述第一上行通知信息指示所述j条发送逻辑通道锁定，或所述j条发送逻辑通道对应的接收逻辑通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M，当所述j条发送逻辑通道包括多条发送逻辑通道时，每条发送逻辑通道对应一个第一上行通知信息；或所述第一网络设备的处理部件向所述第二网络设备的处理部件发送第三上行通知信息，所述第三上行通知信息指示j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
本申请中由第一光模块或第一网络设备发送上行通知信息，第一光模块发送的第一上行通知信息可以承载在物理层比特流中，第一网络设备发送的第二上行通知信息和第三上行通知信息可以承载在二层以太网帧或IP数据包中，实现方式更加灵活。
可选地，每个第一上行通知信息(通过该M条发送逻辑通道中的任意一个发送逻辑通道发送的第一上行通知信息)包括传输所述第一上行通知信息的发送逻辑通道的标识，以及锁定标记。
可选地，所述第一上行通知信息为对齐标识符。所述对齐标识符例如可以是200G/400G对应的标准对齐标识符，或者其他设定格式的对齐标识符，该对齐标识符能够用于确定逻辑通道是否锁定。所述锁定标记通过修改所述对齐标识符中的指定字段得到。可选地，所述指定字段为200G/400G对齐标识符中的UP x字段。
本申请的上述实施方式只需要修改标准对齐标识符，能够兼容现有的方法，容易实现，并且保证在数据传输的过程中不增加额外的带宽。
可选地，所述锁定标识在所述UP x字段中重复出现。即在UP x字段中携带多个锁定标识。通过本方式，可以规避传输过程中出现的误码，确保第二光模块能够准确获取第一光模块的状态。
在一种实现方式中，所述第一光模块通过所述M个接收逻辑通道接收M个第一下行通知信息，所述M个第一下行通知信息指示所述第二光模块内的逻辑通道锁定；或所述第一网络设备的处理部件接收所述第二网络设备的处理部件发送的第二下行通知信息，并将所述第二下行通知信息发送给所述第一光模块，所述第二下行通知信息指示所述第二光模块内的逻辑通道锁定。
在另一个实施方式中，所述第一光模块通过所述M个接收逻辑通道的p条接收逻辑通道接收第一下行通知信息，所述第一下行通知信息指示所述p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M，当所述p条接收逻辑通道包括多条接收逻辑通道时，每条接收逻辑通道对应一个第一下行通知信息；或所述第一网络设备的处理部件接收所述第二网络设备的处理部件发送的第三下行通知信息，并将所述第三下行通知信息发送给所述第一光模块，所述第三下行通知信息指示p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
本申请中，第一光模块还可以获取第二光模块内的逻辑通道的状态，具体方式可以是第一光模块直接接收第一下行通知信息，或者第一光模块通过第一网络设备的处理模块接收第二下行通知信息或第三下行通知信息。该第一下行通知信息的传输方式可以参考上述第一上行通知信息，该第二下行通知信息和第三下行通知信息的传输方式可以参考上述第二上行通知信息和第三上行通知信息。
本申请中的第一光模块和第二光模块可以获取对端的逻辑通道的锁定状态，并在锁定状态满足预设的规则时，执行相应的处理，可以提高数据处理(包括加密和解密)的可靠性。并且，本申请可以单独判断每条逻辑通道的所述状态，不需要考虑其他逻辑通道的状态带来的干扰，降低了处理开销。当本申请利用标准规定的对齐标识符传输第一上行通知信息和下行通知信息时，不增加网络带宽，可以避免带宽资源的浪费。
本申请第二方面提供了一种光模块，所述光模块为上述第一方面的第一光模块，该包括状态确定单元和通知单元。所述状态确定单元，用于确定所述第一光模块内的逻辑通道的锁定状态，所述第一光模块属于第一网络设备，所述锁定状态包括锁定或未锁定；所述通知单元，用于当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，发送上行通知信息，所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。
可选地，所述状态确定单元还用于获取下行通知信息，所述下行通知信息用于使所述状态确定单元确定所述第二光模块内的逻辑通道锁定。
可选地，所述第一光模块还包括加密/解密单元，用于在所述第一光模块内的逻辑通道锁定，且所述第二光模块内的逻辑通道锁定时，加密发往所述第二光模块的数据，或解密从所述第二光模块接收的数据。
可选地，第一光模块内的逻辑通道包括M条发送逻辑通道和M条接收逻辑通道，所述状态确定单元用于：确定所述M条发送逻辑通道中每条发送逻辑通道的状态，和/或，确定所述M条发送逻辑通道中每条发送逻辑通道的状态。
可选地，所述第一光模块内的逻辑通道锁定包括所述M条发送逻辑通道全部锁定，和/或，所述M条接收逻辑通道全部锁定。这种情况下，所述通知单元用于：分别通过所述M条发送逻辑通道向所述第二光模块发送M个第一上行通知信息，所述M个第一上行通知信息中的每个第一上行通知信息指示发送所述第一上行通知信息的发送逻辑通道锁定，和/或，指示所述第一上行通知信息的发送逻辑通道对应的接收逻辑通道锁定；或，向所述第一网络设备的处理部件发送第二上行通知信息，以使所述第一网络设备的处理部件向所述第二网络设备的处理部件发送所述第二上行通知信息，所述第二上行通知信息指示所述第一光模块的所述M条发送逻辑通道和/或所述M条接收逻辑通道全部锁定。
可选地，所述第一光模块内的逻辑通道锁定包括以下一项或多项：所述M条发送逻辑通道中的一条发送逻辑通道锁定；所述M条接收逻辑通道中的一条接收逻辑通道锁定；和所述M条发送逻辑通道中的一条发送逻辑通道与对应的接收逻辑通道锁定。这种情况下，所述通知单元用于：通过j条发送逻辑通道向所述第二光模块 发送第一上行通知信息，所述第一上行通知信息指示所述j条发送逻辑通道锁定，或所述j条发送逻辑通道对应的接收逻辑通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M，当所述j条发送逻辑通道包括多条发送逻辑通道时，每条发送逻辑通道对应一个第一上行通知信息；或，向所述第一网络设备的处理部件发送第三上行通知信息，以使所述第一网络设备的处理部件向所述第二网络设备的处理部件发送所述第三上行通知信息，所述第三上行通知信息指示j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
可选地，当所述通知单元发送第一上行通知信息时，所述第一上行通知信息包括传输所述第一上行通知信息的发送逻辑通道的标识，以及锁定标记。
可选地，所述第一上行通知信息为对齐标识符，所述锁定标记通过修改所述对齐标识符中的指定字段的值得到。
可选地，所述第一光模块为200G或更高速率的光模块，所述指定字段为200G/400G对齐标识符中的UP x字段，所述锁定标识在所述UP x字段中重复出现。
可选地，在获取下行通知信息时，所述状态确定单元用于：通过所述M个接收逻辑通道接收M个第一下行通知信息，所述M个第一下行通知信息指示所述第二光模块内的逻辑通道锁定；或，接收所述第一网络设备的处理部件发送的第二下行通知信息，所述第二下行通知信息指示所述第二光模块内的逻辑通道锁定。
可选地，在获取下行通知信息时，所述状态确定单元用于：通过所述M个接收逻辑通道的p条接收逻辑通道接收第一下行通知信息，所述第一下行通知信息指示所述p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M；或，接收所述第一网络设备的处理部件发送的第三下行通知信息，所述第三下行通知信息指示p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
该状态确定单元，通知单元和加密/解密单元可以是独立的部件，也可以集中在一个部件中。例如，上述光模块还包括一个N：M比特复用单元和一个M：K比特复用单元。该N：M比特复用单元用于将N路物理通道信号转换成M路逻辑通道信号，该M：K比特复用单元用于将M路逻辑通道信号转换成K路逻辑通道信号。N：M比特复用单元和一个M：K比特复用单元之间包括一个加密/解密部件，该加密/解密部件包括上述的状态确定单元，通知单元和加密/解密单元。
通过在N：M比特复用单元和M：K比特复用单元之间设置上述加密/解密部件，可以使光模块执行本申请第一方面的方法的过程对外部不可见，对现有设备的改动较小。
本申请上述状态确定单元，通知单元和加密/解密单元可以由软件实现，也可以由硬件实现。
本申请第三方面提供了一种网络设备，该网络设备包括处理部件以及第一光模块，所述第一光模块为上述第二方面及其各实现方式中所述的光模块，所述处理部件用于：
从所述第一光模块获取所述第一光模块内的逻辑通道的锁定状态；以及
当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，向第二网络设备发送上行通知信息，所述上行通知信息用于指示所述第一光模块内的逻辑通道锁定。
可选地，所述上行通知信息为上述第一方面中的第二上行通知信息，该第二上行通知信息指示所述第一光模块的M条发送逻辑通道和/或M条接收逻辑通道全部锁定；或
所述上行通知信息为上述第二方面中的第三上行通知信息，该第三上行通知信息指示所述第一光模块的j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
可选地，所述处理部件还用于接收所述第二网络设备发送的下行通知信息，并将所述下行通知信息发送给所述第一光模块。
可选地，所述下行通知信息为上述第一方面中的第二下行通知信息，所述第二下行通知信息指示第二光模块内的逻辑通道锁定(可以是M条接收逻辑通道和M条发送逻辑通道全部锁定)；或，所述下行通知信息上述第一方面中的第三下行通知信息，所述第三下行通知信息指示p条接收逻辑通道对应的第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
所述第二光模块属于所述第二网络设备，所述第二光模块连接所述第一光模块。
本申请第四方面提供了一种网络系统，包括第一网络设备和第二网络设备，所述第一网络设备为如上述第三方面及其任意实施方式所述的网络设备，所述第一网络设备用于实现上述第一方面的方法中的相关步骤。所述第二网络设备与所述第一网络设备具有相同的功能。
本申请第五方面提供了一种逻辑电路，当所述逻辑电路运行时，可以实现本申请上述第一方面及其各实现方式中由第一光模块实现的功能，该逻辑电路可以集成在本申请第二方面及其各实施方式中的光模块中。
本申请第六方面提供了一种芯片，该芯片可以包括上述第五方面提供的逻辑电路。
本申请第二到第六方面的有益效果，可以参考对第一方面及其各实施方式的有益效果的描述。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对本申请实施例描述中所需要使用的附图作简单地介绍。
图1A为以太网协议结构示意图；
图1B为以太网协议OSI参考模型中各层的对应关系示意图；
图2A为本申请一种光模块的结构示意图；
图2B为光数字信号处理芯片的工作电路示意图；
图3为比特复用过程示意图；
图4为200G/400G通道使用的对齐标识符的结构；
图5为400G通道的每个逻辑通道的对齐标识符的结构；
图6为本申请提供的一种实现MACsec功能的架构示意图；
图7为本申请提供的一种光模块加密方案；
图8为本申请提供的一种光模块的结构示意图；
图9为本申请提供的状态通知方法的应用场景示意图；
图10为本申请提供的网络系统的结构示意图；
图11为本申请提供的状态通知方法的流程示意图；
图12为本申请提供的一种数据传输过程示意图；
图13为本申请提供的另一种数据传输过程示意图。
具体实施方式
本申请提供了一种加密方法，以提高物理层加密的可靠性。本申请可以应用于以太网的物理层。以下结合附图1A和图1B对以太协议进行介绍。
如图1a所示，为以太协议的结构示意图。以太网包括物理层(Physical Layer)和媒体访问控制(Media Access Control，MAC)层。其中，物理层包括传输模块和物理层实体(Physical Layer entity,PHY)，该传输模块包括传输介质，该传输介质用于传输数据。传输介质例如可以是电缆或光模块，光模块用于连接光纤。
上述PHY包括物理介质相关子层(physical medium dependent，PMD)、物理介质接入子层(physical medium attachment，PMA)、以及物理编码子层(physical coding sublayer)。以太网的MAC层主要包括MAC控制子层(MAC control)和协调子层(reconciliation sublayer，RS)。图1B示出了开放系统互联参考模型的层次与以太网中MAC层和PHY层的对应关系。其中，OSI参考模型的数据链路层对应MAC层中协调子层之上的功能，OSI参考模型的物理层对应PHY层以及MAC层中的协调子层。该MAC/PHY架构可以支持多种速率的数据传输，不同传输速率需要不同的传输介质和介质无关接口(media independent interface，MII)。
随着网络的发展，越来越多的网络设备之间的通信采用光纤传输，光模块也成了极为重要的器件。如图2A所示，为光模块的结构示意图。该光模块包括光电收发器(简称TX/RX)，控制器，以及处理单元。其中，控制器用于控制光电收发器和处理单元执行各种操作。控制器可以是微控制器单元(micro-controller unit，MCU)。处理单元可以用于数字信号/模拟信号的编解码，以及用于对传输链路中的诸多代价进行补偿，比如长距离传输的色散补偿。处理单元还可以包括比特复用/解复用器(本申请称为BitMux)，BitMux用于将通过N个物理通道接收的信号映射到处理单元中的内部处理通道。内部处理通道可以有一个或多个。处理单元例如可以是光数字信号处理芯片(optical digital signal processor,oDSP)。如图2B所示，为oDSP的工作电路示意图。在发送方向，数字信号经过oDSP处理后，通过调制算法转换为模拟调制电信号，调制算法可以为交叉正交幅度调制(cross quadrature amplitude modulation，XQAM)。模拟调制电信号经过光发送器TX处理后转换为调制光信号，并发送该调制光信号。在接收方向，光信号通过光接收器处理后转换为模拟调制电信号，模拟调制电信号经过oDSP处理后转换为数字信号。
在通信过程中，当网络设备作为发送端时，该网络设备接收数据，并由该网络设备 的MAC层将接收的数据流组成以太帧，然后将以太帧发送给PCS，由PCS对数据进行码块编码，并将编码后的数据发送到PCS中的多个逻辑通道，经过该多个逻辑通道发送到PMA，PMA对该多个逻辑通道的数据经过比特复用(bit mux)后，分发到一路或多路物理通道，这一路或多路物理通道的数据经过PMD子层处理后，变为模拟信号通过介质相关接口(MDI)发送到传输介质。接收方向上的处理与发送方向上的处理相反。
上述逻辑通道(logical lanes)又可以称为虚拟通道(virtual lanes)，本申请中指PCS lane或前向纠错(forward error correction，FEC)lane(100G标准中为FEC lane，200G/400G标准中为PCS lane)。这些通道一般分布在PCS的实现单元内部。比如200G以太网规定的PCS或FEC通道个数为8，400G以太网规定的逻辑通道的个数为16,100G以太网规定的逻辑通道的个数为4。上述物理通道指PMA lane。一个物理通道可以承载一个或多个逻辑通道的数据。在100G/200G/400G高速以太网中，根据实现的不同，物理通道数也会不同。
上述比特复用是一种函数，适用于所有输入/输出通道计数以及每个方向的传输，可以将由m个输入通道接收的数据流(data streams)/数据比特(data bits)通过比特交织的方式发送到n个输出通道，比如m:n＝4:2时,每两个输入通道的比特流交织为1个输出通道的比特流。图3为一种比特复用过程示意图。图3中，4个输入通道的信号流在PMA子层比特复用之后被发送到2个输出通道。
当数据在不同的逻辑通道与物理通道上传输时，为了保证接收端可以对齐多条逻辑通道(即确定通过各逻辑通道接收的数据具有相同的码组边界)，IEEE 802.3标准设计了对齐标识符(alignment marker，AM)。发送端PCS将一条串行流分发到多条PCS lane时，会周期性往每个PCS lane的数据流中插入AM，接收端根据各通道的AM实施AM锁定(即锁定该AM对应的通道)，以便将多路信号合并为一路串行信号。不同传输速率(100Gb/s，200Gb/s，400Gb/s等)对应的对齐标识符的格式可能不同。200Gb/s以及400Gb/s的AM格式如图4所示，其中CM 0,CM 1,CM 2,CM 3,CM 4,CM 5是所有逻辑通道的共同标识，而UM 0,UM 1,UM 2,UM 3,UM 4,UM 5则用于唯一标识一个逻辑通道，即不同的逻辑通道具有不同的“UM 0,UM 1,UM 2,UM 3,UM 4,UM 5”组合。UP 0,UP 1,UP 2为用户可编辑字段。200G以及400G的AM长度为120比特(bits)，以0～119定位(position)，则{CM 0,CM 1,CM 2}，{CM 3,CM 4,CM 5}，{UM 0,UM 1,UM 2}，{UM 3,UM 4,UM 5}分别占24比特，而{UP 0}，{UP 1}和{UP 2}各占8比特。IEEE802.3规定，200G对应8个逻辑通道，400G对应16个逻辑通道。以400G通道为例，每个逻辑通道的对齐标识符的编码结构如图5所示。将CM 0-CM 5划分为12个符号，每个符号占用4比特(即半字节，nibble)，接收端比较接收的AM中的CM 0-CM 5与图5中的CM 0-CM 5，当接收的AM中存在小于或等于3个的nibble与图5中的CM 0-CM 5不匹配时，才能锁定一个逻辑通道，并正确识别出这个逻辑通道的编号(number)。
为了保障以太网的通信安全，本领域提出了一种加密协议MACsec，其运行在MAC层，能够基于介质访问无关协议实现无连接数据的完整性和机密性。MACsec应用高级加密标准(Advanced Encryption Standard,AES)对分组应用对称秘钥加密，以生成加密数据。分组意味着把明文(plaintext)分成不同的组，每组长度相等，每次加密一组数据，直到加密完整个明文。其中，分组长度可以是128位，192位，256位等。在对一 组数据加密时，MACsec先将分组数据切分成帧，然后针对每一帧加密，得到加密帧，每个加密帧都携带16字节的完整性校验值(Integrity Check Value，ICV)，以及12字节的初始化矢量(Initialization Vector，IV)，当平均帧长64字节时，采用MACsec加密会占用(16+12)/64＝43％用户带宽。可见，当采用MACsec对以太帧加密时，需要在以太帧中添加相关的加密信息，占用了较多的用户带宽。
近年来随着网络设备容量的翻倍增长，功耗带来的散热、供电等工程挑战越来越大，客户对降功耗诉求越来越强烈；而随着高性能计算、AI等加速推广，对网络时延的关注度也越来越高。尽管MACsec是基于以太网数据链路层(二层)实现数据加解密，但随着系统容量提升、端口带宽增长，基于高速率大容量芯片实现MACsec功能所需功耗代价越来越大；而新业务下时延带来的影响也越来越明显。如图6所示，业界多采用在网络设备的交换芯片外面设置支持MACsec功能的物理芯片。可选地，也可以由交换芯片实现MACsec功能。其中，交换芯片可以部署在单板(又称为线卡)上。
但不论是基于物理芯片还是基于交换芯片的方式，该实现都与单板硬件强相关，因此无法满足客户基于已有传统单板实现MACsec加解密的需求。另外，用户(指购买并使用网络设备的个人或实体)现场应用中对端口加密的需求往往动态变化且难以预测，譬如：在购买网络设备时仅有8个固定端口支持MACsec功能即可满足当时需求，若后续应用需要更多MACsec端口则只能更新硬件、追加投资；若购买网络设备的MACsec端口数远远多于实际需求，又容易过度投资，因此该方案无法满足客户已有传统硬件系统或现场动态变化需求。
针对上述问题，如图7所示，本申请提出了一种光模块加密的方案。由于光模块可以独立于单板存在，用户只需要购买支持加密的光模块即可满足新的加密需求。图7中的方案利用AM的可修改字段承载加密参数，不会增加额外的带宽。上述可修改字段例如可以是200G或400G的AM中的UP 0，UP 1和UP2字段中的一个或多个(本申请中统称为UP x字段)。可选地，当允许增加带宽时，还可以通过在数据流的特定位置插入填充信息(padding)承载加密参数。同样地，在加密前，保证加密侧设备和解密侧都已经完成AM锁定。其中，AM锁定是指当从一个逻辑通道的数据流中找到两个连续的AM与该通道的AM匹配(即两个连续的AM与该通道的AM相同或与该通道的AM的比较结果满足匹配规则)，则认为该通道被锁定，通道被锁定后，可以执行针对该通道中的数据流的操作(例如，插入加密参数，对齐各个通道等)。对齐用于弥补不同通道之间因传输导致的偏差，使接收端在从各个通道接收到完整的数据块后才进行相应的处理。
为了实现图7所示的光模块加密方案，本申请还提供了一种光模块。如图8所示，为本申请提供的改进的光模块的结构示意图，该光模块包括控制器，处理单元以及TX/RX。进一步地，该光模块还包括BitMux，用于执行比特复用功能。该BitMux可以部署在处理单元上或处理单元之外。该BitMux可以包括两个子比特复用功能，N:M BitMux和M:K Bitmux。其中，N(N>＝1)为外部物理通道的数量，M(M>＝1)为BitMux内部虚拟通道的数量，K(K>＝1)为光模块支持的物理通道的数量。该BitMux还包括加密/解密组件。当该光模块应用于发送端时，光模块接收物理层中PMD(或其他电芯片)传输的N路物理通道数据流；N:M BitMux将输入到光模块中的N路物理通道数据 流转换为M路逻辑通道数据流；加密/解密组件从该M路逻辑通道数据流中识别出每个逻辑通道的AM，在每个逻辑通道的AM中添加加密参数，并加密数据报文，得到加密后的M路数据流，然后，M:K BitMux将该加密后的M路逻辑通道数据流复用到处理单元的K路物理通道上形成K路数据流，处理单元对该K路数据流实施算法处理(例如色散补偿预处理，可选)，然后，该处理后的K路数据流被Tx转换为光信号并发送给其他光模块。当应用于接收端时，该光模块接收来自其他光模块的光信号，该光信号承载加密的数据流，该光信号经由Rx转换为电信号，处理单元对该电信号实施算法处理(例如色散补偿等)得到数字信号，并将该数字信号通过K路物理通道发送到M:K BitMux；M:K BitMux将该K路物理通道数据流转换为M路逻辑通道数据流，加密/解密组件识别该M路逻辑通道数据流中的AM，获取其中的加密参数后，对该M路逻辑通道数据流解密，得到解密后的M路数据流，并将解密后的M路数据流通过M条逻辑通道发送给N:M BitMux，N:M BitMux将接收的M路逻辑通道数据流转换成N路物理通道数据流传输到物理层中的PMD或其他电芯片。
图7所示的加密方案在进行加密前，需要保证加密侧设备和解密侧设备已经完成AM锁定，这样才能保证数据正确传输。因此，需要一种机制，确保加密侧设备和解密侧设备都能够在已经完成AM锁定后才对数据执行加密/解密操作。那么，如何判断加密侧设备和解密侧设备是否已经完成AM锁定就是非常关键的技术。相应地，本申请提供了一种状态通知方法以及相关装置，用于使网络设备(即位于通道任一端的设备，可以为加密侧设备或解密侧设备)获取通道的AM锁定状态，并根据通道的AM锁定状态确定是否可以执行加密/解密操作。通道的AM锁定状态可以是两端设备之间的全部通道的AM的锁定状态，或其中一条通道的AM锁定状态。当通道的一端设备为本端时，该通道的另一端设备为对端，相应地，通道的AM锁定状态包括：本端AM未锁定，且对端AM未锁定；本端AM未锁定，且对端AM锁定；本端AM锁定，且对端AM未锁定；以及，本端AM锁定，且对端AM锁定。
本申请提供的状态通知方法可以应用于图9所示的场景中。在图9中，边缘节点A通过中间节点B和中间节点C连接边缘节点D。边缘节点A与中间节点B之间、中间节点B与中间节点C之间，以及中间节点C与边缘节点D之间基于以太网连接。任意两个直接相连的节点之间，都可以应用本申请的状态通知方法。
基于图8所示的光模块，图10以两个直接相连的网络设备为例，介绍本申请提供的网络系统。如图10所示，所述网络系统包括第一网络设备100和第二网络设备200。第一网络设备100和第二网络设备200可以是图9中任意两个节点。第一网络设备100包括第一光模块1010，第二网络设备包括第二光模块2010。第一网络设备100的第一光模块1010连接第二网络设备200的第二光模块2010。第一光模块1010的加密/解密组件进一步包括状态确定单元1011，通知单元1012，加密/解密单元1013，在发送方向上的M个逻辑通道(本申请称为发送逻辑通道)，以及在接收方向上的M个逻辑通道(本申请称为接收逻辑通道)。第二光模块2010与第一光模块1010具有类似的结构和功能。本申请为了简洁，仅示出了第一光模块1010中的加密/解密组件的结构示意图。其中，状态确定单元1011、通知单元1012和加密/解密单元1013的实现方式本申请不予限定。
第一光模块1010确定第一光模块1010的逻辑通道的锁定状态，并在第一光模块 1010的逻辑通道锁定后，向第二网络设备200的第二光模块2010发送第一上行通知信息(为了描述方便，本申请将从第一网络设备100到第二网络设备200的方向称为上行方向，将从第二网络设备200到第一网络设备100的方向称为下行方向，相应地，将从第一网络设备100发往第二网络设备200的通知信息上行通知信息，将从第二网络设备200发往第一网络设备100的通知信息称为下行通知信息)，或触发所述第一网络设备100的处理部件1020(部署在光模块1010的外面)向所述第二网络设备发送第二上行通知信息或第三上行通知信息，所述第一上行通知信息或、第二上行通知信息或第三上行通知信息用于使所述第二光模块2010确定所述第一光模块1010的逻辑通道锁定。第一光模块1010或第二光模块2010在确定本端和对端的逻辑通道均锁定后，才执行相应的加密/解密操作。当第一网络设备作为加密侧设备时，第二网络设备作为解密侧设备，反之亦然。本申请为了方便，以下结合图10和图11，以第一网络设备为发送端(加密侧设备)，第二网络设备为接收端(解密侧设备)为例，详细说明本申请的状态通知方法。
如图11所示，为本申请所示的状态通知方法的流程示意图，包括步骤S101-S104。所述方法由图10所示的第一光模块1010或所述第一网络设备100执行。
在步骤S101中，确定所述第一光模块内的逻辑通道的锁定状态。
如前所述，第一光模块1010通过图10中的N个物理通道接收N路物理通道信号，并将该N路物理通道信号通过N:M BitMux转换为分别通过M个发送逻辑通道传输的M路逻辑通道信号，每路逻辑通道信号中包括由第一网络设备100的PCS层间隔插入的对齐标识符。第一光模块通过图10中的K个物理通道接收K路物理通道信号，并将该K路物理通道信号经过M:K BitMux转换为分别通过M个接收逻辑通道传输的M路逻辑通道信号，每路逻辑通道信号中包括由第二网络设备的PCS层插入的对齐标识符。
由于第一光模块内的逻辑通道包括M条发送逻辑通道和M条接收逻辑通道，确定第一光模块内的逻辑通道的锁定状态包括：确定所述M条发送逻辑通道中每条发送逻辑通道的状态；或确定所述M条发送逻辑通道和M条接收逻辑通道中每条逻辑通道的状态。每条逻辑通道的状态包括锁定或未锁定。逻辑通道锁定，是指在该逻辑通道上，符合匹配规则的对齐标识符，进而可以准确识别对齐标识符的位置。当逻辑通道锁定后，即可以通过该逻辑通道传输数据。逻辑通道未锁定，是指该逻辑通道不能用于传输数据，即使该逻辑通道中有数据，该数据也被认为是无效的。步骤S101具体可以由第一光模块1010的状态确定单元1011执行。
第一光模块S1010中的状态确定单元1011通过以下方式确定所述M条发送逻辑通道中每条发送逻辑通道的状态：
状态确定单元1011获取待发往发送逻辑通道i的第一对齐标识符，i＝1，…，M；该第一对齐标识符的格式(format)可以和图4所示的200G/400G通道使用的对齐标识符的格式相同；
状态确定单元1011根据所述第一对齐标识符确定所述发送逻辑通道i的状态，所述发送逻辑通道i的状态包括锁定或未锁定。
第一光模块S1010中的状态确定单元1011通过以下方式确定所述M条接收逻辑通道中每条接收逻辑通道的状态：
状态确定单元1011通过接收逻辑通道q接收第二对齐标识符，q＝1，…，M；该第二对齐标识符的格式(format)可以和图4所示的200G/400G通道使用的对齐标识符的格式相同，即第二对齐标识符和第一对齐标识符具有相同的格式；
状态确定单元1011根据所述第二对齐标识符确定所述接收逻辑通道q的状态，所述接收逻辑通道q的状态包括锁定或未锁定。
根据第一对齐标识符确定发送逻辑通道i的状态与根据第二对齐标识符确定接收逻辑通道q的状态使用的方法相同，以下以根据第一对齐标识符确定发送逻辑通道i的状态为例说明如何确定逻辑通道的状态。
当所述第一对齐标识符与所述发送逻辑通道i的参考对齐标识符匹配，或所述第一对齐标识符与所述发送逻辑通道i的参考对齐标识符匹配且进入所述发送逻辑通道i的与所述发送逻辑通道i的参考对齐标识符匹配的对齐标识符的数量达到设定的数量，所述发送逻辑通道i锁定；当所述第一对齐标识符与所述发送逻辑通道i的参考对齐标识符不匹配，或所述第一对齐标识符与所述发送逻辑通道i的参考对齐标识符不匹配，且进入所述发送逻辑通道i的与所述发送逻辑通道i的参考对齐标识符不用匹配的对齐标识符的数量达到设定的数量时，所述发送逻辑通道i未锁定。
本申请中，为每条发送逻辑通道设置对应的参考对齐标识符，该参考对齐标识符可以是IEEE 802.3标准规定的对齐标识符，也可以是其他格式的用于确定逻辑通道是否锁定的对齐标识符。在400G场景下，当M为16时，每条逻辑通道的参考对齐标识符可以如图5所示。
所述第一对齐标识符与所述发送逻辑通道i的参考对齐标识符匹配，可以是所述第一对齐标识符与所述参考对齐标识符相同，也可以是所述第一对齐标识符与所述参考对齐标识符不一致的比特数少于或等于设定的阈值(例如，允许第一对齐标识符2个比特位的值与所述参考标识符的对应比特位的值不同)，还可以是所述第一对齐标识符与所述参考对齐标识符相同的比特数达到设定的比例(例如，所述第一对齐标识符中大于或等于98％的比特位的值与所述参考对齐标识符中对应比特位的值相同)。
通过执行步骤S101，第一光模块1010(例如其中的状态确定单元1011)可以确定第一光模块1010内部的M条发送逻辑通道和M条接收逻辑通道中每条逻辑通道的锁定状态。进一步地，第一网络设备100(具体例如是第一网络设备100的处理部件)也可以从第一光模块1010获取第一光模块1010内的每条逻辑通道的锁定状态。例如，第一光模块1010的状态确定单元1011可以实时将每条逻辑通道的锁定状态发送给第一网络设备100，第一光模块1010的状态确定单元1011也可以将所有M条发送逻辑通道和M条接收逻辑通道的锁定状态一次性发送给第一网络设备100，第一网络设备100也可以轮询第一光模块1010的每个逻辑通道，以实时获取每个逻辑通道的锁定状态。本申请对第一网络设备100获取第一光模块1010内的逻辑通道的锁定状态的方式不做限定。
在步骤S102中，当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，发送上行通知信息。
所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。根据场 景不同，所述上行通知信息可以是第一上行通信信息、第二上行通知信息或第三上行通知信息，下面将详细说明。
当第一光模块1010或第一网络设备100获取到第一光模块1010内的各逻辑通道的锁定状态后，第一光模块1010或第一网络设备100根据预设的规则判断所述第一光模块内的逻辑通道是否锁定(步骤S1011)，如果没有锁定，则继续执行步骤S101，如果锁定，则执行步骤S102。
其中，该预设的规则用于判断第一光模块内的逻辑通道是否锁定，即满足预设的规则时，第一光模块内的逻辑通道锁定，不满足预设的规则时，第一光模块内的逻辑通道未锁定。该预设的规则包括以下任意一项或多项：
M条发送逻辑通道全部锁定和/或M条发送逻辑通道全部锁定；M条发送逻辑通道中的一条发送逻辑通道锁定；
M条接收逻辑通道中的一条接收逻辑通道锁定；和
M条发送逻辑通道中的一条发送逻辑通道与对应的接收逻辑通道锁定。
当预设的规则为M条发送逻辑通道中的一条发送逻辑通道与对应的接收逻辑通道锁定时，由于第一光模块和第二光模块对各自的逻辑通道的编号方式不一定相同，因此，第一光模块1010上或第一网络设备100上需要配置映射关系，该映射关系记录第一光模块1010上的发送逻辑通道与接收逻辑通道的对应关系，该映射关系还可以进一步包括第二光模块2010上的发送逻辑通道与接收逻辑通道的对应关系。以A表示第一光模块上的逻辑通道，以B表示第二光模块上的逻辑通道，以T表示发送逻辑通道，R表示接收逻辑通道，以数字表示逻辑通道的编号，该映射关系例如可以如表1所示。
表1
AT0 AR1 BT1 BR2
AT1 AR3 BT0 BR1
AT2 AR2 BT3 BR3
…… …… …… ……
根据预设的规则不同，第一光模块1010内的逻辑通道锁定时，发送的上行通知信息的内容也不同，并且，本申请中，可以由第一光模块1010中的通知单元1012发送上行通知信息，也可以由第一网络设备100中的而处理部件1020发送上行通知信息。因此，步骤S102又包括以下各种实现方式：
方式一：如果预设的规则为所述M条发送逻辑通道全部锁定，和/或，所述M条接收逻辑通道全部锁定，则满足预设的规则时，第一光模块1010分别通过所述M条发送逻辑通道向第二光模块2010发送M个第一上行通知信息，即每个发送逻辑通道分别发送一个第一上行通知信息，每个第一上行通知信息指示发送所述第一上行通知信息的发送逻辑通道锁定，和/或,指示所述第一上行通知信息的发送逻辑通道对应的接收逻辑通道锁定。
方式二：如果预设的规则为所述M条发送逻辑通道全部锁定，和/或，所述M条发送所述M条接收逻辑通道全部锁定，则满足预设的规则时，所述第一网络设备的处理部件1020向所述第二网络设备的处理部件2020发送第二上行通知信息，所述 第二上行通知信息指示所述第一光模块的M条发送逻辑通道全部锁定和/或所述M条接收逻辑通道全部锁定。
方式三：如果预设的规则为所述M条发送逻辑通道中的一条发送逻辑通道锁定，所述M条接收逻辑通道中的一条接收逻辑通道锁定，或所述M条发送逻辑通道中的一条发送逻辑通道与对应的接收逻辑通道锁定，则满足预设的规则时，假设所述M条发送逻辑通道中的j条发送逻辑通道锁定，所述j条发送逻辑通道对应的接收通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，第一光模块1010通过该j条发送逻辑通道向所述第二光模块发送第一上行通知信息，所述第一上行通知信息指示所述j条发送逻辑通道锁定，或所述j条发送逻辑通道对应的接收逻辑通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M，当所述j条发送逻辑通道包括多条发送逻辑通道时，每条发送逻辑通道对应一个第一上行通知信息。
方式四：如果预设的规则为所述M条发送逻辑通道中的一条或多条发送逻辑通道锁定，所述M条接收逻辑通道中的一条或多条接收逻辑通道锁定，或所述M条发送逻辑通道中的一条或多条发送逻辑通道与对应的接收逻辑通道锁定，则满足预设的规则时，假设所述M条发送逻辑通道中的j条发送逻辑通道锁定，所述j条发送逻辑通道对应的接收通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，第一网络设备100的处理部件1020向所述第二网络设备200的处理部件2020发送第三上行通知信息，所述第三上行通知信息指示所述j条发送逻辑通道锁定，所述发送逻辑j对应的接收通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
上述各实现方式中，所述第一上行通知信息，所述第二上行通知信息或所述第三上行信息可以指示不同场景下逻辑通道的锁定，具体指示哪种场景下的锁定，可以根据需要设置。
在一种实现方式中，上述方式一中的第一上行通知信息和方式三中的第一上行通知信息具有相同的格式。每个第一上行通知信息包括传输所述第一上行通知信息的发送逻辑通道的标识，以及锁定标记，该锁定标记用于指示所述第一上行通知信息的发送逻辑通道已锁定。在不同的发送逻辑通道中传输的第一上行通知信息包括不同的通道标识。在不同的发送逻辑通道中传输的第一上行通知信息可以包括相同的锁定标记。当第一上行通知信息为对齐标识符，所述锁定标记通过修改所述对齐标识符中的指定字段得到。所述锁定标识可以一次出现或多次重复出现。当所述锁定标识多次重复出现时，可以确保接收端正确识别锁定标识。上述的第一上行通知信息，可以通过修改图4或图5所示的对齐标识符得到的，也可以通过修改其他格式的对齐标识符中的指定字段得到。例如，当第一光模块为200G/400G光模块时，则可以修改图5所示的该发送逻辑通道的对齐标识符(即参考对齐标识符)中的UP 0，UP 1和UP 2中一个或多个字段的值，使修改后的{UP 0，UP 1，UP 2}作为锁定标记指示一个发送逻辑通道锁定，M个发送逻辑通道全部锁定，或M个发送逻辑通道和M个接收逻辑通道全部锁定。优选地，当M个发送逻辑通道全部锁定时，和/或M条接收逻辑通道全部锁定时，所述M条发送逻辑通道中分别传输的M个第一上行通 信信息具有相同的锁定标记。
上述方式二中的第二上行通知信息和方式四中的第三上行通知信息可以具有相同的格式或不同的格式。上述第二上行通知信息和第三上行通知信息可以承载在二层以太网帧或IP数据包中。在方式二中，第一网络设备100通过一个第二上行通知信息即可通知全部发送逻辑通道锁定，和/或全部接收逻辑通道锁定。在方式四中，第一网络设备100可以在确定一个或多个发送逻辑通道锁定，一个或多个接收逻辑通道锁定或确定一个发送逻辑通道与对应的接收逻辑通道锁定时发送第三上行通知信息。
通过执行步骤S102，第一光模块1010或第一网络设备100可以使第二光模块2010获知第一光模块1010中的各逻辑通道的锁定状态。
当由第一光模块1010中的通知单元1012发送该第一上行通知信息时，可以由状态确定单元1011确定第一光模块1010内的逻辑通道的锁定状态是否满足预设的规则，并在第一光模块1010内的逻辑通道的锁定状态满足预设的规则时触发所述通知单元1012发送所述第一上行通知信息，也可以由通知单元1012根据状态确定单元1011检测到的第一光模块1010内的逻辑通道的锁定状态来确定第一光模块1010内的逻辑通道的锁定状态是否满足预设的规则。
在步骤S103中，所述第一网络设备或所述第一光模块获取下行通知信息，所述下行通知信息用于使所述第一光模块确定所述第二光模块内的逻辑通道锁定。
其中，所述下行通知信息由第二网络设备200或第二光模块2010发送，该下行通知信息与上述的上行通知信息的生成条件和发送方式类似。例如：
场景一：第一光模块1010通过所述M个接收逻辑通道接收M个第一下行通知信息，所述M个第一下行通知信息指示所述第二光模块2010内的逻辑通道锁定，所述第二光模块2010内的逻辑通道锁定包括所述第二光模块2010的M条接收逻辑通道锁定和M条发送逻辑通道锁定。
场景二：所述第一网络设备100的处理部件1020接收所述第二网络设备200的处理部件2020发送的第二下行通知信息，并将所述第二下行通知信息发送给所述第一光模块1010，所述第二下行通知信息指示所述第二光模块2010内的逻辑通道锁定，所述第二光模块2010内的逻辑通道锁定包括所述第二光模块2010的M条接收逻辑通道锁定和M条发送逻辑通道锁定。
场景三：第一光模块1010通过所述M个接收逻辑通道的p条接收逻辑通道接收第一下行通知信息，所述第一下行通知信息指示所述p条接收逻辑通道对应的第二光模块2010的发送逻辑通道与接收逻辑通道锁定，p大于1小于M，当所述p条接收逻辑通道包括多条接收逻辑通道时，每条接收逻辑通道对应一个第一下行通知信息。
场景四：第一网络设备100的处理部件1020接收所述第二网络设备200的处理部件2020发送的第三下行通知信息，并将所述第三下行通知信息发送给所述第一光模块1010，所述第二下行通知信息指示p条接收逻辑通道对应的第二光模块2010的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
由于本实施方式中第二光模块2010是接收端，第二光模块2010能够向第一光模块1010返回数据，说明第二光模块的接收逻辑通道必然已经锁定。因此，场景 一和场景二中，该M个第一下行通知信息和该第二下行通知信息，指示第二光模块2010的M个接收逻辑通道和M个发送逻辑通道全部锁定；场景三和场景四中，该第一下行通知和该第三下行通知指示所述p条接收逻辑通道对应的第二光模块2010的发送逻辑通道与接收逻辑通道锁定。
上述场景一和场景三中的第一下行通知信息可以由第一光模块1010中的状态确定单元1012接收。上述场景二中的第二下行通知信息和场景四中的第三下行通知信息可以由第一网络设备100中的处理部件1020接收，并发送给所述第一光模块1010中的状态确定单元1012。处理部件1020可以将第二下行通知信息和第四下行通知信息转换成第一光模块1010状态确定单元1012以识别的格式再发送。上述第二下行通知信息和第三下行通知信息可以承载在二层以太网帧或IP数据包中。
在S104中，当所述第一光模块内的逻辑通道锁定，且所述第二光模块内的逻辑通道锁定后，所述第一光模块处理数据。具体可以是，第一光模块加密发往所述第二光模块的数据，或所述第一光模块解密从所述第二光模块接收的数据。其中，该处理还可以包括在数据中插入握手信息等。
步骤S104可以由第一光模块1010中的加密/解密单元1013执行，并且，步骤S104中的加密数据的操作或解密数据的操作，仅仅是一种处理数据方式。第一光模块1010还可以包括其他的处理单元，相应地，步骤S104还可以被其他的数据处理操作代替。
通过本申请的上述实施方式，可以保证在第一光模块和第二光模块中的内部逻辑通道都锁定的情况下，才对逻辑通道中传输的数据执行加密/解密操作，或者其他操作，可以提高数据传输的可靠性。
以下结合图4和图5的对齐标识符的格式，以及图12的数据传输过程示意图，说明本申请实施例提供的状态通知方法的应用。当第一网络设备100向第二网络设备200传输数据时，如图12所示，第一网络设备100的PCS周期性向数据流中插入AM，PCS插入的AM均为图4或图5所示的标准AM。第一光模块1010的状态确定单元实时检测第一光模块的每个发送逻辑通道和每个接收逻辑通道的状态。当该数据流到达第一光模块1010时，第一光模块1010将该数据流发送到M个发送逻辑通道，并针对每个发送逻辑通道和/或接收逻辑通道，识别出该发送逻辑通道和/或接收逻辑通道中传输的数据流中的AM，根据该AM以及发送逻辑通道和/或接收逻辑通道的参考AM(参考AM即为图5列出的AM)，确定第一光模块1010内的逻辑通道的是否锁定，以及确定第二光模块内的逻辑通道是否锁定(第一光模块1010和第二光模块2010内的逻辑通道是否锁定的各种实现方式，参考上述实施例的描述)。
当第一光模块1010内的逻辑通道未锁定时，第一光模块发送PCS层插入的标准的AM(即第一光模块不修改AM而直接发送)。当第一光模块1010内的逻辑通道锁定，且第二光模块内的逻辑通道未锁定时，第一光模块修改获取到的AM，使该AM携带锁定标记。例如，该AM为图5所示的AM，该锁定标记通过修改图5所示的AM中的UP x字段得到，该UP x字段可以是UP 0，UP 1和UP 2中的一个或多个。该锁定标记可以占用一个或多个比特，该锁定标记的值可以约定，例如，该锁定标记可以为“01”或“0011”等。为了避免接收端错误识别锁定标记，可以将该锁定标记重复传输(即在AM中重复 出现)。例如，在图12中，锁定标记为“01”，则UP 0，UP 1和UP 2的值均为“01010101”，这样，通过一个AM可以传输12次锁定标记，则该锁定标记出现错误的概率将会非常小。例如，假设逻辑通道的比特误码率(bit error ratio)为BER＝1E^-4，每比特的可靠性＝1-BER，12倍冗余，即12个比特中正确比特数大于等于7的概率
Figure PCTCN2021139424-appb-000001
AM锁定比特序列正确性概率＝P 2。考虑AM在每个通道出现的时间周期，该比特序列出错的时间约万年，可靠性极高。
当第一光模块1010内的逻辑通道锁定，并且第二光模块2010内的逻辑通道也锁定时，第一光模块101修改在逻辑通道锁定后获取到的对应该逻辑通道的第一个AM，使该AM包括复帧标记，该复帧标记指示该AM后传输的数据为经过处理的数据，该复帧标记可以占用一个或多个比特，并且该复帧标记与该锁定标记不同，该复帧标记也可以在AM中重复出现，以提高传输可靠性。如图12所示，复帧标记为“10”，则UP 0，UP 1和UP 2的值均为“01010101”。包括复帧标记的AM后的AM则可以包括秘钥，IV等加密信息，以使第二光模块2010接收到数据流后根据该秘钥和IV后解密该数据流。
如图13所示，为本申请实施例提供的另一种数据传输过程示意图。与图12不同的是，图13中不包括复帧标识，当第一光模块1010内的逻辑通道锁定，并且第二光模块2010内的逻辑通道也锁定时，第一光模块1010修改在逻辑通道锁定后获取到的对应该逻辑通道的每个AM，使该AM包括加密标记，该加密标记指示该AM后的数据流为加密的数据流。接收到包括该AM的数据流后，第二光模块2010解密该数据流。
进一步地，图12和13中的复帧标记和加密标记也可以为被替换为其他的信息，以使光模块实现更多的操作。
当在图7所示的场景下，采用图12或图13所示的方式传输数据时，可以在不增加网络设备的传输带宽的情况下，实现光模块内的逻辑通道的锁定状态的通知，并使光模块在本端和对端的逻辑通道锁定后，执行加密/解密或其他操作，提高了操作的可靠性。
本申请中的第一光模块1011中的加密/解密组件，可以由软件实现，也可以由硬件实现。当由硬件实现时，可以由独立的芯片实现，也可以由逻辑电路实现，该芯片或该逻辑电路可以集成在光模块中。
本申请实施例中涉及的多个，是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的描述在适当情况下可以互换，以便使实施例能够以除了在本申请图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。在本申请中出现的对步骤进行的命名或者编号，并不意味着必须按照命名或者编号所指示的时间/逻辑先后顺序执行方法流程中的步骤，已经命名或者编号的流程步骤可以根据要实现的技术目的变更执行次序，只要能达到相同或者相类似的技术效果即可。本申请中所出现的单元的划分，是一种逻辑上的划分，实 际应用中实现时可以有另外的划分方式，例如多个单元可以结合成或集成在另一个系统中，或一些特征可以忽略，或不执行，另外，所显示的或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元之间的间接耦合或通信连接可以是电性或其他类似的形式，本申请中均不作限定。并且，作为分离部件说明的单元或子单元可以是也可以不是物理上的分离，可以是也可以不是物理单元，或者可以分布到多个电路单元中，可以根据实际的需要选择其中的部分或全部单元来实现本申请方案的目的。
以上该仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (35)

  1. 一种状态通知方法，其特征在于，包括：
    确定第一光模块内的逻辑通道的锁定状态，所述第一光模块属于第一网络设备，所述锁定状态包括锁定或未锁定；
    当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，发送上行通知信息，所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。
  2. 根据权利要求1所述的方法，其特征在于，还包括：
    获取下行通知信息，所述下行通知信息用于使所述第一光模块确定所述第二光模块内的逻辑通道锁定。
  3. 根据权利要求2所述的方法，其特征在于，当所述第一光模块内的逻辑通道锁定，且所述第二光模块内的逻辑通道锁定后，所述方法还包括：
    所述第一光模块加密发往所述第二光模块的数据；
    或
    所述第一光模块解密从所述第二光模块接收的数据。
  4. 根据权利要求1-3中任意一项所述的方法，其特征在于，所述确定所述第一光模块内的逻辑通道的锁定状态包括：
    所述第一光模块确定所述第一光模块内的逻辑通道的锁定状态；或
    所述第一网络设备的处理部件从所述第一光模块获取所述第一光模块内的逻辑通道的锁定状态。
  5. 根据权利要求1-4中任意一项所述的方法，其特征在于，所述第一光模块内的逻辑通道包括M条发送逻辑通道和M条接收逻辑通道，M大于等于1，所述确定第一光模块内的逻辑通道的锁定状态包括：
    确定所述M条发送逻辑通道中每条发送逻辑通道的状态；和/或
    确定所述M条接收逻辑通道中每条接收逻辑通道的状态。
  6. 根据权利要求5所述的方法，其特征在于，所述第一光模块内的逻辑通道锁定包括：所述M条发送逻辑通道全部锁定，和/或，所述M条接收逻辑通道全部锁定。
  7. 根据权利要求6所述的方法，其特征在于，所述发送上行通知信息包括：
    所述第一光模块分别通过所述M条发送逻辑通道向所述第二光模块发送M个第一上行通知信息，所述M个第一上行通知信息中的每个第一上行通知信息指示发送所述第一上行通知信息的发送逻辑通道锁定，和/或指示所述第一上行通知信息的发送逻辑通道对应的接收逻辑通道锁定；或
    所述第一网络设备的处理部件向所述第二网络设备的处理部件发送第二上行通知信息，所述第二上行通知信息指示所述第一光模块的所述M条发送逻辑通道和/或所述M条接收逻辑通道全部锁定。
  8. 根据权利要求5所述的方法，其特征在于，所述第一光模块内的逻辑通道锁定包括以下一项或多项：
    所述M条发送逻辑通道中的一条或多条发送逻辑通道锁定；
    所述M条接收逻辑通道中的一条或多条接收逻辑通道锁定；和，
    所述M条发送逻辑通道中的一条或多条发送逻辑通道与对应的接收逻辑通道锁定。
  9. 根据权利要求8所述的方法，其特征在于，所述发送上行通知信息包括：
    所述第一光模块通过j条发送逻辑通道向所述第二光模块发送第一上行通知信息，所述第一上行通知信息指示所述j条发送逻辑通道锁定，或所述j条发送逻辑通道对应的接收逻辑通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M，当所述j条发送逻辑通道包括多条发送逻辑通道时，每条发送逻辑通道对应一个第一上行通知信息；或
    所述第一网络设备的处理部件向所述第二网络设备的处理部件发送第三上行通知信息，所述第三上行通知信息指示j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
  10. 根据权利要求7或9所述的方法，其特征在于，每个第一上行通知信息包括传输所述第一上行通知信息的发送逻辑通道的标识，以及锁定标记。
  11. 根据权利要求10所述的方法，其特征在于，所述第一上行通知信息为对齐标识符，所述锁定标记通过修改所述对齐标识符中的指定字段得到。
  12. 根据权利要求11所述的方法，其特征在于，所述指定字段为200G/400G对齐标识符中的UP x字段。
  13. 根据权利要求12所述的方法，其特征在于，所述锁定标识在所述UP x字段中重复出现。
  14. 根据权利要求5-13中任意一项所述的方法，其特征在于，所述获取下行通知信息包括：
    所述第一光模块通过所述M个接收逻辑通道接收M个第一下行通知信息，所述M个第一下行通知信息指示所述第二光模块内的逻辑通道锁定；或
    所述第一网络设备的处理部件接收所述第二网络设备的处理部件发送的第二下行通知信息，并将所述第二下行通知信息发送给所述第一光模块，所述第二下行通知信息指示所述第二光模块内的逻辑通道锁定。
  15. 根据权利要求5-13中任意一项所述的方法，其特征在于，所述获取下行通知信息包括：
    所述第一光模块通过所述M个接收逻辑通道的p条接收逻辑通道接收第一下行通知信息，所述第一下行通知信息指示所述p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M，当所述p条接收逻辑通道包括多条接收逻辑通道时，每条接收逻辑通道对应一个第一下行通知信息；或
    所述第一网络设备的处理部件接收所述第二网络设备的处理部件发送的第三下行通知信息，并将所述第三下行通知信息发送给所述第一光模块，所述第三下行通知信息指示p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
  16. 一种光模块，其特征在于，所述光模块为第一光模块，所述第一光模块包括：
    状态确定单元，用于确定所述第一光模块内的逻辑通道的锁定状态，所述第一光模块属于第一网络设备，所述锁定状态包括锁定或未锁定；
    通知单元，用于当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，发送上行通知信息，所述上行通知信息用于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于第二网络设备，所述第一光模块连接所述第二光模块。
  17. 根据权利要求16所述的光模块，其特征在于，所述状态确定单元还用于获取下行通知信息，所述下行通知信息用于使所述状态确定单元确定所述第二光模块内的逻辑通道锁定。
  18. 根据权利要求17所述的光模块，其特征在于，所述第一光模块还包括加密/解密单元，用于在所述第一光模块内的逻辑通道锁定，且所述第二光模块内的逻辑通道锁定时，加密发往所述第二光模块的数据，或解密从所述第二光模块接收的数据。
  19. 根据权利要求16-18中任意一项所述的光模块，其特征在于，第一光模块内的逻辑通道包括M条发送逻辑通道和M条接收逻辑通道，所述状态确定单元用于：确定所述M条发送逻辑通道中每条发送逻辑通道的状态，和/或，确定所述M条发送逻辑通道中每条发送逻辑通道的状态。
  20. 根据权利要求19所述的光模块，其特征在于，所述第一光模块内的逻辑通道锁定包括所述M条发送逻辑通道全部锁定，和/或，所述M条接收逻辑通道全部锁定。
  21. 根据权利要求20所述的光模块，其特征在于，所述通知单元用于：
    分别通过所述M条发送逻辑通道向所述第二光模块发送M个第一上行通知信息，所述M个第一上行通知信息中的每个第一上行通知信息指示发送所述第一上行通知信息的发送逻辑通道锁定，和/或，指示所述第一上行通知信息的发送逻辑通道对应的接收逻辑通道锁定；或
    向所述第一网络设备的处理部件发送第二上行通知信息，以使所述第一网络设备的处理部件向所述第二网络设备的处理部件发送所述第二上行通知信息，所述第二上行通知信息指示所述第一光模块的所述M条发送逻辑通道和/或所述M条接收逻辑通道全部锁定。
  22. 根据权利要求19所述的光模块，其特征在于，所述第一光模块内的逻辑通道锁定包括以下一项或多项：
    所述M条发送逻辑通道中的一条或多条发送逻辑通道锁定；
    所述M条接收逻辑通道中的一条或多条接收逻辑通道锁定；和
    所述M条发送逻辑通道中的一条或多条发送逻辑通道与对应的接收逻辑通道锁定。
  23. 根据权利要求22所述的光模块，其特征在于，所述通知单元用于：
    通过j条发送逻辑通道向所述第二光模块发送第一上行通知信息，所述第一上行通知信息指示所述j条发送逻辑通道锁定，或所述j条发送逻辑通道对应的接收逻辑通道锁定，或所述j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M，当所述j条发送逻辑通道包括多条发送逻辑通道时，每条发送逻辑通道对应一个第一上行通知信息；或
    向所述第一网络设备的处理部件发送第三上行通知信息，以使所述第一网络设备的处理部件向所述第二网络设备的处理部件发送所述第三上行通知信息，所述第三上行通知信息指示j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
  24. 根据权利要求21或23所述的光模块，其特征在于，当所述通知单元发送第一上行通知信息时，所述第一上行通知信息包括传输所述第一上行通知信息的发送逻辑通道的标识，以及锁定标记。
  25. 根据权利要求24所述的光模块，其特征在于，所述第一上行通知信息为对齐标识符，所述锁定标记通过修改所述对齐标识符中的指定字段的值得到。
  26. 根据权利要求24或25所述的光模块，其特征在于，所述第一光模块为200G或更高速率的光模块。
  27. 根据权利要求26所述的光模块，其特征在于，所述指定字段为200G/400G对齐标识符中的UP x字段。
  28. 根据权利要求27所述的光模块，其特征在于，所述锁定标识在所述UP x字段中重复出现。
  29. 根据权利要求19-28中任意一项所述的光模块，其特征在于，在获取下行通知信息时，所述状态确定单元用于：
    通过所述M个接收逻辑通道接收M个第一下行通知信息，所述M个第一下行通知信息指示所述第二光模块内的逻辑通道锁定；或
    接收所述第一网络设备的处理部件发送的第二下行通知信息，所述第二下行通知信息指示所述第二光模块内的逻辑通道锁定。
  30. 根据权利要求19-28中任意一项所述的光模块，其特征在于，在获取下行通知信息时，所述状态确定单元用于：
    通过所述M个接收逻辑通道的p条接收逻辑通道接收第一下行通知信息，所述第一下行通知信息指示所述p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M；或
    接收所述第一网络设备的处理部件发送的第三下行通知信息，所述第三下行通知信息指示p条接收逻辑通道对应的所述第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M。
  31. 一种网络设备，其特征在于，包括第一光模块和处理部件，所述第一光模块为权利要求16-30中任意一项所述的光模块，所述处理部件用于：
    从所述第一光模块获取所述第一光模块内的逻辑通道的锁定状态；以及
    当所述锁定状态指示所述第一光模块内的逻辑通道锁定时，向第二网络设备发送上行通知信息，所述上行通知信息用于指示所述第一光模块内的逻辑通道锁定。
  32. 根据权利要求31所述的网络设备，其特征在于，
    所述上行通知信息指示所述第一光模块的M条发送逻辑通道和/或M条接收逻辑通道全部锁定；或
    所述上行通知信息指示所述第一光模块的j条发送逻辑通道锁定，或j条发送逻辑通道对应的接收逻辑通道锁定，或j条发送逻辑通道与对应接收逻辑通道锁定，j大于1小于M。
  33. 根据权利要求31或32所述的网络设备，其特征在于，所述处理部件还用于接收所述第二网络设备发送的下行通知信息，并将所述下行通知信息发送给所述第一光模块；
    所述下行通知信息指示第二光模块内的逻辑通道锁定；或
    所述下行通知信息指示p条接收逻辑通道对应的第二光模块的发送逻辑通道与接收逻辑通道锁定，p大于1小于M；
    所述第二光模块属于所述第二网络设备，所述第二光模块连接所述第一光模块。
  34. 一种网络系统，其特征在于，包括第一网络设备和第二网络设备，所述第一网络设备为如权利要求31-33中任意一项所述的网络设备；
    所述第一网络设备用于获取第一光模块内的逻辑通道的锁定状态，并向所述第二网络设备发送上行通知信息，所述上行通知信息于使第二光模块确定所述第一光模块内的逻辑通道锁定，所述第二光模块属于所述第二网络设备，所述第一光模块连接所述第二光模块。
  35. 根据权利要求34所述的网络系统，其特征在于，所述第一网络设备还用于接收所述第二网络设备发送的下行通知信息，并将所述下行通知信息发送给所述第一光模块，所述下行通知信息用于使所述第一光模块确定所述第二光模块内的逻辑通道锁定。
PCT/CN2021/139424 2021-01-08 2021-12-18 一种状态通知方法、光模块、网络设备以及网络系统 WO2022148230A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21917270.7A EP4262093A4 (en) 2021-01-08 2021-12-18 STATUS NOTIFICATION METHOD, OPTICAL MODULE, NETWORK DEVICE AND NETWORK SYSTEM
US18/349,645 US20230353255A1 (en) 2021-01-08 2023-07-10 Status Notification Method, Optical Module, Network Device, and Network System

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202110021317.3 2021-01-08
CN202110021317 2021-01-08
CN202110363540.6A CN114760544A (zh) 2021-01-08 2021-04-02 一种物理层状态通知方法、光模块、网络设备以及网络系统
CN202110363540.6 2021-04-02

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/349,645 Continuation US20230353255A1 (en) 2021-01-08 2023-07-10 Status Notification Method, Optical Module, Network Device, and Network System

Publications (1)

Publication Number Publication Date
WO2022148230A1 true WO2022148230A1 (zh) 2022-07-14

Family

ID=82326236

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/139424 WO2022148230A1 (zh) 2021-01-08 2021-12-18 一种状态通知方法、光模块、网络设备以及网络系统

Country Status (4)

Country Link
US (1) US20230353255A1 (zh)
EP (1) EP4262093A4 (zh)
CN (1) CN114760544A (zh)
WO (1) WO2022148230A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117040843A (zh) * 2023-08-10 2023-11-10 昆高新芯微电子(江苏)有限公司 多DP交换芯片实现MACsec的方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100229067A1 (en) * 2009-03-09 2010-09-09 Ganga Ilango S Cable Interconnection Techniques
US20100229071A1 (en) * 2009-03-09 2010-09-09 Ilango Ganga Interconnections techniques
CN104869176A (zh) * 2014-02-21 2015-08-26 凯为公司 使用共享数据路径的多个以太网端口以及端口类型
US9876709B1 (en) * 2014-08-28 2018-01-23 Xilinx, Inc. Alignment detection in a multi-lane network interface
WO2020244412A1 (zh) * 2019-06-04 2020-12-10 华为技术有限公司 一种以太网数据传输的方法和通信设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101250538B1 (ko) * 2009-06-26 2013-04-03 한국전자통신연구원 이더넷 장치 및 이더넷 장치의 레인 운용 방법
KR101238917B1 (ko) * 2009-11-12 2013-03-06 한국전자통신연구원 이더넷 장치 및 그의 전송률 조절 방법
US9413454B1 (en) * 2014-06-30 2016-08-09 Juniper Networks, Inc. Automatic bandwidth adjustment on multi-fiber optics

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100229067A1 (en) * 2009-03-09 2010-09-09 Ganga Ilango S Cable Interconnection Techniques
US20100229071A1 (en) * 2009-03-09 2010-09-09 Ilango Ganga Interconnections techniques
CN104869176A (zh) * 2014-02-21 2015-08-26 凯为公司 使用共享数据路径的多个以太网端口以及端口类型
US9876709B1 (en) * 2014-08-28 2018-01-23 Xilinx, Inc. Alignment detection in a multi-lane network interface
WO2020244412A1 (zh) * 2019-06-04 2020-12-10 华为技术有限公司 一种以太网数据传输的方法和通信设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4262093A4

Also Published As

Publication number Publication date
EP4262093A4 (en) 2024-06-05
CN114760544A (zh) 2022-07-15
EP4262093A1 (en) 2023-10-18
US20230353255A1 (en) 2023-11-02

Similar Documents

Publication Publication Date Title
US10158686B2 (en) System and method for providing an Ethernet interface
US7703132B2 (en) Bridged cryptographic VLAN
US20080052533A1 (en) Relay apparatus for encrypting and relaying a frame
WO2015032259A1 (zh) 对数据进行处理的方法及装置
JP3774455B2 (ja) イーサネット（登録商標）受動型光加入者網システムにおけるデータ転送方法
WO2016068655A1 (en) Method of performing device to device communication between user equipments
US20230353255A1 (en) Status Notification Method, Optical Module, Network Device, and Network System
US20230308259A1 (en) Data transmission method, communication apparatus, and communication system
CN107683592A (zh) 数据处理方法、装置和系统
US20240283565A1 (en) Interface, electronic device, and communication system
CN112804265B (zh) 一种单向网闸接口电路、方法及可读存储介质
CN109327482A (zh) P2p通讯引入身份验证防伪和非对等加密的数据传输方式
US20230269074A1 (en) Encryption/decryption system, optical module, and related apparatus and system
US20230269075A1 (en) Devices, systems, and methods for integrating encryption service channels with a data path
US20220149988A1 (en) Method for Adjusting Transmission Rate, Processor, Network Device, and Network System
CN106713149A (zh) 路由器的子卡和线卡板
WO2022116711A1 (zh) 一种数据传输方法、通信装置及通信系统
EP4387162A1 (en) Data transmission method and device, readable storage medium, and chip system
CN115766046A (zh) 一种数据传输方法、设备、可读存储介质和芯片系统
CN103532788A (zh) Epon终端用户流量检测设备
US20240015009A1 (en) AUTOMATIC IN-BAND MEDIA ACCESS CONTROL SECURITY (MACsec) KEY UPDATE FOR RETIMER DEVICE
WO2019023824A1 (zh) 一种比特块流处理、速率匹配、交换的方法和装置
Tian et al. PHYSec: A Novel Physical Layer Security Architecture for Ethernet
CN115225296A (zh) 一种加密数据的传输方法及相关设备
EP3565198A1 (en) Transmitting security information over a wired link

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21917270

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021917270

Country of ref document: EP

Effective date: 20230710

NENP Non-entry into the national phase

Ref country code: DE